From 893d47fb7c89c41b33253c51cbff01f612133e68 Mon Sep 17 00:00:00 2001
From: Saarika Bhasi <55930906+saarikabhasi@users.noreply.github.com>
Date: Mon, 23 Jan 2023 09:19:48 -0500
Subject: [PATCH 01/54] [Enterprise Search] Move healthcolor to shared folder
 (#149271)

## Summary

Based on the PR
[comment](https://github.com/elastic/kibana/pull/149241#discussion_r1081847139),
Moving healthStatus color map to
[public/applications/shared](https://github.com/elastic/kibana/tree/5df280162515c9429cbd172a56eba2baace6baf1/x-pack/plugins/enterprise_search/public/applications/shared)
folder
---
 .../search_index_selectable.tsx               | 13 ++---------
 .../components/engine/engine_indices.tsx      |  8 +------
 .../search_indices/indices_table.tsx          |  8 +------
 .../shared/constants/health_colors.ts         | 22 +++++++++++++++++++
 4 files changed, 26 insertions(+), 25 deletions(-)
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/shared/constants/health_colors.ts

diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_creation/search_index_selectable.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_creation/search_index_selectable.tsx
index 93e045d2ecb267..22add9bdaa518f 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_creation/search_index_selectable.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/engine_creation/search_index_selectable.tsx
@@ -21,6 +21,7 @@ import {
 import { i18n } from '@kbn/i18n';
 
 import './engine_creation.scss';
+import { healthColorsMapSelectable } from '../../../shared/constants/health_colors';
 
 export interface SearchIndexSelectableOption {
   label: string;
@@ -47,16 +48,6 @@ export interface SearchIndexSelectableOption {
   checked?: 'on';
   count: number;
 }
-
-const healthColorsMap = {
-  red: 'danger',
-  RED: 'danger',
-  green: 'success',
-  GREEN: 'success',
-  yellow: 'warning',
-  YELLOW: 'warning',
-};
-
 interface IndexStatusDetailsProps {
   option?: SearchIndexSelectableOption;
 }
@@ -67,7 +58,7 @@ export const IndexStatusDetails: React.FC<IndexStatusDetailsProps> = ({ option }
   ) : (
     <EuiFlexGroup className="entSearch__indexListItem" alignItems="center">
       <EuiFlexItem grow={false}>
-        <EuiHealth color={option.health ? healthColorsMap[option.health] : ''}>
+        <EuiHealth color={option.health ? healthColorsMapSelectable[option.health] : ''}>
           {option.health ?? '-'}
         </EuiHealth>
       </EuiFlexItem>
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx
index 537c83cac5b1ea..bcda0026ddd3c9 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engine/engine_indices.tsx
@@ -22,6 +22,7 @@ import { i18n } from '@kbn/i18n';
 import { EnterpriseSearchEngineIndex } from '../../../../../common/types/engines';
 
 import { CANCEL_BUTTON_LABEL } from '../../../shared/constants';
+import { healthColorsMap } from '../../../shared/constants/health_colors';
 import { generateEncodedPath } from '../../../shared/encode_path_params';
 import { KibanaLogic } from '../../../shared/kibana';
 import { EuiLinkTo } from '../../../shared/react_router_helpers';
@@ -33,13 +34,6 @@ import { EnterpriseSearchEnginesPageTemplate } from '../layout/engines_page_temp
 import { EngineIndicesLogic } from './engine_indices_logic';
 import { EngineViewLogic } from './engine_view_logic';
 
-const healthColorsMap = {
-  green: 'success',
-  red: 'danger',
-  unavailable: '',
-  yellow: 'warning',
-};
-
 export const EngineIndices: React.FC = () => {
   const { engineName, isLoadingEngine } = useValues(EngineViewLogic);
   const { engineData } = useValues(EngineIndicesLogic);
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_table.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_table.tsx
index 6e506c6bc66a30..fd0bc55fdc7e32 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_table.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_indices/indices_table.tsx
@@ -19,6 +19,7 @@ import {
 import { i18n } from '@kbn/i18n';
 
 import { Meta } from '../../../../../common/types';
+import { healthColorsMap } from '../../../shared/constants/health_colors';
 import { generateEncodedPath } from '../../../shared/encode_path_params';
 import { KibanaLogic } from '../../../shared/kibana';
 import { EuiLinkTo } from '../../../shared/react_router_helpers';
@@ -32,13 +33,6 @@ import {
   ingestionStatusToText,
 } from '../../utils/ingestion_status_helpers';
 
-const healthColorsMap = {
-  green: 'success',
-  red: 'danger',
-  unavailable: '',
-  yellow: 'warning',
-};
-
 interface IndicesTableProps {
   indices: ElasticsearchViewIndex[];
   isLoading?: boolean;
diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/constants/health_colors.ts b/x-pack/plugins/enterprise_search/public/applications/shared/constants/health_colors.ts
new file mode 100644
index 00000000000000..9c87507ae69940
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/shared/constants/health_colors.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const healthColorsMap = {
+  red: 'danger',
+  green: 'success',
+  yellow: 'warning',
+  unavailable: '',
+};
+
+export const healthColorsMapSelectable = {
+  red: 'danger',
+  RED: 'danger',
+  green: 'success',
+  GREEN: 'success',
+  yellow: 'warning',
+  YELLOW: 'warning',
+};

From bdfe63613eb5aeec4265ec15563cd439dcebd18f Mon Sep 17 00:00:00 2001
From: Nicolas Chaulet <nicolas.chaulet@elastic.co>
Date: Mon, 23 Jan 2023 10:39:43 -0400
Subject: [PATCH 02/54] [Fleet] Move view agent dashboard button (#149315)

---
 .../components/agent_dashboard_link.test.tsx  |  9 +--
 .../components/agent_dashboard_link.tsx       | 27 ++++++--
 .../agent_details/agent_details_overview.tsx  | 63 ++++++++++++++-----
 .../agents/agent_details_page/index.tsx       |  4 --
 4 files changed, 73 insertions(+), 30 deletions(-)

diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx
index 3fc27cfbc9263b..6e425b53522a66 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.test.tsx
@@ -87,7 +87,7 @@ describe('AgentDashboardLink', () => {
     expect(result.getByRole('button').hasAttribute('disabled')).toBeTruthy();
   });
 
-  it('should not enable the button if elastic_agent package is installed and policy do not have monitoring enabled', async () => {
+  it('should link to the agent policy settings tab if logs and metrics are not enabled for that policy', async () => {
     mockedUseGetPackageInfoByKey.mockReturnValue({
       isLoading: false,
       data: {
@@ -107,14 +107,15 @@ describe('AgentDashboardLink', () => {
         }
         agentPolicy={
           {
+            id: 'policy123',
             monitoring_enabled: [],
           } as unknown as AgentPolicy
         }
       />
     );
 
-    expect(result.queryByRole('link')).toBeNull();
-    expect(result.queryByRole('button')).not.toBeNull();
-    expect(result.getByRole('button').hasAttribute('disabled')).toBeTruthy();
+    const link = result.queryByRole('link');
+    expect(link).not.toBeNull();
+    expect(link?.getAttribute('href')).toBe('/mock/app/fleet/policies/policy123/settings');
   });
 });
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx
index 658a94dc7a5643..93be90219cdc9f 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_dashboard_link.tsx
@@ -8,8 +8,9 @@
 import React from 'react';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { EuiButton, EuiToolTip } from '@elastic/eui';
+import styled from 'styled-components';
 
-import { useGetPackageInfoByKey, useKibanaLink } from '../../../../hooks';
+import { useGetPackageInfoByKey, useKibanaLink, useLink } from '../../../../hooks';
 import type { Agent, AgentPolicy } from '../../../../types';
 import {
   FLEET_ELASTIC_AGENT_PACKAGE,
@@ -32,11 +33,16 @@ function useAgentDashboardLink(agent: Agent) {
   };
 }
 
+const EuiButtonCompressed = styled(EuiButton)`
+  height: 32px;
+`;
+
 export const AgentDashboardLink: React.FunctionComponent<{
   agent: Agent;
   agentPolicy?: AgentPolicy;
 }> = ({ agent, agentPolicy }) => {
   const { isInstalled, link, isLoading } = useAgentDashboardLink(agent);
+  const { getHref } = useLink();
 
   const isLogAndMetricsEnabled = agentPolicy?.monitoring_enabled?.length ?? 0 > 0;
 
@@ -44,15 +50,15 @@ export const AgentDashboardLink: React.FunctionComponent<{
     !isInstalled || isLoading || !isLogAndMetricsEnabled ? { disabled: true } : { href: link };
 
   const button = (
-    <EuiButton fill {...buttonArgs} isLoading={isLoading}>
+    <EuiButtonCompressed {...buttonArgs} isLoading={isLoading} color="primary">
       <FormattedMessage
         id="xpack.fleet.agentDetails.viewDashboardButtonLabel"
-        defaultMessage="View agent dashboard"
+        defaultMessage="View more agent metrics"
       />
-    </EuiButton>
+    </EuiButtonCompressed>
   );
 
-  if (!isLogAndMetricsEnabled) {
+  if (!isLoading && !isLogAndMetricsEnabled && agentPolicy) {
     return (
       <EuiToolTip
         content={
@@ -62,7 +68,16 @@ export const AgentDashboardLink: React.FunctionComponent<{
           />
         }
       >
-        {button}
+        <EuiButtonCompressed
+          isLoading={isLoading}
+          color="primary"
+          href={getHref('policy_details', { policyId: agentPolicy.id, tabId: 'settings' })}
+        >
+          <FormattedMessage
+            id="xpack.fleet.agentDetails.enableLogsAndMetricsLabel"
+            defaultMessage="Enable logs and metrics"
+          />
+        </EuiButtonCompressed>
       </EuiToolTip>
     );
   }
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
index b5f53d56402230..f0af73545466f0 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
@@ -27,6 +27,7 @@ import { AgentPolicySummaryLine } from '../../../../../components';
 import { AgentHealth } from '../../../components';
 import { Tags } from '../../../components/tags';
 import { formatAgentCPU, formatAgentMemory } from '../../../services/agent_metrics';
+import { AgentDashboardLink } from '../agent_dashboard_link';
 
 // Allows child text to be truncated
 const FlexItemWithMinWidth = styled(EuiFlexItem)`
@@ -44,23 +45,53 @@ export const AgentDetailsOverviewSection: React.FunctionComponent<{
     <EuiPanel>
       <EuiDescriptionList compressed>
         <EuiFlexGroup direction="column" gutterSize="m">
+          {displayAgentMetrics && (
+            <EuiFlexGroup>
+              <FlexItemWithMinWidth grow={5}>
+                <EuiFlexGroup direction="column" gutterSize="m">
+                  {[
+                    {
+                      title: i18n.translate('xpack.fleet.agentDetails.cpuLabel', {
+                        defaultMessage: 'CPU',
+                      }),
+                      description: formatAgentCPU(agent.metrics, agentPolicy),
+                    },
+                    {
+                      title: i18n.translate('xpack.fleet.agentDetails.memoryLabel', {
+                        defaultMessage: 'Memory',
+                      }),
+                      description: formatAgentMemory(agent.metrics, agentPolicy),
+                    },
+                  ].map(({ title, description }) => {
+                    const tooltip =
+                      typeof description === 'string' && description.length > 20 ? description : '';
+                    return (
+                      <EuiFlexGroup>
+                        <FlexItemWithMinWidth grow={8}>
+                          <EuiDescriptionListTitle>{title}</EuiDescriptionListTitle>
+                        </FlexItemWithMinWidth>
+                        <FlexItemWithMinWidth grow={4}>
+                          <EuiToolTip position="top" content={tooltip}>
+                            <EuiDescriptionListDescription className="eui-textTruncate">
+                              {description}
+                            </EuiDescriptionListDescription>
+                          </EuiToolTip>
+                        </FlexItemWithMinWidth>
+                      </EuiFlexGroup>
+                    );
+                  })}
+                </EuiFlexGroup>
+              </FlexItemWithMinWidth>
+              <FlexItemWithMinWidth grow={5}>
+                <EuiFlexGroup justifyContent="flexEnd">
+                  <EuiFlexItem grow={false}>
+                    <AgentDashboardLink agent={agent} agentPolicy={agentPolicy} />
+                  </EuiFlexItem>
+                </EuiFlexGroup>
+              </FlexItemWithMinWidth>
+            </EuiFlexGroup>
+          )}
           {[
-            ...(displayAgentMetrics
-              ? [
-                  {
-                    title: i18n.translate('xpack.fleet.agentDetails.cpuLabel', {
-                      defaultMessage: 'CPU',
-                    }),
-                    description: formatAgentCPU(agent.metrics, agentPolicy),
-                  },
-                  {
-                    title: i18n.translate('xpack.fleet.agentDetails.memoryLabel', {
-                      defaultMessage: 'Memory',
-                    }),
-                    description: formatAgentMemory(agent.metrics, agentPolicy),
-                  },
-                ]
-              : []),
             {
               title: i18n.translate('xpack.fleet.agentDetails.statusLabel', {
                 defaultMessage: 'Status',
diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/index.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/index.tsx
index 5ff3c8096bc0ee..cd5c397bce14ed 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/index.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/index.tsx
@@ -32,7 +32,6 @@ import {
   AgentLogs,
   AgentDetailsActionMenu,
   AgentDetailsContent,
-  AgentDashboardLink,
   AgentDiagnosticsTab,
 } from './components';
 
@@ -131,9 +130,6 @@ export const AgentDetailsPage: React.FunctionComponent = () => {
                 />
               </EuiFlexItem>
             )}
-            <EuiFlexItem grow={false}>
-              <AgentDashboardLink agent={agentData?.item} agentPolicy={agentPolicyData?.item} />
-            </EuiFlexItem>
           </EuiFlexGroup>
         </>
       ) : undefined,

From 65c83738393f5080c6a0aae2d09040d9e6c48cf0 Mon Sep 17 00:00:00 2001
From: GitStart <1501599+gitstart@users.noreply.github.com>
Date: Mon, 23 Jan 2023 15:49:39 +0100
Subject: [PATCH 03/54] [Fleet]: Flickering is observed on Agent monitoring
 after navigating to agent details page. (#149110)

[Fleet]: Flickering is observed on Agent monitoring after navigating to
agent details page

Resolves https://github.com/elastic/kibana/issues/142045

### Loom/Screenshot Demo
https://www.loom.com/share/678b4d6765244c40a792cb6845d594fb

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../agent_details/agent_details_overview.tsx  | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
index f0af73545466f0..5f0b64051f26fd 100644
--- a/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
+++ b/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_details/agent_details_overview.tsx
@@ -16,6 +16,7 @@ import {
   EuiPanel,
   EuiIcon,
   EuiToolTip,
+  EuiLoadingContent,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage, FormattedRelative } from '@kbn/i18n-react';
@@ -127,7 +128,7 @@ export const AgentDetailsOverviewSection: React.FunctionComponent<{
               description: agentPolicy ? (
                 <AgentPolicySummaryLine policy={agentPolicy} agent={agent} />
               ) : (
-                agent.policy_id || '-'
+                <EuiLoadingContent lines={1} />
               ),
             },
             {
@@ -199,8 +200,7 @@ export const AgentDetailsOverviewSection: React.FunctionComponent<{
               title: i18n.translate('xpack.fleet.agentDetails.monitorLogsLabel', {
                 defaultMessage: 'Monitor logs',
               }),
-              description:
-                Array.isArray(agentPolicy?.monitoring_enabled) &&
+              description: Array.isArray(agentPolicy?.monitoring_enabled) ? (
                 agentPolicy?.monitoring_enabled?.includes('logs') ? (
                   <FormattedMessage
                     id="xpack.fleet.agentList.monitorLogsEnabledText"
@@ -211,14 +211,16 @@ export const AgentDetailsOverviewSection: React.FunctionComponent<{
                     id="xpack.fleet.agentList.monitorLogsDisabledText"
                     defaultMessage="Disabled"
                   />
-                ),
+                )
+              ) : (
+                <EuiLoadingContent lines={1} />
+              ),
             },
             {
               title: i18n.translate('xpack.fleet.agentDetails.monitorMetricsLabel', {
                 defaultMessage: 'Monitor metrics',
               }),
-              description:
-                Array.isArray(agentPolicy?.monitoring_enabled) &&
+              description: Array.isArray(agentPolicy?.monitoring_enabled) ? (
                 agentPolicy?.monitoring_enabled?.includes('metrics') ? (
                   <FormattedMessage
                     id="xpack.fleet.agentList.monitorMetricsEnabledText"
@@ -229,7 +231,10 @@ export const AgentDetailsOverviewSection: React.FunctionComponent<{
                     id="xpack.fleet.agentList.monitorMetricsDisabledText"
                     defaultMessage="Disabled"
                   />
-                ),
+                )
+              ) : (
+                <EuiLoadingContent lines={1} />
+              ),
             },
             {
               title: i18n.translate('xpack.fleet.agentDetails.tagsLabel', {

From 92e480f4bd7b03d89edaa51c33d98269f69b0667 Mon Sep 17 00:00:00 2001
From: Shahzad <shahzad31comp@gmail.com>
Date: Mon, 23 Jan 2023 15:53:23 +0100
Subject: [PATCH 04/54] [Synthetics] Fix getting started redirect from overview
 page (#149308)

Fixes https://github.com/elastic/kibana/issues/149117
---
 .../components/shared/exploratory_view/embeddable/index.tsx     | 1 -
 .../monitors_page/{monitor_page.tsx => monitors_page.tsx}       | 0
 .../components/monitors_page/overview/overview_page.tsx         | 2 +-
 x-pack/plugins/synthetics/public/apps/synthetics/routes.tsx     | 2 +-
 4 files changed, 2 insertions(+), 3 deletions(-)
 rename x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/{monitor_page.tsx => monitors_page.tsx} (100%)

diff --git a/x-pack/plugins/observability/public/components/shared/exploratory_view/embeddable/index.tsx b/x-pack/plugins/observability/public/components/shared/exploratory_view/embeddable/index.tsx
index db0d2c03c3a1d2..a8f24ec3ee5c51 100644
--- a/x-pack/plugins/observability/public/components/shared/exploratory_view/embeddable/index.tsx
+++ b/x-pack/plugins/observability/public/components/shared/exploratory_view/embeddable/index.tsx
@@ -78,7 +78,6 @@ export function getExploratoryViewEmbeddable(
     const embedProps = { ...props };
     if (props.sparklineMode) {
       embedProps.axisTitlesVisibility = { x: false, yRight: false, yLeft: false };
-      embedProps.gridlinesVisibilitySettings = { x: false, yRight: false, yLeft: false };
       embedProps.legendIsVisible = false;
       embedProps.hideTicks = true;
     }
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/monitor_page.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/monitors_page.tsx
similarity index 100%
rename from x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/monitor_page.tsx
rename to x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/monitors_page.tsx
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview_page.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview_page.tsx
index b401676032e88c..5531f6821445c2 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview_page.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview_page.tsx
@@ -79,7 +79,7 @@ export const OverviewPage: React.FC = () => {
 
   if (
     !search &&
-    enablementLoading &&
+    !enablementLoading &&
     isEnabled &&
     !monitorsLoading &&
     syntheticsMonitors.length === 0
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/routes.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/routes.tsx
index 69cad74504ddd9..2379eca420598b 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/routes.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/routes.tsx
@@ -48,7 +48,7 @@ import {
   TEST_RUN_DETAILS_ROUTE,
 } from '../../../common/constants';
 import { PLUGIN } from '../../../common/constants/plugin';
-import { MonitorsPageWithServiceAllowed } from './components/monitors_page/monitor_page';
+import { MonitorsPageWithServiceAllowed } from './components/monitors_page/monitors_page';
 import { apiService } from '../../utils/api_service';
 import { RunTestManually } from './components/monitor_details/run_test_manually';
 import { MonitorDetailsStatus } from './components/monitor_details/monitor_details_status';

From 61820b418879f46512e0e2223cdf76792fa32b92 Mon Sep 17 00:00:00 2001
From: Angela Chuang <6295984+angorayc@users.noreply.github.com>
Date: Mon, 23 Jan 2023 14:56:07 +0000
Subject: [PATCH 05/54] [SecuritySolution] Fix page crashes after editing the
 filter (#149048)

## Summary

Fixes: https://github.com/elastic/kibana/issues/148710

<img width="1677" alt="Screenshot 2023-01-11 at 10 15 24"
src="https://user-images.githubusercontent.com/6295984/211781537-55c15301-fb61-48d6-aa17-0098d60fb46e.png">


**Steps to verify:**
1. Enable feature flags: Please add this to kibana.dev.yml
`xpack.securitySolution.enableExperimental: ['chartEmbeddablesEnabled']`

2. Go to alerts host details page.
3. Click on the donut chart to apply the filter.
4. Click the filter it applied to global search bar, and select `Edit
filter`.
5. Should edit the filter successfully.
---
 .../public/common/containers/sourcerer/index.test.tsx            | 1 +
 .../public/common/containers/sourcerer/index.tsx                 | 1 +
 x-pack/plugins/security_solution/public/common/types.ts          | 1 +
 3 files changed, 3 insertions(+)

diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
index 89d8bc2721f826..d3faed1a28a6b5 100644
--- a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.test.tsx
@@ -586,6 +586,7 @@ describe('Sourcerer Hooks', () => {
           '-filebeat-*',
           '-packetbeat-*',
         ]);
+        expect(result.current.indexPattern).toHaveProperty('getName');
       });
     });
   });
diff --git a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
index 9e7c14a48026b7..43521274cde97b 100644
--- a/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
+++ b/x-pack/plugins/security_solution/public/common/containers/sourcerer/index.tsx
@@ -434,6 +434,7 @@ export const useSourcererDataView = (
       indexPattern: {
         fields: sourcererDataView.indexFields,
         title: selectedPatterns.join(','),
+        getName: () => selectedPatterns.join(','),
       },
       indicesExist,
       loading: loading || sourcererDataView.loading,
diff --git a/x-pack/plugins/security_solution/public/common/types.ts b/x-pack/plugins/security_solution/public/common/types.ts
index c639975e499a0b..18a66571217231 100644
--- a/x-pack/plugins/security_solution/public/common/types.ts
+++ b/x-pack/plugins/security_solution/public/common/types.ts
@@ -26,6 +26,7 @@ export interface SecuritySolutionUiConfigType {
  */
 export interface SecuritySolutionDataViewBase extends DataViewBase {
   fields: FieldSpec[];
+  getName?: () => string;
 }
 
 export type AlertWorkflowStatus = 'open' | 'closed' | 'acknowledged';

From ee4276c20dc4b00533b9d4aea87bd64a1444e6d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Efe=20G=C3=BCrkan=20YALAMAN?=
 <efeguerkan.yalaman@elastic.co>
Date: Mon, 23 Jan 2023 15:58:54 +0100
Subject: [PATCH 06/54] [Enterprise Search]Add empty prompt for Engines List
 page (#149317)

## Summary


- Add empty prompt for Engines page.
![Screenshot 2023-01-23 at 13 52
09](https://user-images.githubusercontent.com/1410658/214045131-4926210e-e42e-4e5b-b5d1-5837c39fd4a8.png)


- Moves page descriptions to page header to match designs.
![Screenshot 2023-01-23 at 13 53
44](https://user-images.githubusercontent.com/1410658/214045218-e2c44680-5823-4c46-8e4f-6114f30d6c20.png)

Note on designs: Description page won't extend under right side items
per EUI don't allow it.
See the screenshot from EUI cc/ @julianrosado
![Screenshot 2023-01-23 at 13 16
30](https://user-images.githubusercontent.com/1410658/214045427-4e41edc8-17c1-44a2-8463-32df5fc77044.png)
https://eui.elastic.co/#/layout/page-header


- Update isLoading logic for engine list logic.
- Update and add tests.


### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [x] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)
---
 .../components/empty_engines_prompt.test.tsx  |  23 ++
 .../components/empty_engines_prompt.tsx       |  36 +++
 .../engines/engine_list_logic.test.ts         |   4 +-
 .../components/engines/engines_list.test.tsx  |  39 +++-
 .../components/engines/engines_list.tsx       | 218 ++++++++++--------
 .../components/engines/engines_list_logic.ts  |   2 +-
 6 files changed, 216 insertions(+), 106 deletions(-)
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/empty_engines_prompt.test.tsx
 create mode 100644 x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/empty_engines_prompt.tsx

diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/empty_engines_prompt.test.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/empty_engines_prompt.test.tsx
new file mode 100644
index 00000000000000..81d81bc8a164cb
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/empty_engines_prompt.test.tsx
@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import React from 'react';
+
+import { shallow } from 'enzyme';
+
+import { EuiEmptyPrompt } from '@elastic/eui';
+
+import { EmptyEnginesPrompt } from './empty_engines_prompt';
+
+describe('EmptyEnginesPrompt', () => {
+  it('should pass children to prompt actions', () => {
+    const dummyEl = <div>dummy</div>;
+    const wrapper = shallow(<EmptyEnginesPrompt>{dummyEl}</EmptyEnginesPrompt>);
+    const euiPrompt = wrapper.find(EuiEmptyPrompt);
+
+    expect(euiPrompt.prop('actions')).toEqual(dummyEl);
+  });
+});
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/empty_engines_prompt.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/empty_engines_prompt.tsx
new file mode 100644
index 00000000000000..d3b4f1fc2b5f7c
--- /dev/null
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/empty_engines_prompt.tsx
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { EuiEmptyPrompt } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n-react';
+
+export const EmptyEnginesPrompt: React.FC = ({ children }) => {
+  return (
+    <EuiEmptyPrompt
+      iconType="aggregate"
+      title={
+        <h2>
+          <FormattedMessage
+            id="xpack.enterpriseSearch.content.engines.enginesList.empty.title"
+            defaultMessage="Create your first engine"
+          />
+        </h2>
+      }
+      body={
+        <p>
+          <FormattedMessage
+            id="xpack.enterpriseSearch.content.engines.enginesList.empty.description"
+            defaultMessage="Let's walk you through creating your first engine."
+          />
+        </p>
+      }
+      actions={children}
+    />
+  );
+};
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engine_list_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engine_list_logic.test.ts
index e6128bab79bb61..bfbbb71d220c69 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engine_list_logic.test.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engine_list_logic.test.ts
@@ -24,7 +24,7 @@ const DEFAULT_VALUES = {
   deleteStatus: Status.IDLE,
   isDeleteLoading: false,
   isDeleteModalVisible: false,
-  isLoading: false,
+  isLoading: true,
   meta: DEFAULT_META,
   parameters: { meta: DEFAULT_META },
   results: [],
@@ -146,6 +146,7 @@ describe('EnginesListLogic', () => {
             meta: newPageMeta,
             // searchQuery: 'k',
           },
+          isLoading: false,
           meta: newPageMeta,
           parameters: {
             meta: newPageMeta,
@@ -224,6 +225,7 @@ describe('EnginesListLogic', () => {
             results,
             meta: DEFAULT_META,
           },
+          isLoading: false,
           meta: DEFAULT_META,
           parameters: {
             meta: DEFAULT_META,
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.test.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.test.tsx
index 340dd3517746bf..3de8546bcf5f79 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.test.tsx
@@ -13,18 +13,34 @@ import { shallow } from 'enzyme';
 
 import { Status } from '../../../../../common/types/api';
 
+import { EnterpriseSearchContentPageTemplate } from '../layout/page_template';
+
+import { EmptyEnginesPrompt } from './components/empty_engines_prompt';
 import { EnginesListTable } from './components/tables/engines_table';
 import { EnginesList } from './engines_list';
 import { DEFAULT_META } from './types';
 
 const DEFAULT_VALUES = {
   data: undefined,
-  results: [],
+  isLoading: true,
   meta: DEFAULT_META,
   parameters: { meta: DEFAULT_META },
+  results: [],
   status: Status.IDLE,
 };
-const mockValues = { ...DEFAULT_VALUES };
+const mockValues = {
+  ...DEFAULT_VALUES,
+  isLoading: false,
+  results: [
+    {
+      created: '1999-12-31T23:59:59Z',
+      indices: ['index-18', 'index-23'],
+      name: 'engine-name-1',
+      updated: '1999-12-31T23:59:59Z',
+    },
+  ],
+  status: Status.SUCCESS,
+};
 
 const mockActions = {
   fetchEngines: jest.fn(),
@@ -36,7 +52,23 @@ describe('EnginesList', () => {
     jest.clearAllMocks();
     global.localStorage.clear();
   });
-  describe('Empty state', () => {});
+  it('renders loading when isLoading', () => {
+    setMockValues(DEFAULT_VALUES);
+    setMockActions(mockActions);
+
+    const wrapper = shallow(<EnginesList />);
+    const pageTemplate = wrapper.find(EnterpriseSearchContentPageTemplate);
+
+    expect(pageTemplate.prop('isLoading')).toEqual(true);
+  });
+  it('renders empty prompt when no data is available', () => {
+    setMockValues(DEFAULT_VALUES);
+    setMockActions(mockActions);
+    const wrapper = shallow(<EnginesList />);
+
+    expect(wrapper.find(EmptyEnginesPrompt)).toHaveLength(1);
+    expect(wrapper.find(EnginesListTable)).toHaveLength(0);
+  });
 
   it('renders with Engines data ', async () => {
     setMockValues(mockValues);
@@ -45,5 +77,6 @@ describe('EnginesList', () => {
     const wrapper = shallow(<EnginesList />);
 
     expect(wrapper.find(EnginesListTable)).toHaveLength(1);
+    expect(wrapper.find(EmptyEnginesPrompt)).toHaveLength(0);
   });
 });
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx
index 1bafef662a135b..db125c425c5014 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx
@@ -20,13 +20,30 @@ import { DataPanel } from '../../../shared/data_panel/data_panel';
 
 import { EnterpriseSearchContentPageTemplate } from '../layout/page_template';
 
+import { EmptyEnginesPrompt } from './components/empty_engines_prompt';
 import { EnginesListTable } from './components/tables/engines_table';
 import { DeleteEngineModal } from './delete_engine_modal';
 import { EnginesListLogic } from './engines_list_logic';
 
+const CreateButton: React.FC = () => {
+  return (
+    <EuiButton
+      fill
+      iconType="plusInCircle"
+      data-test-subj="enterprise-search-content-engines-creation-button"
+      data-telemetry-id="entSearchContent-engines-list-createEngine"
+      href={'TODO'}
+    >
+      {i18n.translate('xpack.enterpriseSearch.content.engines.createEngineButtonLabel', {
+        defaultMessage: 'Create engine',
+      })}
+    </EuiButton>
+  );
+};
+
 export const EnginesList: React.FC = () => {
   const { fetchEngines, onPaginate, openDeleteEngineModal } = useActions(EnginesListLogic);
-  const { meta, results } = useValues(EnginesListLogic);
+  const { meta, results, isLoading } = useValues(EnginesListLogic);
   const [searchQuery, setSearchValue] = useState('');
   const throttledSearchQuery = useThrottle(searchQuery, INPUT_THROTTLE_DELAY_MS);
 
@@ -47,114 +64,113 @@ export const EnginesList: React.FC = () => {
           }),
         ]}
         pageHeader={{
+          description: (
+            <FormattedMessage
+              id="xpack.enterpriseSearch.content.engines.description"
+              defaultMessage="Engines allow you to query indexed data with a complete set of relevance, analytics and personalization tools. To learn more about how engines work in Enterprise search {documentationUrl}"
+              values={{
+                documentationUrl: (
+                  <EuiLink
+                    data-test-subj="engines-documentation-link"
+                    href="TODO"
+                    target="_blank"
+                    data-telemetry-id="entSearchContent-engines-documentation-viewDocumentaion"
+                  >
+                    {' '}
+                    {/* TODO: navigate to documentation url */}{' '}
+                    {i18n.translate('xpack.enterpriseSearch.content.engines.documentation', {
+                      defaultMessage: 'explore our Engines documentation',
+                    })}
+                  </EuiLink>
+                ),
+              }}
+            />
+          ),
           pageTitle: i18n.translate('xpack.enterpriseSearch.content.engines.title', {
             defaultMessage: 'Engines',
           }),
-          rightSideItems: [
-            <EuiButton
-              fill
-              iconType="plusInCircle"
-              data-test-subj="enterprise-search-content-engines-creation-button"
-              data-telemetry-id="entSearchContent-engines-list-createEngine"
-              href={'TODO'}
-            >
-              {i18n.translate('xpack.enterpriseSearch.content.engines.createEngineButtonLabel', {
-                defaultMessage: 'Create engine',
-              })}
-            </EuiButton>,
-          ],
+          rightSideItems: [<CreateButton />],
         }}
         pageViewTelemetry="Engines"
-        isLoading={false}
+        isLoading={isLoading}
       >
-        <EuiText>
-          <FormattedMessage
-            id="xpack.enterpriseSearch.content.engines.description"
-            defaultMessage="Engines allow you to query indexed data with a complete set of relevance, analytics and personalization tools. To learn more about how engines work in Enterprise search {documentationUrl}"
-            values={{
-              documentationUrl: (
-                <EuiLink
-                  data-test-subj="engines-documentation-link"
-                  href="TODO"
-                  target="_blank"
-                  data-telemetry-id="entSearchContent-engines-documentation-viewDocumentaion"
-                >
-                  {' '}
-                  {/* TODO: navigate to documentation url */}{' '}
-                  {i18n.translate('xpack.enterpriseSearch.content.engines.documentation', {
-                    defaultMessage: 'explore our Engines documentation',
-                  })}
-                </EuiLink>
-              ),
-            }}
-          />
-        </EuiText>
         <EuiSpacer />
-        <div>
-          <EuiFieldSearch
-            value={searchQuery}
-            placeholder={i18n.translate(
-              'xpack.enterpriseSearch.content.engines.searchPlaceholder',
-              {
-                defaultMessage: 'Search engines',
-              }
-            )}
-            aria-label={i18n.translate(
-              'xpack.enterpriseSearch.content.engines.searchBar.ariaLabel',
-              {
-                defaultMessage: 'Search engines',
-              }
-            )}
-            fullWidth
-            onChange={(event) => {
-              setSearchValue(event.currentTarget.value);
-            }}
-          />
-        </div>
-        <EuiSpacer size="s" />
-        <EuiText color="subdued" size="s">
-          {i18n.translate('xpack.enterpriseSearch.content.engines.searchPlaceholder.description', {
-            defaultMessage: 'Locate an engine via name or indices',
-          })}
-        </EuiText>
+        {results.length ? (
+          <>
+            <div>
+              <EuiFieldSearch
+                value={searchQuery}
+                placeholder={i18n.translate(
+                  'xpack.enterpriseSearch.content.engines.searchPlaceholder',
+                  {
+                    defaultMessage: 'Search engines',
+                  }
+                )}
+                aria-label={i18n.translate(
+                  'xpack.enterpriseSearch.content.engines.searchBar.ariaLabel',
+                  {
+                    defaultMessage: 'Search engines',
+                  }
+                )}
+                fullWidth
+                onChange={(event) => {
+                  setSearchValue(event.currentTarget.value);
+                }}
+              />
+            </div>
+            <EuiSpacer size="s" />
+            <EuiText color="subdued" size="s">
+              {i18n.translate(
+                'xpack.enterpriseSearch.content.engines.searchPlaceholder.description',
+                {
+                  defaultMessage: 'Locate an engine via name or indices',
+                }
+              )}
+            </EuiText>
 
-        <EuiSpacer size="m" />
-        <EuiText size="s">
-          <FormattedMessage
-            id="xpack.enterpriseSearch.content.engines.enginesList.description"
-            defaultMessage="Showing {from}-{to} of {total}"
-            values={{
-              from: (
-                <strong>
-                  <FormattedNumber value={meta.from + 1} />
-                </strong>
-              ),
-              to: (
-                <strong>
-                  <FormattedNumber value={meta.from + (results?.length ?? 0)} />
-                </strong>
-              ),
-              total: <FormattedNumber value={meta.total} />,
-            }}
-          />
-        </EuiText>
-        <DataPanel
-          title={
-            <h2>
-              {i18n.translate('xpack.enterpriseSearch.content.engines.title', {
-                defaultMessage: 'Engines',
-              })}
-            </h2>
-          }
-        >
-          <EnginesListTable
-            enginesList={results}
-            meta={meta}
-            onChange={onPaginate}
-            onDelete={openDeleteEngineModal}
-            loading={false}
-          />
-        </DataPanel>
+            <EuiSpacer size="m" />
+            <EuiText size="s">
+              <FormattedMessage
+                id="xpack.enterpriseSearch.content.engines.enginesList.description"
+                defaultMessage="Showing {from}-{to} of {total}"
+                values={{
+                  from: (
+                    <strong>
+                      <FormattedNumber value={meta.from + 1} />
+                    </strong>
+                  ),
+                  to: (
+                    <strong>
+                      <FormattedNumber value={meta.from + (results?.length ?? 0)} />
+                    </strong>
+                  ),
+                  total: <FormattedNumber value={meta.total} />,
+                }}
+              />
+            </EuiText>
+            <DataPanel
+              title={
+                <h2>
+                  {i18n.translate('xpack.enterpriseSearch.content.engines.title', {
+                    defaultMessage: 'Engines',
+                  })}
+                </h2>
+              }
+            >
+              <EnginesListTable
+                enginesList={results}
+                meta={meta}
+                onChange={onPaginate}
+                onDelete={openDeleteEngineModal}
+                loading={false}
+              />
+            </DataPanel>
+          </>
+        ) : (
+          <EmptyEnginesPrompt>
+            <CreateButton />
+          </EmptyEnginesPrompt>
+        )}
 
         <EuiSpacer size="xxl" />
         <div />
diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_logic.ts
index 8f7a012518905a..6428217e12b5ba 100644
--- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_logic.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_logic.ts
@@ -124,7 +124,7 @@ export const EnginesListLogic = kea<MakeLogicType<EngineListValues, EnginesListA
     ],
     isLoading: [
       () => [selectors.status],
-      (status: EngineListValues['status']) => [Status.LOADING].includes(status),
+      (status: EngineListValues['status']) => [Status.LOADING, Status.IDLE].includes(status),
     ],
     results: [() => [selectors.data], (data) => data?.results ?? []],
     meta: [() => [selectors.parameters], (parameters) => parameters.meta],

From e5df1b8bc068094cabf74062212ca07559aff748 Mon Sep 17 00:00:00 2001
From: Kevin Logan <56395104+kevinlog@users.noreply.github.com>
Date: Mon, 23 Jan 2023 10:23:11 -0500
Subject: [PATCH 07/54] [Security Solution] Reduce scope of osquery update fix
 to only update the package (#149325)

## Summary

Reduce the scope of the OSQuery start task to only update the OSQuery
integration package to 1.6.0. Originally, we had a check to also
rollover indices to fix a bug on a potentially small subset of users who
tried OSQuery for the first time in the first few days of release in
8.6.0. However, this check is potentially expensive and risky since it
is in the start of Kibana/OSQuery plugin.

Here, we reduce the risk by only upgrade the OSQuery integration package
automatically which should fix the issue for most users. It is also less
risky/expensive as searching over all existing data.

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../server/utils/upgrade_integration.ts       | 49 +------------------
 1 file changed, 1 insertion(+), 48 deletions(-)

diff --git a/x-pack/plugins/osquery/server/utils/upgrade_integration.ts b/x-pack/plugins/osquery/server/utils/upgrade_integration.ts
index 53e8a7101a0d66..bc68c474188963 100644
--- a/x-pack/plugins/osquery/server/utils/upgrade_integration.ts
+++ b/x-pack/plugins/osquery/server/utils/upgrade_integration.ts
@@ -9,13 +9,10 @@ import { satisfies } from 'semver';
 import { installPackage } from '@kbn/fleet-plugin/server/services/epm/packages';
 import { pkgToPkgKey } from '@kbn/fleet-plugin/server/services/epm/registry';
 import { DEFAULT_SPACE_ID } from '@kbn/spaces-plugin/common/constants';
-import { asyncForEach } from '@kbn/std';
-import { orderBy } from 'lodash';
 import type { Installation } from '@kbn/fleet-plugin/common';
 import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
 import type { SavedObjectsClientContract } from '@kbn/core-saved-objects-api-server';
 import type { Logger } from '@kbn/logging';
-import { OSQUERY_INTEGRATION_NAME } from '../../common';
 
 interface UpgradeIntegrationOptions {
   packageInfo?: Installation;
@@ -31,12 +28,10 @@ export const upgradeIntegration = async ({
   esClient,
   logger,
 }: UpgradeIntegrationOptions) => {
-  let updatedPackageResult;
-
   if (packageInfo && satisfies(packageInfo?.version ?? '', '<1.6.0')) {
     try {
       logger.info('Updating osquery_manager integration');
-      updatedPackageResult = await installPackage({
+      await installPackage({
         installSource: 'registry',
         savedObjectsClient: client,
         pkgkey: pkgToPkgKey({
@@ -53,46 +48,4 @@ export const upgradeIntegration = async ({
       logger.error(e);
     }
   }
-
-  // Check to see if the package has already been updated to at least 1.6.0
-  if (
-    satisfies(packageInfo?.version ?? '', '>=1.6.0') ||
-    updatedPackageResult?.status === 'installed'
-  ) {
-    try {
-      // First get all datastreams matching the pattern.
-      const dataStreams = await esClient.indices.getDataStream({
-        name: `logs-${OSQUERY_INTEGRATION_NAME}.result-*`,
-      });
-
-      // Then for each of those datastreams, we need to see if they need to rollover.
-      await asyncForEach(dataStreams.data_streams, async (dataStream) => {
-        const mapping = await esClient.indices.getMapping({
-          index: dataStream.name,
-        });
-
-        const valuesToSort = Object.entries(mapping).map(([key, value]) => ({
-          index: key,
-          mapping: value,
-        }));
-
-        // Sort by index name to get the latest index for detecting if we need to rollover
-        const dataStreamMapping = orderBy(valuesToSort, ['index'], 'desc');
-
-        if (
-          dataStreamMapping &&
-          // @ts-expect-error 'properties' does not exist on type 'MappingMatchOnlyTextProperty'
-          dataStreamMapping[0]?.mapping?.mappings?.properties?.data_stream?.properties?.dataset
-            ?.value === 'generic'
-        ) {
-          logger.info('Rolling over index: ' + dataStream.name);
-          await esClient.indices.rollover({
-            alias: dataStream.name,
-          });
-        }
-      });
-    } catch (e) {
-      logger.error(e);
-    }
-  }
 };

From 105a657faeda7408ee33a39998cc821641f46d8b Mon Sep 17 00:00:00 2001
From: Shahzad <shahzad31comp@gmail.com>
Date: Mon, 23 Jan 2023 16:28:11 +0100
Subject: [PATCH 08/54] [Synthetics] Test run details step results details
 (#149252)

Fixes https://github.com/elastic/kibana/issues/145380
---
 .../common/components/thershold_indicator.tsx |  86 +++++++
 .../browser_steps_list.tsx                    |  59 ++++-
 .../monitor_test_result/result_details.tsx    |  75 ++++++
 .../monitor_summary/last_test_run.tsx         |   1 +
 .../common/network_data/data_formatting.ts    |   6 +-
 .../hooks/use_network_timings.ts              |  59 ++---
 .../hooks/use_network_timings_prev.ts         | 233 ++++++++++++++++++
 .../synthetics/hooks/use_redux_es_search.ts   |  13 +-
 .../synthetics/state/elasticsearch/actions.ts |  22 +-
 .../synthetics/state/elasticsearch/api.ts     |   6 +-
 .../synthetics/state/elasticsearch/effects.ts |  30 ++-
 11 files changed, 526 insertions(+), 64 deletions(-)
 create mode 100644 x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/thershold_indicator.tsx
 create mode 100644 x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/result_details.tsx
 create mode 100644 x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_network_timings_prev.ts

diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/thershold_indicator.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/thershold_indicator.tsx
new file mode 100644
index 00000000000000..e24b4cd52a2d91
--- /dev/null
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/thershold_indicator.tsx
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiFlexGroup, EuiFlexItem, EuiIcon, EuiText, EuiToolTip } from '@elastic/eui';
+export const getDeltaPercent = (current: number, previous: number) => {
+  if (previous === 0) {
+    return 0;
+  }
+
+  return Number((((current - previous) / previous) * 100).toFixed(0));
+};
+export const ThresholdIndicator = ({
+  current,
+  previous,
+  previousFormatted,
+  currentFormatted,
+}: {
+  current: number;
+  previous: number;
+  previousFormatted: string;
+  currentFormatted: string;
+}) => {
+  const delta = getDeltaPercent(current, previous);
+
+  const getToolTipContent = () => {
+    return i18n.translate('xpack.synthetics.stepDetails.palette.tooltip', {
+      defaultMessage: 'Value is {deltaLabel} compared to previous steps in last 24 hours.',
+      values: {
+        deltaLabel:
+          Math.abs(delta) === 0
+            ? i18n.translate('xpack.synthetics.stepDetails.palette.tooltip.noChange', {
+                defaultMessage: 'same',
+              })
+            : delta > 0
+            ? i18n.translate('xpack.synthetics.stepDetails.palette.increased', {
+                defaultMessage: '{delta}% higher',
+                values: { delta },
+              })
+            : i18n.translate('xpack.synthetics.stepDetails.palette.decreased', {
+                defaultMessage: '{delta}% lower',
+                values: { delta },
+              }),
+      },
+    });
+  };
+
+  const getColor = () => {
+    if (Math.abs(delta) < 5) {
+      return 'default';
+    }
+    return delta > 5 ? 'danger' : 'success';
+  };
+
+  const hasDelta = Math.abs(delta) > 0;
+
+  return (
+    <EuiFlexGroup gutterSize="s" justifyContent="flexEnd">
+      <EuiFlexItem grow={false}>
+        <EuiText color={getColor()}>
+          <strong>{currentFormatted}</strong>
+        </EuiText>
+      </EuiFlexItem>
+      <EuiFlexItem grow={false}>
+        <EuiToolTip
+          content={getToolTipContent()}
+          title={i18n.translate('xpack.synthetics.stepDetails.palette.previous', {
+            defaultMessage: 'Average(24h): {previous}',
+            values: { previous: previousFormatted },
+          })}
+        >
+          {hasDelta ? (
+            <EuiIcon type={delta > 0 ? 'sortUp' : 'sortDown'} size="m" color={getColor()} />
+          ) : (
+            <EuiIcon type="minus" size="m" color="subdued" />
+          )}
+        </EuiToolTip>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/browser_steps_list.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/browser_steps_list.tsx
index 3ddf55d7300fc1..ec9a1217f8ea42 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/browser_steps_list.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/browser_steps_list.tsx
@@ -6,16 +6,23 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import React, { CSSProperties } from 'react';
-import { EuiBasicTable, EuiBasicTableColumn, EuiText, useEuiTheme } from '@elastic/eui';
+import React, { CSSProperties, ReactElement, useState } from 'react';
+import {
+  EuiBasicTable,
+  EuiBasicTableColumn,
+  EuiButtonIcon,
+  EuiText,
+  useEuiTheme,
+} from '@elastic/eui';
 import { EuiThemeComputed } from '@elastic/eui/src/services/theme/types';
 
+import { ResultDetails } from './result_details';
 import { JourneyStep } from '../../../../../../common/runtime_types';
 import { JourneyStepScreenshotContainer } from '../screenshot/journey_step_screenshot_container';
 import { ScreenshotImageSize, THUMBNAIL_SCREENSHOT_SIZE } from '../screenshot/screenshot_size';
 import { StepDetailsLinkIcon } from '../links/step_details_link';
 
-import { StatusBadge, parseBadgeStatus, getTextColorForMonitorStatus } from './status_badge';
+import { parseBadgeStatus, getTextColorForMonitorStatus } from './status_badge';
 import { StepDurationText } from './step_duration_text';
 
 interface Props {
@@ -25,6 +32,7 @@ interface Props {
   showStepNumber: boolean;
   screenshotImageSize?: ScreenshotImageSize;
   compressed?: boolean;
+  showExpand?: boolean;
 }
 
 export function isStepEnd(step: JourneyStep) {
@@ -38,11 +46,41 @@ export const BrowserStepsList = ({
   screenshotImageSize = THUMBNAIL_SCREENSHOT_SIZE,
   showStepNumber = false,
   compressed = true,
+  showExpand = true,
 }: Props) => {
   const { euiTheme } = useEuiTheme();
   const stepEnds: JourneyStep[] = steps.filter(isStepEnd);
+  const [itemIdToExpandedRowMap, setItemIdToExpandedRowMap] = useState<
+    Record<string, ReactElement>
+  >({});
+
+  const toggleDetails = (item: JourneyStep) => {
+    const itemIdToExpandedRowMapValues = { ...itemIdToExpandedRowMap };
+    if (itemIdToExpandedRowMapValues[item._id]) {
+      delete itemIdToExpandedRowMapValues[item._id];
+    } else {
+      itemIdToExpandedRowMapValues[item._id] = <></>;
+    }
+    setItemIdToExpandedRowMap(itemIdToExpandedRowMapValues);
+  };
 
   const columns: Array<EuiBasicTableColumn<JourneyStep>> = [
+    ...(showExpand
+      ? [
+          {
+            align: 'left' as const,
+            width: '40px',
+            isExpander: true,
+            render: (item: JourneyStep) => (
+              <EuiButtonIcon
+                onClick={() => toggleDetails(item)}
+                aria-label={itemIdToExpandedRowMap[item._id] ? 'Collapse' : 'Expand'}
+                iconType={itemIdToExpandedRowMap[item._id] ? 'arrowDown' : 'arrowRight'}
+              />
+            ),
+          },
+        ]
+      : []),
     ...(showStepNumber
       ? [
           {
@@ -100,7 +138,13 @@ export const BrowserStepsList = ({
     {
       field: 'synthetics.step.status',
       name: RESULT_LABEL,
-      render: (pingStatus: string) => <StatusBadge status={parseBadgeStatus(pingStatus)} />,
+      render: (pingStatus: string, item: JourneyStep) => (
+        <ResultDetails
+          step={item}
+          pingStatus={pingStatus}
+          isExpanded={Boolean(itemIdToExpandedRowMap[item._id])}
+        />
+      ),
     },
     {
       align: 'left',
@@ -131,6 +175,12 @@ export const BrowserStepsList = ({
   return (
     <>
       <EuiBasicTable
+        rowProps={() => ({
+          style: { verticalAlign: 'initial' },
+        })}
+        cellProps={() => ({
+          style: { verticalAlign: 'initial' },
+        })}
         compressed={compressed}
         loading={loading}
         columns={columns}
@@ -148,6 +198,7 @@ export const BrowserStepsList = ({
               })
         }
         tableLayout={'auto'}
+        itemId="_id"
       />
     </>
   );
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/result_details.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/result_details.tsx
new file mode 100644
index 00000000000000..54f0fe8412551c
--- /dev/null
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/result_details.tsx
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiDescriptionList, EuiLoadingContent, EuiSpacer } from '@elastic/eui';
+import { ThresholdIndicator } from '../components/thershold_indicator';
+import { useNetworkTimings } from '../../step_details_page/hooks/use_network_timings';
+import { useNetworkTimingsPrevious24Hours } from '../../step_details_page/hooks/use_network_timings_prev';
+import { formatMillisecond } from '../../step_details_page/common/network_data/data_formatting';
+import { JourneyStep } from '../../../../../../common/runtime_types';
+import { parseBadgeStatus, StatusBadge } from './status_badge';
+
+export const ResultDetails = ({
+  pingStatus,
+  isExpanded,
+  step,
+}: {
+  pingStatus: string;
+  isExpanded: boolean;
+  step: JourneyStep;
+}) => {
+  return (
+    <div>
+      <StatusBadge status={parseBadgeStatus(pingStatus)} />
+      {isExpanded && (
+        <>
+          <EuiSpacer size="m" />
+          <TimingDetails step={step} />
+        </>
+      )}
+    </div>
+  );
+};
+export const TimingDetails = ({ step }: { step: JourneyStep }) => {
+  const { timingsWithLabels } = useNetworkTimings(
+    step.monitor.check_group,
+    step.synthetics.step?.index
+  );
+
+  const { timingsWithLabels: prevTimingsWithLabels, loading } = useNetworkTimingsPrevious24Hours(
+    step.synthetics.step?.index
+  );
+
+  const items = timingsWithLabels?.map((item) => {
+    const prevValueItem = prevTimingsWithLabels?.find((prev) => prev.label === item.label);
+    const prevValue = prevValueItem?.value ?? 0;
+    return {
+      title: item.label,
+      description: loading ? (
+        <EuiLoadingContent lines={1} />
+      ) : (
+        <ThresholdIndicator
+          currentFormatted={formatMillisecond(item.value, 1)}
+          current={Number(item.value.toFixed(1))}
+          previous={Number(prevValue.toFixed(1))}
+          previousFormatted={formatMillisecond(prevValue, 1)}
+        />
+      ),
+    };
+  });
+
+  return (
+    <EuiDescriptionList
+      type="column"
+      listItems={items}
+      style={{ maxWidth: 250 }}
+      textStyle="reverse"
+      descriptionProps={{ style: { textAlign: 'right' } }}
+    />
+  );
+};
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_summary/last_test_run.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_summary/last_test_run.tsx
index b22039f65ef9aa..9c4249517b64f5 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_summary/last_test_run.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_summary/last_test_run.tsx
@@ -127,6 +127,7 @@ export const LastTestRunComponent = ({
           steps={stepsData?.steps ?? []}
           loading={stepsLoading}
           showStepNumber={true}
+          showExpand={false}
         />
       ) : (
         <SinglePingResult ping={latestPing} loading={loading} />
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts
index 10b70d0c86eead..fb12506065cde1 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts
@@ -491,9 +491,9 @@ export const colourPalette: ColourPalette = { ...TIMING_PALETTE, ...MIME_TYPE_PA
 export const formatTooltipHeading = (index: number, fullText: string): string =>
   isNaN(index) ? fullText : `${index}. ${fullText}`;
 
-export const formatMillisecond = (ms: number) => {
+export const formatMillisecond = (ms: number, digits?: number) => {
   if (ms < 1000) {
-    return `${ms.toFixed(0)} ms`;
+    return `${ms.toFixed(digits ?? 0)} ms`;
   }
-  return `${(ms / 1000).toFixed(1)} s`;
+  return `${(ms / 1000).toFixed(digits ?? 1)} s`;
 };
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_network_timings.ts b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_network_timings.ts
index ed43a38113af98..36c71d1d71b804 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_network_timings.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_network_timings.ts
@@ -7,7 +7,6 @@
 
 import { useParams } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
-import { useEsSearch } from '@kbn/observability-plugin/public';
 import {
   NETWORK_TIMINGS_FIELDS,
   SYNTHETICS_BLOCKED_TIMINGS,
@@ -16,28 +15,33 @@ import {
   SYNTHETICS_RECEIVE_TIMINGS,
   SYNTHETICS_SEND_TIMINGS,
   SYNTHETICS_SSL_TIMINGS,
-  SYNTHETICS_STEP_DURATION,
   SYNTHETICS_TOTAL_TIMINGS,
   SYNTHETICS_WAIT_TIMINGS,
 } from '@kbn/observability-plugin/common';
+import { SYNTHETICS_INDEX_PATTERN } from '../../../../../../common/constants';
+import { useReduxEsSearch } from '../../../hooks/use_redux_es_search';
 
-export const useStepFilters = (prevCheckGroupId?: string) => {
-  const { checkGroupId, stepIndex } = useParams<{ checkGroupId: string; stepIndex: string }>();
+export const useStepFilters = (checkGroupId: string, stepIndex: number) => {
   return [
     {
       term: {
-        'monitor.check_group': prevCheckGroupId ?? checkGroupId,
+        'monitor.check_group': checkGroupId,
       },
     },
     {
       term: {
-        'synthetics.step.index': Number(stepIndex),
+        'synthetics.step.index': stepIndex,
       },
     },
   ];
 };
 
-export const useNetworkTimings = () => {
+export const useNetworkTimings = (checkGroupIdArg?: string, stepIndexArg?: number) => {
+  const params = useParams<{ checkGroupId: string; stepIndex: string; monitorId: string }>();
+
+  const checkGroupId = checkGroupIdArg ?? params.checkGroupId;
+  const stepIndex = stepIndexArg ?? Number(params.stepIndex);
+
   const runTimeMappings = NETWORK_TIMINGS_FIELDS.reduce(
     (acc, field) => ({
       ...acc,
@@ -48,24 +52,17 @@ export const useNetworkTimings = () => {
     {}
   );
 
-  const networkAggs = NETWORK_TIMINGS_FIELDS.reduce(
-    (acc, field) => ({
-      ...acc,
-      [field]: {
-        sum: {
-          field,
-        },
-      },
-    }),
-    {}
-  );
-
-  const { data } = useEsSearch(
+  const { data } = useReduxEsSearch(
     {
-      index: 'synthetics-*',
+      index: SYNTHETICS_INDEX_PATTERN,
       body: {
         size: 0,
-        runtime_mappings: runTimeMappings,
+        runtime_mappings: {
+          ...runTimeMappings,
+          'synthetics.payload.is_navigation_request': {
+            type: 'boolean',
+          },
+        },
         query: {
           bool: {
             filter: [
@@ -74,17 +71,16 @@ export const useNetworkTimings = () => {
                   'synthetics.type': 'journey/network_info',
                 },
               },
-              ...useStepFilters(),
+              {
+                term: {
+                  'synthetics.payload.is_navigation_request': true,
+                },
+              },
+              ...useStepFilters(checkGroupId, stepIndex),
             ],
           },
         },
         aggs: {
-          ...networkAggs,
-          totalDuration: {
-            sum: {
-              field: SYNTHETICS_STEP_DURATION,
-            },
-          },
           dns: {
             sum: {
               field: SYNTHETICS_DNS_TIMINGS,
@@ -128,8 +124,8 @@ export const useNetworkTimings = () => {
         },
       },
     },
-    [],
-    { name: 'networkTimings' }
+    [checkGroupId, stepIndex],
+    { name: `stepNetworkTimingsMetrics/${checkGroupId}/${stepIndex}` }
   );
 
   const aggs = data?.aggregations;
@@ -176,7 +172,6 @@ export const useNetworkTimings = () => {
         label: SYNTHETICS_WAIT_TIMINGS_LABEL,
       },
     ].sort((a, b) => b.value - a.value),
-    totalDuration: aggs?.totalDuration.value ?? 0,
   };
 };
 
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_network_timings_prev.ts b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_network_timings_prev.ts
new file mode 100644
index 00000000000000..e214d62429d4f2
--- /dev/null
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_network_timings_prev.ts
@@ -0,0 +1,233 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useParams } from 'react-router-dom';
+import { i18n } from '@kbn/i18n';
+import {
+  NETWORK_TIMINGS_FIELDS,
+  SYNTHETICS_BLOCKED_TIMINGS,
+  SYNTHETICS_CONNECT_TIMINGS,
+  SYNTHETICS_DNS_TIMINGS,
+  SYNTHETICS_RECEIVE_TIMINGS,
+  SYNTHETICS_SEND_TIMINGS,
+  SYNTHETICS_SSL_TIMINGS,
+  SYNTHETICS_TOTAL_TIMINGS,
+  SYNTHETICS_WAIT_TIMINGS,
+} from '@kbn/observability-plugin/common';
+import { SYNTHETICS_INDEX_PATTERN } from '../../../../../../common/constants';
+import { useReduxEsSearch } from '../../../hooks/use_redux_es_search';
+
+export const useStepFilters = (checkGroupId: string, stepIndex: number) => {
+  return [
+    {
+      term: {
+        'monitor.check_group': checkGroupId,
+      },
+    },
+    {
+      term: {
+        'synthetics.step.index': stepIndex,
+      },
+    },
+  ];
+};
+
+export const useNetworkTimingsPrevious24Hours = (stepIndexArg?: number) => {
+  const params = useParams<{ checkGroupId: string; stepIndex: string; monitorId: string }>();
+
+  const configId = params.monitorId;
+  const checkGroupId = params.checkGroupId;
+  const stepIndex = stepIndexArg ?? Number(params.stepIndex);
+
+  const runTimeMappings = NETWORK_TIMINGS_FIELDS.reduce(
+    (acc, field) => ({
+      ...acc,
+      [field]: {
+        type: 'double',
+      },
+    }),
+    {}
+  );
+
+  const { data, loading } = useReduxEsSearch(
+    {
+      index: SYNTHETICS_INDEX_PATTERN,
+      body: {
+        size: 0,
+        runtime_mappings: {
+          ...runTimeMappings,
+          'synthetics.payload.is_navigation_request': {
+            type: 'boolean',
+          },
+        },
+        query: {
+          bool: {
+            filter: [
+              {
+                range: {
+                  '@timestamp': {
+                    lte: 'now',
+                    gte: 'now-24h/h',
+                  },
+                },
+              },
+              {
+                term: {
+                  'synthetics.payload.is_navigation_request': true,
+                },
+              },
+              {
+                term: {
+                  'synthetics.type': 'journey/network_info',
+                },
+              },
+              {
+                term: {
+                  'synthetics.step.index': stepIndex,
+                },
+              },
+              {
+                term: {
+                  config_id: configId,
+                },
+              },
+            ],
+            must_not: [
+              {
+                term: {
+                  'monitor.check_group': checkGroupId,
+                },
+              },
+            ],
+          },
+        },
+        aggs: {
+          dns: {
+            percentiles: {
+              field: SYNTHETICS_DNS_TIMINGS,
+              percents: [50],
+            },
+          },
+          ssl: {
+            percentiles: {
+              field: SYNTHETICS_SSL_TIMINGS,
+              percents: [50],
+            },
+          },
+          blocked: {
+            percentiles: {
+              field: SYNTHETICS_BLOCKED_TIMINGS,
+              percents: [50],
+            },
+          },
+          connect: {
+            percentiles: {
+              field: SYNTHETICS_CONNECT_TIMINGS,
+              percents: [50],
+            },
+          },
+          receive: {
+            percentiles: {
+              field: SYNTHETICS_RECEIVE_TIMINGS,
+              percents: [50],
+            },
+          },
+          send: {
+            percentiles: {
+              field: SYNTHETICS_SEND_TIMINGS,
+              percents: [50],
+            },
+          },
+          wait: {
+            percentiles: {
+              field: SYNTHETICS_WAIT_TIMINGS,
+              percents: [50],
+            },
+          },
+          total: {
+            percentiles: {
+              field: SYNTHETICS_TOTAL_TIMINGS,
+              percents: [50],
+            },
+          },
+        },
+      },
+    },
+    [configId, stepIndex, checkGroupId],
+    { name: `stepNetworkPreviousTimings/${configId}/${stepIndex}` }
+  );
+
+  const aggs = data?.aggregations;
+
+  const timings = {
+    dns: aggs?.dns.values['50.0'] ?? 0,
+    connect: aggs?.connect.values['50.0'] ?? 0,
+    receive: aggs?.receive.values['50.0'] ?? 0,
+    send: aggs?.send.values['50.0'] ?? 0,
+    wait: aggs?.wait.values['50.0'] ?? 0,
+    blocked: aggs?.blocked.values['50.0'] ?? 0,
+    ssl: aggs?.ssl.values['50.0'] ?? 0,
+  };
+
+  return {
+    loading,
+    timings,
+    timingsWithLabels: [
+      {
+        value: timings.dns,
+        label: SYNTHETICS_DNS_TIMINGS_LABEL,
+      },
+      {
+        value: timings.ssl,
+        label: SYNTHETICS_SSL_TIMINGS_LABEL,
+      },
+      {
+        value: timings.blocked,
+        label: SYNTHETICS_BLOCKED_TIMINGS_LABEL,
+      },
+      {
+        value: timings.connect,
+        label: SYNTHETICS_CONNECT_TIMINGS_LABEL,
+      },
+      {
+        value: timings.receive,
+        label: SYNTHETICS_RECEIVE_TIMINGS_LABEL,
+      },
+      {
+        value: timings.send,
+        label: SYNTHETICS_SEND_TIMINGS_LABEL,
+      },
+      {
+        value: timings.wait,
+        label: SYNTHETICS_WAIT_TIMINGS_LABEL,
+      },
+    ].sort((a, b) => b.value - a.value),
+  };
+};
+
+const SYNTHETICS_CONNECT_TIMINGS_LABEL = i18n.translate('xpack.synthetics.connect.label', {
+  defaultMessage: 'Connect',
+});
+const SYNTHETICS_DNS_TIMINGS_LABEL = i18n.translate('xpack.synthetics.dns', {
+  defaultMessage: 'DNS',
+});
+const SYNTHETICS_WAIT_TIMINGS_LABEL = i18n.translate('xpack.synthetics.wait', {
+  defaultMessage: 'Wait',
+});
+
+const SYNTHETICS_SSL_TIMINGS_LABEL = i18n.translate('xpack.synthetics.ssl', {
+  defaultMessage: 'SSL',
+});
+const SYNTHETICS_BLOCKED_TIMINGS_LABEL = i18n.translate('xpack.synthetics.blocked', {
+  defaultMessage: 'Blocked',
+});
+const SYNTHETICS_SEND_TIMINGS_LABEL = i18n.translate('xpack.synthetics.send', {
+  defaultMessage: 'Send',
+});
+const SYNTHETICS_RECEIVE_TIMINGS_LABEL = i18n.translate('xpack.synthetics.receive', {
+  defaultMessage: 'Receive',
+});
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_redux_es_search.ts b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_redux_es_search.ts
index 72715c596e82a8..5afb38431878d8 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_redux_es_search.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_redux_es_search.ts
@@ -8,11 +8,11 @@
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { ESSearchResponse } from '@kbn/es-types';
 import { IInspectorInfo } from '@kbn/data-plugin/common';
-import { useInspectorContext } from '@kbn/observability-plugin/public';
 import { useDispatch, useSelector } from 'react-redux';
 import { useEffect, useMemo } from 'react';
 import {
   executeEsQueryAction,
+  selectEsQueryError,
   selectEsQueryLoading,
   selectEsQueryResult,
 } from '../state/elasticsearch';
@@ -26,27 +26,26 @@ export const useReduxEsSearch = <
   options: { inspector?: IInspectorInfo; name: string }
 ) => {
   const { name } = options ?? {};
-
-  const { addInspectorRequest } = useInspectorContext();
-
   const dispatch = useDispatch();
 
   const loadings = useSelector(selectEsQueryLoading);
   const results = useSelector(selectEsQueryResult);
+  const errors = useSelector(selectEsQueryError);
 
   useEffect(() => {
     if (params.index) {
-      dispatch(executeEsQueryAction.get({ params, name, addInspectorRequest }));
+      dispatch(executeEsQueryAction.get({ params, name }));
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [addInspectorRequest, dispatch, name, JSON.stringify(params)]);
+  }, [dispatch, name, JSON.stringify(params)]);
 
   return useMemo(() => {
     return {
       data: results[name] as ESSearchResponse<DocumentSource, TParams>,
       loading: loadings[name],
+      error: errors[name],
     };
-  }, [loadings, name, results]);
+  }, [errors, loadings, name, results]);
 };
 
 export function createEsParams<T extends estypes.SearchRequest>(params: T): T {
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/actions.ts b/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/actions.ts
index fbf505ecc950dd..93c035bdc8d99b 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/actions.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/actions.ts
@@ -7,14 +7,18 @@
 
 import * as esTypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { ESSearchResponse } from '@kbn/es-types';
-import { FetcherResult } from '@kbn/observability-plugin/public/hooks/use_fetcher';
 import { createAsyncAction } from '../utils/actions';
 
-export const executeEsQueryAction = createAsyncAction<
-  {
-    params: esTypes.SearchRequest;
-    name: string;
-    addInspectorRequest: <Data>(result: FetcherResult<Data>) => void;
-  },
-  { name: string; result: ESSearchResponse }
->('executeEsQueryAction');
+export interface EsActionPayload {
+  params: esTypes.SearchRequest;
+  name: string;
+}
+
+export interface EsActionResponse {
+  name: string;
+  result: ESSearchResponse;
+}
+
+export const executeEsQueryAction = createAsyncAction<EsActionPayload, EsActionResponse>(
+  'executeEsQueryAction'
+);
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/api.ts b/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/api.ts
index 6f233b89423b2d..0df5b7d30cd3e2 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/api.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/api.ts
@@ -14,20 +14,20 @@ import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { ESSearchResponse } from '@kbn/es-types';
 import { FETCH_STATUS } from '@kbn/observability-plugin/public';
 import { getInspectResponse } from '@kbn/observability-plugin/common';
-import type { FetcherResult } from '@kbn/observability-plugin/public/hooks/use_fetcher';
 import { kibanaService } from '../../../../utils/kibana_service';
+import { apiService } from '../../../../utils/api_service';
 
 export const executeEsQueryAPI = async ({
   params,
   name,
-  addInspectorRequest,
 }: {
   params: estypes.SearchRequest;
   name: string;
-  addInspectorRequest: <Data>(result: FetcherResult<Data>) => void;
 }) => {
   const data = kibanaService.startPlugins.data;
 
+  const addInspectorRequest = apiService.addInspectorRequest;
+
   const response = new Promise<IKibanaSearchResponse>((resolve, reject) => {
     const startTime = Date.now();
 
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/effects.ts b/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/effects.ts
index d92285e537dc6a..868d5a3dd5d6b0 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/effects.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/state/elasticsearch/effects.ts
@@ -5,15 +5,33 @@
  * 2.0.
  */
 
-import { takeLeading } from 'redux-saga/effects';
+import { call, put, takeEvery } from 'redux-saga/effects';
 
-import { fetchEffectFactory } from '../utils/fetch_effect';
-import { executeEsQueryAction } from './actions';
+import { Action } from 'redux-actions';
+import { serializeHttpFetchError } from '../utils/http_error';
+import { EsActionPayload, EsActionResponse, executeEsQueryAction } from './actions';
 import { executeEsQueryAPI } from './api';
 
 export function* executeEsQueryEffect() {
-  yield takeLeading(
-    executeEsQueryAction.get,
-    fetchEffectFactory(executeEsQueryAPI, executeEsQueryAction.success, executeEsQueryAction.fail)
+  const inProgressRequests = new Set<string>();
+
+  yield takeEvery(
+    String(executeEsQueryAction.get),
+    function* (action: Action<EsActionPayload>): Generator {
+      try {
+        if (!inProgressRequests.has(action.payload.name)) {
+          inProgressRequests.add(action.payload.name);
+
+          const response = (yield call(executeEsQueryAPI, action.payload)) as EsActionResponse;
+
+          inProgressRequests.delete(action.payload.name);
+
+          yield put(executeEsQueryAction.success(response));
+        }
+      } catch (e) {
+        inProgressRequests.delete(action.payload.name);
+        yield put(executeEsQueryAction.fail(serializeHttpFetchError(e, action.payload)));
+      }
+    }
   );
 }

From 050cf79cb0fd0e21251daf6f56203e158f518cfa Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@elastic.co>
Date: Mon, 23 Jan 2023 09:06:52 -0700
Subject: [PATCH 09/54] [Maps] fix Do not allow opening multiple tooltips for
 single feature (#149254)

Fixes https://github.com/elastic/kibana/issues/148819

When [multiple tooltips](https://github.com/elastic/kibana/pull/57226)
first merged in 7.7.0, TooltipFeature only had `id` and `layerId`
property so the original equality check `_.isEqual(features,
tooltipState.features)` prevented tooltips from opening that shows
identical features. Later releases added new properties to
TooltipFeature that broke this deep equals check.

This PR resolves the issue by mapping features to just `{id, layerId}`
before equality check to ensure those are the only properties that
determine equality.

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../public/actions/tooltip_actions.test.ts    | 137 ++++++++++++++++++
 .../maps/public/actions/tooltip_actions.ts    |   9 +-
 2 files changed, 145 insertions(+), 1 deletion(-)
 create mode 100644 x-pack/plugins/maps/public/actions/tooltip_actions.test.ts

diff --git a/x-pack/plugins/maps/public/actions/tooltip_actions.test.ts b/x-pack/plugins/maps/public/actions/tooltip_actions.test.ts
new file mode 100644
index 00000000000000..953f2bca0f56e7
--- /dev/null
+++ b/x-pack/plugins/maps/public/actions/tooltip_actions.test.ts
@@ -0,0 +1,137 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { TooltipState } from '../../common/descriptor_types';
+import { openOnClickTooltip } from './tooltip_actions';
+import { MapStoreState } from '../reducers/store';
+
+describe('openOnClickTooltip', () => {
+  const newTooltip = {
+    features: [
+      {
+        id: 'feature1',
+        layerId: 'layer1',
+      },
+    ],
+    id: 'tooltip1',
+    isLocked: true,
+    location: [0, 0],
+  } as unknown as TooltipState;
+
+  test('should add tooltip to open tooltips', () => {
+    const openTooltip = {
+      features: [
+        {
+          id: 'feature2',
+          layerId: 'layer1',
+        },
+      ],
+      id: 'tooltip2',
+      isLocked: true,
+      location: [1, 1],
+    } as unknown as TooltipState;
+    const action = openOnClickTooltip(newTooltip);
+    const dispatchMock = jest.fn();
+    action(dispatchMock, () => {
+      return {
+        map: {
+          openTooltips: [openTooltip],
+        },
+      } as unknown as MapStoreState;
+    });
+    expect(dispatchMock.mock.calls[0][0]).toEqual({
+      openTooltips: [openTooltip, newTooltip],
+      type: 'SET_OPEN_TOOLTIPS',
+    });
+  });
+
+  test('should remove existing mouseover tooltips when adding locked tooltips', () => {
+    const action = openOnClickTooltip(newTooltip);
+    const dispatchMock = jest.fn();
+    action(dispatchMock, () => {
+      return {
+        map: {
+          openTooltips: [
+            {
+              features: [
+                {
+                  id: 'feature2',
+                  layerId: 'layer1',
+                },
+              ],
+              id: 'tooltip2',
+              isLocked: false, // mouseover tooltip
+              location: [1, 1],
+            },
+          ],
+        },
+      } as unknown as MapStoreState;
+    });
+    expect(dispatchMock.mock.calls[0][0]).toEqual({
+      openTooltips: [newTooltip],
+      type: 'SET_OPEN_TOOLTIPS',
+    });
+  });
+
+  test('should remove existing tooltip when adding new tooltip at same location', () => {
+    const action = openOnClickTooltip(newTooltip);
+    const dispatchMock = jest.fn();
+    action(dispatchMock, () => {
+      return {
+        map: {
+          openTooltips: [
+            {
+              features: [
+                {
+                  id: 'feature2',
+                  layerId: 'layer1',
+                },
+              ],
+              id: 'tooltip2',
+              isLocked: true,
+              location: [0, 0], // same location as newTooltip
+            },
+          ],
+        },
+      } as unknown as MapStoreState;
+    });
+    expect(dispatchMock.mock.calls[0][0]).toEqual({
+      openTooltips: [newTooltip],
+      type: 'SET_OPEN_TOOLTIPS',
+    });
+  });
+
+  test('should remove existing tooltip when adding new tooltip with same features', () => {
+    const action = openOnClickTooltip(newTooltip);
+    const dispatchMock = jest.fn();
+    action(dispatchMock, () => {
+      return {
+        map: {
+          openTooltips: [
+            {
+              features: [
+                {
+                  id: 'feature1',
+                  layerId: 'layer1',
+                  // ensure new props do not break equality check
+                  newProp: 'someValue',
+                },
+              ],
+              id: 'tooltip2',
+              isLocked: true,
+              location: [1, 1],
+            },
+          ],
+        },
+      } as unknown as MapStoreState;
+    });
+    expect(dispatchMock.mock.calls[0][0]).toEqual({
+      openTooltips: [newTooltip],
+      type: 'SET_OPEN_TOOLTIPS',
+    });
+  });
+});
diff --git a/x-pack/plugins/maps/public/actions/tooltip_actions.ts b/x-pack/plugins/maps/public/actions/tooltip_actions.ts
index 22deb1fd1e9303..780012a9fd6ca5 100644
--- a/x-pack/plugins/maps/public/actions/tooltip_actions.ts
+++ b/x-pack/plugins/maps/public/actions/tooltip_actions.ts
@@ -29,7 +29,14 @@ export function openOnClickTooltip(tooltipState: TooltipState) {
       return (
         isLocked &&
         !_.isEqual(location, tooltipState.location) &&
-        !_.isEqual(features, tooltipState.features)
+        !_.isEqual(
+          features.map(({ id, layerId }) => {
+            return { id, layerId };
+          }),
+          tooltipState.features.map(({ id, layerId }) => {
+            return { id, layerId };
+          })
+        )
       );
     });
 

From 164f629fd61c02cadfde9afa78e340ca8a8c38aa Mon Sep 17 00:00:00 2001
From: Alexi Doak <109488926+doakalexi@users.noreply.github.com>
Date: Mon, 23 Jan 2023 11:09:17 -0500
Subject: [PATCH 10/54] [Response Ops][Alerting] Optimize alerting task runner
 for persistent (non-lifecycle rule types) (#149043)

Resolves https://github.com/elastic/kibana/issues/148573

## Summary

To help prepare for the framework to handle persistent (non-lifecycle
rule types) that do not need the auto-recovery functionality performed
by the framework, we added a flag for the rule type so they can opt in
or out

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### To verify

- Create a rule and verify that it is working as expected.
- Set `autoRecoverAlerts: true` for a rule type and create a rule using
that rule type. Verify that the rule does not recover.
---
 .../server/alert/create_alert_factory.test.ts |  41 ++++++
 .../server/alert/create_alert_factory.ts      |   9 ++
 .../legacy_alerts_client.test.ts              |   2 +
 .../alerts_client/legacy_alerts_client.ts     |   5 +
 .../server/lib/process_alerts.test.ts         |  55 +++++++
 .../alerting/server/lib/process_alerts.ts     |  13 +-
 x-pack/plugins/alerting/server/plugin.ts      |   1 +
 .../alerting/server/task_runner/fixtures.ts   |   1 +
 .../server/task_runner/task_runner.test.ts    |  74 ++++++++++
 .../server/task_runner/task_runner.ts         |  13 +-
 x-pack/plugins/alerting/server/types.ts       |   5 +
 .../plugins/alerts/server/alert_types.ts      |  75 ++++++++++
 .../builtin_alert_types/auto_recover/index.ts |  15 ++
 .../builtin_alert_types/auto_recover/rule.ts  | 136 ++++++++++++++++++
 .../alerting/builtin_alert_types/index.ts     |   1 +
 15 files changed, 442 insertions(+), 4 deletions(-)
 create mode 100644 x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/auto_recover/index.ts
 create mode 100644 x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/auto_recover/rule.ts

diff --git a/x-pack/plugins/alerting/server/alert/create_alert_factory.test.ts b/x-pack/plugins/alerting/server/alert/create_alert_factory.test.ts
index 663a0b7401b2ea..c532d1a6640f2e 100644
--- a/x-pack/plugins/alerting/server/alert/create_alert_factory.test.ts
+++ b/x-pack/plugins/alerting/server/alert/create_alert_factory.test.ts
@@ -30,6 +30,7 @@ describe('createAlertFactory()', () => {
       alerts: {},
       logger,
       maxAlerts: 1000,
+      autoRecoverAlerts: true,
     });
     const result = alertFactory.create('1');
     expect(result).toMatchInlineSnapshot(`
@@ -55,6 +56,7 @@ describe('createAlertFactory()', () => {
       },
       logger,
       maxAlerts: 1000,
+      autoRecoverAlerts: true,
     });
     const result = alertFactory.create('1');
     expect(result).toMatchInlineSnapshot(`
@@ -79,6 +81,7 @@ describe('createAlertFactory()', () => {
       alerts,
       logger,
       maxAlerts: 1000,
+      autoRecoverAlerts: true,
     });
     alertFactory.create('1');
     expect(alerts).toMatchInlineSnapshot(`
@@ -98,6 +101,7 @@ describe('createAlertFactory()', () => {
       alerts: {},
       logger,
       maxAlerts: 3,
+      autoRecoverAlerts: true,
     });
 
     expect(alertFactory.hasReachedAlertLimit()).toBe(false);
@@ -117,6 +121,7 @@ describe('createAlertFactory()', () => {
       alerts: {},
       logger,
       maxAlerts: 1000,
+      autoRecoverAlerts: true,
     });
     const result = alertFactory.create('1');
     expect(result).toEqual({
@@ -158,6 +163,7 @@ describe('createAlertFactory()', () => {
       logger,
       canSetRecoveryContext: true,
       maxAlerts: 1000,
+      autoRecoverAlerts: true,
     });
     const result = alertFactory.create('1');
     expect(result).toEqual({
@@ -184,6 +190,7 @@ describe('createAlertFactory()', () => {
       logger,
       maxAlerts: 1000,
       canSetRecoveryContext: true,
+      autoRecoverAlerts: true,
     });
     const result = alertFactory.create('1');
     expect(result).toEqual({
@@ -209,6 +216,7 @@ describe('createAlertFactory()', () => {
       logger,
       maxAlerts: 1000,
       canSetRecoveryContext: true,
+      autoRecoverAlerts: true,
     });
     const result = alertFactory.create('1');
     expect(result).toEqual({
@@ -233,6 +241,7 @@ describe('createAlertFactory()', () => {
       logger,
       maxAlerts: 1000,
       canSetRecoveryContext: false,
+      autoRecoverAlerts: true,
     });
     const result = alertFactory.create('1');
     expect(result).toEqual({
@@ -259,6 +268,7 @@ describe('createAlertFactory()', () => {
       alerts: {},
       logger,
       maxAlerts: 1000,
+      autoRecoverAlerts: true,
     });
 
     const limit = alertFactory.alertLimit.getValue();
@@ -276,6 +286,7 @@ describe('createAlertFactory()', () => {
       alerts: {},
       logger,
       maxAlerts: 1000,
+      autoRecoverAlerts: true,
     });
 
     const limit = alertFactory.alertLimit.getValue();
@@ -290,6 +301,7 @@ describe('createAlertFactory()', () => {
       alerts: {},
       logger,
       maxAlerts: 1000,
+      autoRecoverAlerts: true,
     });
 
     const limit = alertFactory.alertLimit.getValue();
@@ -298,6 +310,34 @@ describe('createAlertFactory()', () => {
     alertFactory.alertLimit.setLimitReached(false);
     alertFactory.alertLimit.checkLimitUsage();
   });
+
+  test('returns empty array if recovered alerts exist but autoRecoverAlerts is false', () => {
+    const alertFactory = createAlertFactory({
+      alerts: {},
+      logger,
+      maxAlerts: 1000,
+      canSetRecoveryContext: true,
+      autoRecoverAlerts: false,
+    });
+    const result = alertFactory.create('1');
+    expect(result).toEqual({
+      meta: {
+        flappingHistory: [],
+      },
+      state: {},
+      context: {},
+      scheduledExecutionOptions: undefined,
+      id: '1',
+    });
+
+    const { getRecoveredAlerts: getRecoveredAlertsFn } = alertFactory.done();
+    const recoveredAlerts = getRecoveredAlertsFn!();
+    expect(Array.isArray(recoveredAlerts)).toBe(true);
+    expect(recoveredAlerts.length).toEqual(0);
+    expect(logger.debug).toHaveBeenCalledWith(
+      `Set autoRecoverAlerts to true on rule type to get access to recovered alerts.`
+    );
+  });
 });
 
 describe('getPublicAlertFactory', () => {
@@ -306,6 +346,7 @@ describe('getPublicAlertFactory', () => {
       alerts: {},
       logger,
       maxAlerts: 1000,
+      autoRecoverAlerts: true,
     });
 
     expect(alertFactory.create).toBeDefined();
diff --git a/x-pack/plugins/alerting/server/alert/create_alert_factory.ts b/x-pack/plugins/alerting/server/alert/create_alert_factory.ts
index ff8aacd52f5feb..99f4c3f2b5da62 100644
--- a/x-pack/plugins/alerting/server/alert/create_alert_factory.ts
+++ b/x-pack/plugins/alerting/server/alert/create_alert_factory.ts
@@ -52,6 +52,7 @@ export interface CreateAlertFactoryOpts<
   alerts: Record<string, Alert<State, Context>>;
   logger: Logger;
   maxAlerts: number;
+  autoRecoverAlerts: boolean;
   canSetRecoveryContext?: boolean;
 }
 
@@ -63,6 +64,7 @@ export function createAlertFactory<
   alerts,
   logger,
   maxAlerts,
+  autoRecoverAlerts,
   canSetRecoveryContext = false,
 }: CreateAlertFactoryOpts<State, Context>): AlertFactory<State, Context, ActionGroupIds> {
   // Keep track of which alerts we started with so we can determine which have recovered
@@ -128,6 +130,12 @@ export function createAlertFactory<
             );
             return [];
           }
+          if (!autoRecoverAlerts) {
+            logger.debug(
+              `Set autoRecoverAlerts to true on rule type to get access to recovered alerts.`
+            );
+            return [];
+          }
 
           const { currentRecoveredAlerts } = processAlerts<
             State,
@@ -140,6 +148,7 @@ export function createAlertFactory<
             previouslyRecoveredAlerts: {},
             hasReachedAlertLimit,
             alertLimit: maxAlerts,
+            autoRecoverAlerts,
             // setFlapping is false, as we only want to use this function to get the recovered alerts
             setFlapping: false,
           });
diff --git a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts
index 25b723e24234d3..e7e62ec848ea33 100644
--- a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts
@@ -124,6 +124,7 @@ describe('Legacy Alerts Client', () => {
       logger,
       maxAlerts: 1000,
       canSetRecoveryContext: false,
+      autoRecoverAlerts: true,
     });
   });
 
@@ -227,6 +228,7 @@ describe('Legacy Alerts Client', () => {
       previouslyRecoveredAlerts: {},
       hasReachedAlertLimit: false,
       alertLimit: 1000,
+      autoRecoverAlerts: true,
       setFlapping: true,
     });
 
diff --git a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts
index 9a8cd78f7fd8f0..c4fa1b8565ca3c 100644
--- a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts
@@ -95,6 +95,7 @@ export class LegacyAlertsClient<
       alerts: this.alerts,
       logger: this.options.logger,
       maxAlerts: this.options.maxAlerts,
+      autoRecoverAlerts: this.options.ruleType.autoRecoverAlerts ?? true,
       canSetRecoveryContext: this.options.ruleType.doesSetRecoveryContext ?? false,
     });
   }
@@ -121,6 +122,10 @@ export class LegacyAlertsClient<
       previouslyRecoveredAlerts: this.recoveredAlertsFromPreviousExecution,
       hasReachedAlertLimit: this.alertFactory!.hasReachedAlertLimit(),
       alertLimit: this.options.maxAlerts,
+      autoRecoverAlerts:
+        this.options.ruleType.autoRecoverAlerts !== undefined
+          ? this.options.ruleType.autoRecoverAlerts
+          : true,
       setFlapping: true,
     });
 
diff --git a/x-pack/plugins/alerting/server/lib/process_alerts.test.ts b/x-pack/plugins/alerting/server/lib/process_alerts.test.ts
index 3b09b072476e61..9dae6c4c033a81 100644
--- a/x-pack/plugins/alerting/server/lib/process_alerts.test.ts
+++ b/x-pack/plugins/alerting/server/lib/process_alerts.test.ts
@@ -55,6 +55,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts,
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -92,6 +93,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -137,6 +139,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -174,6 +177,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -221,6 +225,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -278,6 +283,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -338,6 +344,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts,
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: true,
       });
 
@@ -380,6 +387,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -407,6 +415,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -436,6 +445,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -474,6 +484,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -512,11 +523,42 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts,
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: true,
       });
 
       expect(recoveredAlerts).toEqual(updatedAlerts);
     });
+
+    test('should skip recovery calculations if autoRecoverAlerts = false', () => {
+      const activeAlert = new Alert<AlertInstanceState, AlertInstanceContext>('1');
+      const recoveredAlert1 = new Alert<AlertInstanceState, AlertInstanceContext>('2');
+      const recoveredAlert2 = new Alert<AlertInstanceState, AlertInstanceContext>('3');
+
+      const existingAlerts = {
+        '1': activeAlert,
+        '2': recoveredAlert1,
+        '3': recoveredAlert2,
+      };
+      existingAlerts['2'].replaceState({ start: '1969-12-30T00:00:00.000Z', duration: 33000 });
+      existingAlerts['3'].replaceState({ start: '1969-12-31T07:34:00.000Z', duration: 23532 });
+
+      const updatedAlerts = cloneDeep(existingAlerts);
+
+      updatedAlerts['1'].scheduleActions('default' as never, { foo: '1' });
+
+      const { recoveredAlerts } = processAlerts({
+        alerts: updatedAlerts,
+        existingAlerts,
+        previouslyRecoveredAlerts: {},
+        hasReachedAlertLimit: false,
+        alertLimit: 10,
+        autoRecoverAlerts: false,
+        setFlapping: false,
+      });
+
+      expect(recoveredAlerts).toEqual({});
+    });
   });
 
   describe('when hasReachedAlertLimit is true', () => {
@@ -557,6 +599,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: true,
         alertLimit: 7,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -592,6 +635,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: true,
         alertLimit: 7,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -651,6 +695,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: true,
         alertLimit: MAX_ALERTS,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -684,6 +729,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: true,
       });
 
@@ -734,6 +780,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: true,
       });
 
@@ -770,6 +817,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: { '1': recoveredAlert },
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: true,
       });
 
@@ -825,6 +873,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: {},
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: true,
       });
 
@@ -858,6 +907,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts: alerts,
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: true,
       });
 
@@ -899,6 +949,7 @@ describe('processAlerts', () => {
         previouslyRecoveredAlerts,
         hasReachedAlertLimit: false,
         alertLimit: 10,
+        autoRecoverAlerts: true,
         setFlapping: false,
       });
 
@@ -965,6 +1016,7 @@ describe('processAlerts', () => {
           previouslyRecoveredAlerts: {},
           hasReachedAlertLimit: true,
           alertLimit: 10,
+          autoRecoverAlerts: true,
           setFlapping: true,
         });
 
@@ -1001,6 +1053,7 @@ describe('processAlerts', () => {
           previouslyRecoveredAlerts: {},
           hasReachedAlertLimit: true,
           alertLimit: 10,
+          autoRecoverAlerts: true,
           setFlapping: true,
         });
 
@@ -1062,6 +1115,7 @@ describe('processAlerts', () => {
           previouslyRecoveredAlerts: { '1': activeAlert1 },
           hasReachedAlertLimit: true,
           alertLimit: 10,
+          autoRecoverAlerts: true,
           setFlapping: true,
         });
 
@@ -1138,6 +1192,7 @@ describe('processAlerts', () => {
           previouslyRecoveredAlerts: {},
           hasReachedAlertLimit: true,
           alertLimit: 10,
+          autoRecoverAlerts: true,
           setFlapping: false,
         });
 
diff --git a/x-pack/plugins/alerting/server/lib/process_alerts.ts b/x-pack/plugins/alerting/server/lib/process_alerts.ts
index 40c86dc461ab03..6ce363742a3d82 100644
--- a/x-pack/plugins/alerting/server/lib/process_alerts.ts
+++ b/x-pack/plugins/alerting/server/lib/process_alerts.ts
@@ -20,6 +20,7 @@ interface ProcessAlertsOpts<
   previouslyRecoveredAlerts: Record<string, Alert<State, Context>>;
   hasReachedAlertLimit: boolean;
   alertLimit: number;
+  autoRecoverAlerts: boolean;
   // flag used to determine whether or not we want to push the flapping state on to the flappingHistory array
   setFlapping: boolean;
 }
@@ -47,6 +48,7 @@ export function processAlerts<
   previouslyRecoveredAlerts,
   hasReachedAlertLimit,
   alertLimit,
+  autoRecoverAlerts,
   setFlapping,
 }: ProcessAlertsOpts<State, Context>): ProcessAlertsResult<
   State,
@@ -62,7 +64,13 @@ export function processAlerts<
         alertLimit,
         setFlapping
       )
-    : processAlertsHelper(alerts, existingAlerts, previouslyRecoveredAlerts, setFlapping);
+    : processAlertsHelper(
+        alerts,
+        existingAlerts,
+        previouslyRecoveredAlerts,
+        autoRecoverAlerts,
+        setFlapping
+      );
 }
 
 function processAlertsHelper<
@@ -74,6 +82,7 @@ function processAlertsHelper<
   alerts: Record<string, Alert<State, Context>>,
   existingAlerts: Record<string, Alert<State, Context>>,
   previouslyRecoveredAlerts: Record<string, Alert<State, Context>>,
+  autoRecoverAlerts: boolean,
   setFlapping: boolean
 ): ProcessAlertsResult<State, Context, ActionGroupIds, RecoveryActionGroupId> {
   const existingAlertIds = new Set(Object.keys(existingAlerts));
@@ -123,7 +132,7 @@ function processAlertsHelper<
             updateAlertFlappingHistory(activeAlerts[id], false);
           }
         }
-      } else if (existingAlertIds.has(id)) {
+      } else if (existingAlertIds.has(id) && autoRecoverAlerts) {
         recoveredAlerts[id] = alerts[id];
         currentRecoveredAlerts[id] = alerts[id];
 
diff --git a/x-pack/plugins/alerting/server/plugin.ts b/x-pack/plugins/alerting/server/plugin.ts
index 86d8a7411c16d2..b3b94584025c3b 100644
--- a/x-pack/plugins/alerting/server/plugin.ts
+++ b/x-pack/plugins/alerting/server/plugin.ts
@@ -349,6 +349,7 @@ export class AlertingPlugin {
         ruleType.cancelAlertsOnRuleTimeout =
           ruleType.cancelAlertsOnRuleTimeout ?? this.config.cancelAlertsOnRuleTimeout;
         ruleType.doesSetRecoveryContext = ruleType.doesSetRecoveryContext ?? false;
+        ruleType.autoRecoverAlerts = ruleType.autoRecoverAlerts ?? true;
         ruleTypeRegistry.register(ruleType);
       },
       getSecurityHealth: async () => {
diff --git a/x-pack/plugins/alerting/server/task_runner/fixtures.ts b/x-pack/plugins/alerting/server/task_runner/fixtures.ts
index f841e2e1ff04fa..a92b4f6850e4ad 100644
--- a/x-pack/plugins/alerting/server/task_runner/fixtures.ts
+++ b/x-pack/plugins/alerting/server/task_runner/fixtures.ts
@@ -144,6 +144,7 @@ export const ruleType: jest.Mocked<UntypedNormalizedRuleType> = {
   producer: 'alerts',
   cancelAlertsOnRuleTimeout: true,
   ruleTaskTimeout: '5m',
+  autoRecoverAlerts: true,
 };
 
 export const mockRunNowResponse = {
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
index 629b9ebea1eff5..c0dcd9c74135b0 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
@@ -2876,6 +2876,80 @@ describe('Task Runner', () => {
     expect(inMemoryMetrics.increment.mock.calls[5][0]).toBe(IN_MEMORY_METRICS.RULE_TIMEOUTS);
   });
 
+  test('does not persist alertInstances or recoveredAlertInstances passed in from state if autoRecoverAlerts is false', async () => {
+    ruleType.autoRecoverAlerts = false;
+    ruleType.executor.mockImplementation(
+      async ({
+        services: executorServices,
+      }: RuleExecutorOptions<
+        RuleTypeParams,
+        RuleTypeState,
+        AlertInstanceState,
+        AlertInstanceContext,
+        string
+      >) => {
+        executorServices.alertFactory.create('1').scheduleActions('default');
+        return { state: {} };
+      }
+    );
+    const date = new Date().toISOString();
+    const taskRunner = new TaskRunner(
+      ruleType,
+      {
+        ...mockedTaskInstance,
+        state: {
+          ...mockedTaskInstance.state,
+          alertInstances: {
+            '1': {
+              meta: { lastScheduledActions: { group: 'default', date } },
+              state: {
+                bar: false,
+                start: DATE_1969,
+                duration: '80000000000',
+              },
+            },
+            '2': {
+              meta: { lastScheduledActions: { group: 'default', date } },
+              state: {
+                bar: false,
+                start: '1969-12-31T06:00:00.000Z',
+                duration: '70000000000',
+              },
+            },
+          },
+        },
+      },
+      taskRunnerFactoryInitializerParams,
+      inMemoryMetrics
+    );
+    expect(AlertingEventLogger).toHaveBeenCalled();
+
+    rulesClient.getAlertFromRaw.mockReturnValue(mockedRuleTypeSavedObject as Rule);
+    encryptedSavedObjectsClient.getDecryptedAsInternalUser.mockResolvedValue(SAVED_OBJECT);
+    const runnerResult = await taskRunner.run();
+    expect(runnerResult.state.alertInstances).toEqual({});
+    expect(runnerResult.state.alertRecoveredInstances).toEqual({});
+
+    testAlertingEventLogCalls({
+      activeAlerts: 1,
+      recoveredAlerts: 0,
+      triggeredActions: 0,
+      generatedActions: 1,
+      status: 'ok',
+      logAlert: 1,
+    });
+    expect(alertingEventLogger.logAlert).toHaveBeenNthCalledWith(
+      1,
+      generateAlertOpts({
+        action: EVENT_LOG_ACTIONS.activeInstance,
+        group: 'default',
+        state: { bar: false, start: DATE_1969, duration: MOCK_DURATION },
+      })
+    );
+
+    expect(mockUsageCounter.incrementCounter).not.toHaveBeenCalled();
+  });
+
   function testAlertingEventLogCalls({
     ruleContext = alertingEventLoggerInitializer,
     activeAlerts = 0,
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
index 347c330361092c..ae9b8fab804260 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
@@ -44,6 +44,7 @@ import {
   RuleTypeParams,
   RuleTypeState,
   parseDuration,
+  RawAlertInstance,
 } from '../../common';
 import { NormalizedRuleType, UntypedNormalizedRuleType } from '../rule_type_registry';
 import { getEsErrorMessage } from '../lib/errors';
@@ -455,8 +456,16 @@ export class TaskRunner<
       }
     });
 
-    const { alertsToReturn, recoveredAlertsToReturn } =
-      this.legacyAlertsClient.getAlertsToSerialize();
+    let alertsToReturn: Record<string, RawAlertInstance> = {};
+    let recoveredAlertsToReturn: Record<string, RawAlertInstance> = {};
+    // Only serialize alerts into task state if we're auto-recovering, otherwise
+    // we don't need to keep this information around.
+    if (this.ruleType.autoRecoverAlerts) {
+      const { alertsToReturn: alerts, recoveredAlertsToReturn: recovered } =
+        this.legacyAlertsClient.getAlertsToSerialize();
+      alertsToReturn = alerts;
+      recoveredAlertsToReturn = recovered;
+    }
 
     return {
       metrics: ruleRunMetricsStore.getMetrics(),
diff --git a/x-pack/plugins/alerting/server/types.ts b/x-pack/plugins/alerting/server/types.ts
index f2a368c062d051..f4b7cc57b27e47 100644
--- a/x-pack/plugins/alerting/server/types.ts
+++ b/x-pack/plugins/alerting/server/types.ts
@@ -204,6 +204,11 @@ export interface RuleType<
   cancelAlertsOnRuleTimeout?: boolean;
   doesSetRecoveryContext?: boolean;
   getSummarizedAlerts?: GetSummarizedAlertsFn;
+  /**
+   * Determines whether framework should
+   * automatically make recovery determination. Defaults to true.
+   */
+  autoRecoverAlerts?: boolean;
 }
 export type UntypedRuleType = RuleType<
   RuleTypeParams,
diff --git a/x-pack/test/alerting_api_integration/common/plugins/alerts/server/alert_types.ts b/x-pack/test/alerting_api_integration/common/plugins/alerts/server/alert_types.ts
index 9360441c3d5ac1..0c8390ca938dc9 100644
--- a/x-pack/test/alerting_api_integration/common/plugins/alerts/server/alert_types.ts
+++ b/x-pack/test/alerting_api_integration/common/plugins/alerts/server/alert_types.ts
@@ -553,6 +553,80 @@ function getPatternSuccessOrFailureAlertType() {
   return result;
 }
 
+function getPatternFiringAutoRecoverFalseAlertType() {
+  const paramsSchema = schema.object({
+    pattern: schema.recordOf(
+      schema.string(),
+      schema.arrayOf(schema.oneOf([schema.boolean(), schema.string()]))
+    ),
+    reference: schema.maybe(schema.string()),
+  });
+  type ParamsType = TypeOf<typeof paramsSchema>;
+  interface State extends RuleTypeState {
+    patternIndex?: number;
+  }
+  const result: RuleType<ParamsType, never, State, {}, {}, 'default'> = {
+    id: 'test.patternFiringAutoRecoverFalse',
+    name: 'Test: Firing on a Pattern with Auto Recover: false',
+    actionGroups: [{ id: 'default', name: 'Default' }],
+    producer: 'alertsFixture',
+    defaultActionGroupId: 'default',
+    minimumLicenseRequired: 'basic',
+    isExportable: true,
+    autoRecoverAlerts: false,
+    async executor(alertExecutorOptions) {
+      const { services, state, params } = alertExecutorOptions;
+      const pattern = params.pattern;
+      if (typeof pattern !== 'object') throw new Error('pattern is not an object');
+      let maxPatternLength = 0;
+      for (const [instanceId, instancePattern] of Object.entries(pattern)) {
+        if (!Array.isArray(instancePattern)) {
+          throw new Error(`pattern for instance ${instanceId} is not an array`);
+        }
+        maxPatternLength = Math.max(maxPatternLength, instancePattern.length);
+      }
+
+      if (params.reference) {
+        await services.scopedClusterClient.asCurrentUser.index({
+          index: ES_TEST_INDEX_NAME,
+          refresh: 'wait_for',
+          body: {
+            reference: params.reference,
+            source: 'alert:test.patternFiringAutoRecoverFalse',
+            ...alertExecutorOptions,
+          },
+        });
+      }
+
+      // get the pattern index, return if past it
+      const patternIndex = state.patternIndex ?? 0;
+      if (patternIndex >= maxPatternLength) {
+        return { state: { patternIndex } };
+      }
+
+      // fire if pattern says to
+      for (const [instanceId, instancePattern] of Object.entries(pattern)) {
+        const scheduleByPattern = instancePattern[patternIndex];
+        if (scheduleByPattern === true) {
+          services.alertFactory.create(instanceId).scheduleActions('default', {
+            ...EscapableStrings,
+            deep: DeepContextVariables,
+          });
+        } else if (typeof scheduleByPattern === 'string') {
+          services.alertFactory.create(instanceId).scheduleActions('default', scheduleByPattern);
+        }
+      }
+
+      return {
+        state: {
+          patternIndex: patternIndex + 1,
+        },
+      };
+    },
+  };
+  return result;
+}
+
 function getLongRunningPatternRuleType(cancelAlertsOnRuleTimeout: boolean = true) {
   let globalPatternIndex = 0;
   const paramsSchema = schema.object({
@@ -925,4 +999,5 @@ export function defineAlertTypes(
   alerting.registerType(getPatternSuccessOrFailureAlertType());
   alerting.registerType(getExceedsAlertLimitRuleType());
   alerting.registerType(getAlwaysFiringAlertAsDataRuleType(logger, { ruleRegistry }));
+  alerting.registerType(getPatternFiringAutoRecoverFalseAlertType());
 }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/auto_recover/index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/auto_recover/index.ts
new file mode 100644
index 00000000000000..619f6e9b4c93eb
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/auto_recover/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../../../../common/ftr_provider_context';
+
+// eslint-disable-next-line import/no-default-export
+export default function alertingTests({ loadTestFile }: FtrProviderContext) {
+  describe('auto_recover_rule', () => {
+    loadTestFile(require.resolve('./rule'));
+  });
+}
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/auto_recover/rule.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/auto_recover/rule.ts
new file mode 100644
index 00000000000000..d46c2d2c60958b
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/auto_recover/rule.ts
@@ -0,0 +1,136 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import { ESTestIndexTool, ES_TEST_INDEX_NAME } from '@kbn/alerting-api-integration-helpers';
+import { RecoveredActionGroup } from '@kbn/alerting-plugin/common';
+
+import { Spaces } from '../../../../scenarios';
+import { FtrProviderContext } from '../../../../../common/ftr_provider_context';
+import { getUrlPrefix, ObjectRemover, TaskManagerUtils } from '../../../../../common/lib';
+import { createEsDocuments } from '../lib/create_test_data';
+
+const RULE_INTERVAL_SECONDS = 6;
+const RULE_INTERVALS_TO_WRITE = 5;
+const RULE_INTERVAL_MILLIS = RULE_INTERVAL_SECONDS * 1000;
+const ES_GROUPS_TO_WRITE = 3;
+
+// eslint-disable-next-line import/no-default-export
+export default function ruleTests({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+  const retry = getService('retry');
+  const es = getService('es');
+  const esTestIndexTool = new ESTestIndexTool(es, retry);
+  const taskManagerUtils = new TaskManagerUtils(es, retry);
+
+  describe('rule that sets autoRecoverAlerts to false', () => {
+    let endDate: string;
+    const objectRemover = new ObjectRemover(supertest);
+
+    beforeEach(async () => {
+      await esTestIndexTool.destroy();
+      await esTestIndexTool.setup();
+
+      // write documents in the future, figure out the end date
+      const endDateMillis = Date.now() + (RULE_INTERVALS_TO_WRITE - 1) * RULE_INTERVAL_MILLIS;
+      endDate = new Date(endDateMillis).toISOString();
+    });
+
+    afterEach(async () => {
+      await objectRemover.removeAll();
+    });
+
+    it('runs successfully and does not auto recover', async () => {
+      const testStart = new Date();
+      await createEsDocuments(
+        es,
+        esTestIndexTool,
+        endDate,
+        RULE_INTERVALS_TO_WRITE,
+        RULE_INTERVAL_MILLIS,
+        ES_GROUPS_TO_WRITE
+      );
+
+      await createRule({
+        name: 'test rule',
+        pattern: [true, false, true],
+      });
+
+      await taskManagerUtils.waitForActionTaskParamsToBeCleanedUp(testStart);
+
+      const actionTestRecord = await esTestIndexTool.waitForDocs('action:test.index-record', '', 2);
+
+      await esTestIndexTool.search('alert:test.patternFiringAutoRecoverFalse', '');
+
+      expect(actionTestRecord[0]._source.params.message).to.eql('Active message');
+      expect(actionTestRecord[1]._source.params.message).to.eql('Active message');
+    });
+
+    interface CreateRuleParams {
+      name: string;
+      pattern: boolean[];
+    }
+
+    async function createRule(params: CreateRuleParams) {
+      const { body: createdAction } = await supertest
+        .post(`${getUrlPrefix(Spaces.space1.id)}/api/actions/connector`)
+        .set('kbn-xsrf', 'foo')
+        .send({
+          name: 'My action',
+          connector_type_id: 'test.index-record',
+          config: {
+            unencrypted: `This value shouldn't get encrypted`,
+          },
+          secrets: {
+            encrypted: 'This value should be encrypted',
+          },
+        })
+        .expect(200);
+      objectRemover.add(Spaces.space1.id, createdAction.id, 'action', 'actions');
+
+      const { status, body: createdRule } = await supertest
+        .post(`${getUrlPrefix(Spaces.space1.id)}/api/alerting/rule`)
+        .set('kbn-xsrf', 'foo')
+        .send({
+          name: params.name,
+          consumer: 'alerts',
+          enabled: true,
+          rule_type_id: 'test.patternFiringAutoRecoverFalse',
+          schedule: { interval: '1s' },
+          actions: [
+            {
+              group: 'default',
+              id: createdAction.id,
+              params: {
+                index: ES_TEST_INDEX_NAME,
+                reference: '',
+                message: 'Active message',
+              },
+            },
+            {
+              group: RecoveredActionGroup.id,
+              id: createdAction.id,
+              params: {
+                index: ES_TEST_INDEX_NAME,
+                reference: '',
+                message: 'Recovered message',
+              },
+            },
+          ],
+          notify_when: 'onThrottleInterval',
+          params: {
+            pattern: {
+              instance: params.pattern,
+            },
+          },
+        });
+
+      expect(status).to.be(200);
+      objectRemover.add(Spaces.space1.id, createdRule.id, 'rule', 'alerting');
+    }
+  });
+}
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/index.ts
index 51a3cfd04be83c..83c77b504833e3 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/index.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/builtin_alert_types/index.ts
@@ -15,5 +15,6 @@ export default function alertingTests({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./long_running'));
     loadTestFile(require.resolve('./cancellable'));
     loadTestFile(require.resolve('./circuit_breaker'));
+    loadTestFile(require.resolve('./auto_recover'));
   });
 }

From 422e9444b1ec1893775dfee2e23cedd088e777b4 Mon Sep 17 00:00:00 2001
From: Aleh Zasypkin <aleh.zasypkin@elastic.co>
Date: Mon, 23 Jan 2023 17:20:38 +0100
Subject: [PATCH 11/54] =?UTF-8?q?Upgrade=20`cookiejar`=20dependency=20(`2.?=
 =?UTF-8?q?1.1`=20=E2=86=92=20`2.1.4`).=20(#149323)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../test_suites/core_plugins/ui_settings.ts   |  2 +-
 yarn.lock                                     | 50 +++++++------------
 2 files changed, 18 insertions(+), 34 deletions(-)

diff --git a/test/plugin_functional/test_suites/core_plugins/ui_settings.ts b/test/plugin_functional/test_suites/core_plugins/ui_settings.ts
index ccbbf7f4d42594..8099b9b7786a63 100644
--- a/test/plugin_functional/test_suites/core_plugins/ui_settings.ts
+++ b/test/plugin_functional/test_suites/core_plugins/ui_settings.ts
@@ -48,7 +48,7 @@ export default function ({ getService, getPageObjects }: PluginFunctionalProvide
     });
 
     it('server plugins have access to registered settings', async () => {
-      await supertest.get('/api/ui-settings-plugin').expect(200).expect({ uiSettingsValue: 2 });
+      await supertest.get('/api/ui-settings-plugin').expect(200).expect({ uiSettingsValue: '2' });
     });
   });
 }
diff --git a/yarn.lock b/yarn.lock
index eec06d3d69577e..432eca0c8f1246 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -6695,9 +6695,9 @@
     "@types/node" "*"
 
 "@types/cookiejar@*":
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/@types/cookiejar/-/cookiejar-2.1.0.tgz#4b7daf2c51696cfc70b942c11690528229d1a1ce"
-  integrity sha512-EIjmpvnHj+T4nMcKwHwxZKUfDmphIKJc2qnEMhSoOvr1lYEQpuRKRz8orWr//krYIIArS/KGGLfL2YGVUYXmIA==
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/@types/cookiejar/-/cookiejar-2.1.2.tgz#66ad9331f63fe8a3d3d9d8c6e3906dd10f6446e8"
+  integrity sha512-t73xJJrvdTjXrn4jLS9VSGRbz0nUY3cl2DMGDU48lKl+HR9dbbjW2A9r3g40VA++mQpy6uuHg33gy7du2BKpog==
 
 "@types/cytoscape@^3.14.0":
   version "3.14.0"
@@ -7888,9 +7888,9 @@
     "@types/node" "*"
 
 "@types/supertest@^2.0.5":
-  version "2.0.8"
-  resolved "https://registry.yarnpkg.com/@types/supertest/-/supertest-2.0.8.tgz#23801236e2b85204ed771a8e7c40febba7da2bda"
-  integrity sha512-wcax7/ip4XSSJRLbNzEIUVy2xjcBIZZAuSd2vtltQfRK7kxhx5WMHbLHkYdxN3wuQCrwpYrg86/9byDjPXoGMA==
+  version "2.0.12"
+  resolved "https://registry.yarnpkg.com/@types/supertest/-/supertest-2.0.12.tgz#ddb4a0568597c9aadff8dbec5b2e8fddbe8692fc"
+  integrity sha512-X3HPWTwXRerBZS7Mo1k6vMVR1Z6zmJcDVn5O/31whe0tnjE4te6ZJSJGq1RiqHPjzPdMTfjCFogDJmwng9xHaQ==
   dependencies:
     "@types/superagent" "*"
 
@@ -11241,9 +11241,9 @@ cookie@^0.5.0:
   integrity sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==
 
 cookiejar@^2.1.0:
-  version "2.1.1"
-  resolved "https://registry.yarnpkg.com/cookiejar/-/cookiejar-2.1.1.tgz#41ad57b1b555951ec171412a81942b1e8200d34a"
-  integrity sha1-Qa1XsbVVlR7BcUEqgZQrHoIA00o=
+  version "2.1.4"
+  resolved "https://registry.yarnpkg.com/cookiejar/-/cookiejar-2.1.4.tgz#ee669c1fea2cf42dc31585469d193fef0d65771b"
+  integrity sha512-LDx6oHrK+PhzLKJU9j5S7/Y3jM/mUHvD/DeI1WQmJn652iPC5Y4TBzC9l+5OMOXlyTTA+SmVUPm0HQUwpD5Jqw==
 
 copy-anything@^3.0.2:
   version "3.0.2"
@@ -14844,7 +14844,7 @@ format@^0.2.0:
   resolved "https://registry.yarnpkg.com/format/-/format-0.2.2.tgz#d6170107e9efdc4ed30c9dc39016df942b5cb58b"
   integrity sha1-1hcBB+nv3E7TDJ3DkBbflCtctYs=
 
-formidable@^1.1.1, formidable@^1.2.0:
+formidable@^1.2.0:
   version "1.2.2"
   resolved "https://registry.yarnpkg.com/formidable/-/formidable-1.2.2.tgz#bf69aea2972982675f00865342b982986f6b8dd9"
   integrity sha512-V8gLm+41I/8kguQ4/o1D3RIHRmhYFG4pnNyonvua+40rqcEmT4+V71yaZ3B457xbbgCsCfjSPi65u/W6vK1U5Q==
@@ -19674,7 +19674,7 @@ merge2@^1.2.3, merge2@^1.3.0, merge2@^1.4.1:
   resolved "https://registry.yarnpkg.com/merge2/-/merge2-1.4.1.tgz#4368892f885e907455a6fd7dc55c0c9d404990ae"
   integrity sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==
 
-methods@^1.1.1, methods@~1.1.2:
+methods@^1.1.1, methods@^1.1.2, methods@~1.1.2:
   version "1.1.2"
   resolved "https://registry.yarnpkg.com/methods/-/methods-1.1.2.tgz#5529a4d67654134edcc5266656835b0f851afcee"
   integrity sha1-VSmk1nZUE07cxSZmVoNbD4Ua/O4=
@@ -25834,23 +25834,7 @@ success-symbol@^0.1.0:
   resolved "https://registry.yarnpkg.com/success-symbol/-/success-symbol-0.1.0.tgz#24022e486f3bf1cdca094283b769c472d3b72897"
   integrity sha1-JAIuSG878c3KCUKDt2nEctO3KJc=
 
-superagent@3.8.2:
-  version "3.8.2"
-  resolved "https://registry.yarnpkg.com/superagent/-/superagent-3.8.2.tgz#e4a11b9d047f7d3efeb3bbe536d9ec0021d16403"
-  integrity sha512-gVH4QfYHcY3P0f/BZzavLreHW3T1v7hG9B+hpMQotGQqurOvhv87GcMCd6LWySmBuf+BDR44TQd0aISjVHLeNQ==
-  dependencies:
-    component-emitter "^1.2.0"
-    cookiejar "^2.1.0"
-    debug "^3.1.0"
-    extend "^3.0.0"
-    form-data "^2.3.1"
-    formidable "^1.1.1"
-    methods "^1.1.1"
-    mime "^1.4.1"
-    qs "^6.5.1"
-    readable-stream "^2.0.5"
-
-superagent@^3.8.2:
+superagent@^3.8.2, superagent@^3.8.3:
   version "3.8.3"
   resolved "https://registry.yarnpkg.com/superagent/-/superagent-3.8.3.tgz#460ea0dbdb7d5b11bc4f78deba565f86a178e128"
   integrity sha512-GLQtLMCoEIK4eDv6OGtkOoSMt3D+oq0y3dsxMuYuDvaNUvuT8eFBuLmfR0iYYzHC1e8hpzC6ZsxbuP6DIalMFA==
@@ -25881,12 +25865,12 @@ superjson@^1.10.0:
     copy-anything "^3.0.2"
 
 supertest@^3.1.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/supertest/-/supertest-3.1.0.tgz#f9ebaf488e60f2176021ec580bdd23ad269e7bc6"
-  integrity sha512-O44AMnmJqx294uJQjfUmEyYOg7d9mylNFsMw/Wkz4evKd1njyPrtCN+U6ZIC7sKtfEVQhfTqFFijlXx8KP/Czw==
+  version "3.4.2"
+  resolved "https://registry.yarnpkg.com/supertest/-/supertest-3.4.2.tgz#bad7de2e43d60d27c8caeb8ab34a67c8a5f71aad"
+  integrity sha512-WZWbwceHUo2P36RoEIdXvmqfs47idNNZjCuJOqDz6rvtkk8ym56aU5oglORCpPeXGxT7l9rkJ41+O1lffQXYSA==
   dependencies:
-    methods "~1.1.2"
-    superagent "3.8.2"
+    methods "^1.1.2"
+    superagent "^3.8.3"
 
 supports-color@8.1.1, supports-color@^8.0.0, supports-color@^8.1.1:
   version "8.1.1"

From 2dd9c3a3377c0a4451588bb187a4453dbdf04f9e Mon Sep 17 00:00:00 2001
From: Spencer <spencer@elastic.co>
Date: Mon, 23 Jan 2023 10:21:24 -0600
Subject: [PATCH 12/54] [dev-cli] restart Kibana when config is changed
 (#149334)

Restores the behavior of the dev cli prior to
https://github.com/elastic/kibana/pull/148924, allowing changes in
`config/**/*.yml` files to trigger server restarts.
---
 packages/kbn-cli-dev-mode/src/watcher.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/kbn-cli-dev-mode/src/watcher.ts b/packages/kbn-cli-dev-mode/src/watcher.ts
index bf5063ac364a47..660022b6fc5715 100644
--- a/packages/kbn-cli-dev-mode/src/watcher.ts
+++ b/packages/kbn-cli-dev-mode/src/watcher.ts
@@ -18,9 +18,10 @@ import { Log } from './log';
 const packageMatcher = makeMatcher(['**/*', '!**/.*']);
 
 /**
- * Any non-package code must match this in order to trigger a restart
+ * Any code that is outside of a package must match this in order to trigger a restart
  */
 const nonPackageMatcher = makeMatcher([
+  'config/**/*.yml',
   'src/**',
   '!src/{dev,fixtures}/**',
   'x-pack/plugins/**',

From 6c0f67afc204f08771c3d126d0738db1ad3b61d9 Mon Sep 17 00:00:00 2001
From: Steph Milovic <stephanie.milovic@elastic.co>
Date: Mon, 23 Jan 2023 10:07:08 -0700
Subject: [PATCH 13/54] [Security Solution] Security Common Schema Package
 (#148664)

---
 .github/CODEOWNERS                            |   1 +
 package.json                                  |   1 +
 packages/kbn-securitysolution-ecs/README.md   |   4 +
 packages/kbn-securitysolution-ecs/index.ts    |   9 +
 .../kbn-securitysolution-ecs/jest.config.js   |  13 +
 .../kbn-securitysolution-ecs/kibana.jsonc     |   5 +
 .../kbn-securitysolution-ecs/package.json     |   6 +
 .../src}/agent/index.ts                       |   5 +-
 .../src}/auditd/index.ts                      |   5 +-
 .../src}/cloud/index.ts                       |   5 +-
 .../src}/destination/index.ts                 |   5 +-
 .../src}/dll/index.ts                         |   5 +-
 .../src}/dns/index.ts                         |   5 +-
 .../src}/ecs_fields/extend_map.test.ts        |   5 +-
 .../src}/ecs_fields/extend_map.ts             |   5 +-
 .../src}/ecs_fields/index.ts                  |   5 +-
 .../src}/endgame/index.ts                     |   5 +-
 .../src}/event/index.ts                       |   5 +-
 .../src}/file/index.ts                        |   5 +-
 .../src}/geo/index.ts                         |   5 +-
 .../src}/host/index.ts                        |   5 +-
 .../src}/http/index.ts                        |   5 +-
 .../kbn-securitysolution-ecs/src}/index.ts    | 129 +++++--
 .../src}/memory_protection/index.ts           |   6 +-
 .../src}/network/index.ts                     |   5 +-
 .../src}/process/index.ts                     |   5 +-
 .../src}/ransomware/index.ts                  |   5 +-
 .../src}/registry/index.ts                    |   5 +-
 .../src}/rule/index.ts                        |   5 +-
 .../src}/signal/index.ts                      |   5 +-
 .../src}/source/index.ts                      |   5 +-
 .../src}/suricata/index.ts                    |   5 +-
 .../src}/system/index.ts                      |   5 +-
 .../src}/target_type/index.ts                 |   5 +-
 .../src}/threat/index.ts                      |  10 +-
 .../src}/tls/index.ts                         |   5 +-
 .../src}/url/index.ts                         |   5 +-
 .../src}/user/index.ts                        |   5 +-
 .../src}/winlog/index.ts                      |   5 +-
 .../src}/zeek/index.ts                        |   5 +-
 .../kbn-securitysolution-ecs/tsconfig.json    |  16 +
 tsconfig.base.json                            |   2 +
 .../components/observability_actions.tsx      |   2 +-
 x-pack/plugins/observability/tsconfig.json    |   1 +
 .../common/ecs/auditd/index.ts                |  46 ---
 .../common/ecs/cloud/index.ts                 |  21 -
 .../security_solution/common/ecs/dns/index.ts |  20 -
 .../security_solution/common/ecs/geo/index.ts |  21 -
 .../common/ecs/host/index.ts                  |  36 --
 .../common/ecs/http/index.ts                  |  38 --
 .../common/ecs/ransomware/index.ts            |  30 --
 .../common/ecs/suricata/index.ts              |  24 --
 .../security_solution/common/ecs/tls/index.ts |  34 --
 .../security_solution/common/ecs/url/index.ts |  16 -
 .../common/ecs/user/index.ts                  |  22 --
 .../common/ecs/winlog/index.ts                |  10 -
 .../security_solution/hosts/common/index.ts   |   3 +-
 .../hosts/uncommon_processes/index.ts         |   4 +-
 .../security_solution/network/common/index.ts |   2 +-
 .../network/details/index.ts                  |   3 +-
 .../users/authentications/index.ts            |   4 +-
 .../security_solution/users/common/index.ts   |   3 +-
 .../common/types/header_actions/index.ts      |   2 +-
 .../common/types/timeline/cells/index.ts      |   2 +-
 .../common/components/data_table/helpers.tsx  |   2 +-
 .../event_details/event_details.tsx           |   2 +-
 .../event_details/get_alert_summary_rows.tsx  |   2 +-
 .../components/event_details/osquery_tab.tsx  |   2 +-
 .../plugins/osquery/renderer.tsx              |   2 +-
 .../common/demo_data/endgame_ecs/creation.ts  |   2 +-
 .../common/demo_data/endgame_ecs/dns.ts       |   2 +-
 .../demo_data/endgame_ecs/file_events.ts      |   2 +-
 .../common/demo_data/endgame_ecs/ipv4.ts      |   2 +-
 .../demo_data/endgame_ecs/termination.ts      |   2 +-
 .../demo_data/endgame_ecs/user_logon.ts       |   2 +-
 .../demo_data/endpoint/library_load_event.ts  |   2 +-
 ...cess_execution_malware_prevention_alert.ts |   2 +-
 .../endpoint/registry_modification_event.ts   |   2 +-
 .../public/common/demo_data/netflow.ts        |   2 +-
 .../default_cell_actions.test.tsx             |   2 +-
 .../common/lib/cell_actions/field_value.tsx   |   2 +-
 .../common/mock/mock_detection_alerts.ts      |   2 +-
 .../common/mock/mock_detection_alerts_aad.ts  |   2 +-
 .../common/mock/mock_endgame_ecs_data.ts      |   2 +-
 .../public/common/mock/mock_timeline_data.ts  |   2 +-
 .../common/utils/endpoint_alert_check.test.ts |   2 +-
 .../common/utils/endpoint_alert_check.ts      |   2 +-
 .../rule_exceptions/utils/helpers.test.tsx    |   2 +-
 .../rule_exceptions/utils/helpers.tsx         |   3 +-
 .../rule_exceptions/utils/types.ts            |   3 +-
 .../components/alerts_table/actions.test.tsx  |   2 +-
 .../components/alerts_table/actions.tsx       |   2 +-
 .../alert_context_menu.test.tsx               |   2 +-
 .../timeline_actions/alert_context_menu.tsx   |   2 +-
 .../investigate_in_resolver.test.tsx          |   2 +-
 .../investigate_in_resolver.tsx               |   2 +-
 .../investigate_in_timeline_action.test.tsx   |   2 +-
 .../investigate_in_timeline_action.tsx        |   3 +-
 .../use_add_to_case_actions.tsx               |   2 +-
 .../use_investigate_in_timeline.test.tsx      |   2 +-
 .../use_investigate_in_timeline.tsx           |   2 +-
 .../components/alerts_table/types.ts          |   2 +-
 .../components/osquery/osquery_flyout.tsx     |   2 +-
 .../components/take_action_dropdown/index.tsx |   2 +-
 .../__mocks__/alert_details_response.ts       |   2 +-
 .../summary/alert_renderer_panel/index.tsx    |   2 +-
 .../alert_details/tabs/summary/index.tsx      |   2 +-
 .../hosts/components/hosts_table/index.tsx    |   2 +-
 .../uncommon_process_table/index.tsx          |   2 +-
 .../security_solution/public/helpers.tsx      |   2 +-
 .../pages/event_filters/test_utils/index.ts   |   2 +-
 .../view/components/event_filters_flyout.tsx  |   2 +-
 .../pages/event_filters/view/utils.ts         |   2 +-
 .../field_renderers/field_renderers.test.tsx  |   2 +-
 .../field_renderers/field_renderers.tsx       |   2 +-
 .../event_details/expandable_event.tsx        |   2 +-
 .../side_panel/event_details/flyout/body.tsx  |   2 +-
 .../event_details/flyout/footer.test.tsx      |   2 +-
 .../event_details/flyout/footer.tsx           |   2 +-
 .../side_panel/event_details/index.test.tsx   |   2 +-
 .../body/data_driven_columns/index.tsx        |   2 +-
 .../body/events/event_column_view.tsx         |   2 +-
 .../components/timeline/body/helpers.test.ts  |   2 +-
 .../components/timeline/body/helpers.tsx      |   2 +-
 .../alert_renderer/helpers/index.test.tsx     |   2 +-
 .../alert_renderer/helpers/index.tsx          |   2 +-
 .../renderers/alert_renderer/index.test.tsx   |   2 +-
 .../body/renderers/auditd/generic_details.tsx |   2 +-
 .../renderers/auditd/generic_file_details.tsx |   2 +-
 .../auditd/generic_row_renderer.test.tsx      |   2 +-
 .../body/renderers/column_renderer.ts         |   2 +-
 .../combine_renderers/index.test.tsx          |   2 +-
 .../renderers/combine_renderers/index.tsx     |   2 +-
 .../threat_match_row_renderer.test.tsx.snap   |  32 --
 .../timeline/body/renderers/cti/helpers.ts    |   3 +-
 .../body/renderers/cti/threat_match_row.tsx   |  18 +-
 .../cti/threat_match_row_renderer.test.tsx    |  23 +-
 .../dns/dns_request_event_details.tsx         |   2 +-
 .../endgame_security_event_details.tsx        |   2 +-
 .../event_summary_column_renderer.tsx         |   2 +-
 .../body/renderers/get_row_renderer.test.tsx  |   2 +-
 .../body/renderers/get_row_renderer.ts        |   2 +-
 .../timeline/body/renderers/netflow.tsx       |   2 +-
 .../netflow/netflow_row_renderer.test.tsx     |   2 +-
 .../renderers/plain_row_renderer.test.tsx     |   2 +-
 .../body/renderers/reason_column_renderer.tsx |   2 +-
 .../registry/registry_event_details.tsx       |   2 +-
 .../renderers/suricata/suricata_details.tsx   |   2 +-
 .../suricata/suricata_row_renderer.test.tsx   |   2 +-
 .../body/renderers/system/generic_details.tsx |   2 +-
 .../renderers/system/generic_file_details.tsx |   2 +-
 .../system/generic_row_renderer.test.tsx      |   2 +-
 .../body/renderers/zeek/zeek_details.tsx      |   2 +-
 .../renderers/zeek/zeek_row_renderer.test.tsx |   2 +-
 .../renderers/zeek/zeek_signature.test.tsx    |   2 +-
 .../body/renderers/zeek/zeek_signature.tsx    |   2 +-
 .../default_cell_renderer.test.tsx            |   2 +-
 .../timelines/containers/details/index.tsx    |   2 +-
 .../factory/hosts/all/helpers.ts              |   2 +-
 .../factory/hosts/all/query.all_hosts.dsl.ts  |   2 +-
 .../factory/hosts/details/helpers.ts          |   2 +-
 .../hosts/details/query.host_details.dsl.ts   |   2 +-
 .../hosts/uncommon_processes/dsl/query.dsl.ts |   6 +-
 .../hosts/uncommon_processes/helpers.test.ts  |   2 +-
 .../factory/hosts/uncommon_processes/index.ts |   2 +-
 .../factory/network/details/helpers.ts        |   2 +-
 .../factory/users/authentications/helpers.ts  |   2 +-
 .../plugins/security_solution/tsconfig.json   |   1 +
 .../timelines/common/ecs/agent/index.ts       |  10 -
 .../timelines/common/ecs/destination/index.ts |  22 --
 .../common/ecs/ecs_fields/extend_map.test.ts  |  57 ---
 .../common/ecs/ecs_fields/extend_map.ts       |  15 -
 .../timelines/common/ecs/ecs_fields/index.ts  | 360 ------------------
 .../timelines/common/ecs/endgame/index.ts     |  22 --
 .../timelines/common/ecs/event/index.ts       |  46 ---
 .../timelines/common/ecs/file/index.ts        |  61 ---
 x-pack/plugins/timelines/common/ecs/index.ts  |  77 ----
 .../timelines/common/ecs/network/index.ts     |  15 -
 .../timelines/common/ecs/process/index.ts     |  49 ---
 .../timelines/common/ecs/registry/index.ts    |  13 -
 .../timelines/common/ecs/rule/index.ts        |  43 ---
 .../timelines/common/ecs/signal/index.ts      |  18 -
 .../timelines/common/ecs/source/index.ts      |  17 -
 .../timelines/common/ecs/system/index.ts      |  40 --
 .../timelines/common/ecs/threat/index.ts      |  47 ---
 .../timelines/common/ecs/zeek/index.ts        | 134 -------
 .../timeline/events/all/index.ts              |   2 +-
 .../timeline/events/details/index.ts          |   2 +-
 .../common/types/timeline/actions/index.ts    |   2 +-
 .../common/types/timeline/cells/index.ts      |   2 +-
 .../timelines/common/types/timeline/index.ts  |   2 +-
 .../common/types/timeline/rows/index.ts       |   2 +-
 .../factory/helpers/build_ecs_objects.ts      |   2 +-
 .../factory/helpers/build_object_recursive.ts |   2 +-
 x-pack/plugins/timelines/tsconfig.json        |   1 +
 .../group6/alerts/alerts_compatibility.ts     |   2 +-
 x-pack/test/tsconfig.json                     |   1 +
 yarn.lock                                     |   4 +
 198 files changed, 399 insertions(+), 1649 deletions(-)
 create mode 100644 packages/kbn-securitysolution-ecs/README.md
 create mode 100644 packages/kbn-securitysolution-ecs/index.ts
 create mode 100644 packages/kbn-securitysolution-ecs/jest.config.js
 create mode 100644 packages/kbn-securitysolution-ecs/kibana.jsonc
 create mode 100644 packages/kbn-securitysolution-ecs/package.json
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/agent/index.ts (55%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/auditd/index.ts (78%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/cloud/index.ts (68%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/destination/index.ts (65%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/dll/index.ts (65%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/dns/index.ts (65%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/ecs_fields/extend_map.test.ts (90%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/ecs_fields/extend_map.ts (70%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/ecs_fields/index.ts (93%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/endgame/index.ts (74%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/event/index.ts (85%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/file/index.ts (89%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/geo/index.ts (70%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/host/index.ts (72%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/http/index.ts (75%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/index.ts (66%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/memory_protection/index.ts (63%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/network/index.ts (64%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/process/index.ts (86%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/ransomware/index.ts (76%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/registry/index.ts (65%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/rule/index.ts (84%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/signal/index.ts (78%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/source/index.ts (65%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/suricata/index.ts (69%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/system/index.ts (75%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/target_type/index.ts (58%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/threat/index.ts (77%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/tls/index.ts (77%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/url/index.ts (60%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/user/index.ts (64%)
 rename {x-pack/plugins/timelines/common/ecs => packages/kbn-securitysolution-ecs/src}/winlog/index.ts (53%)
 rename {x-pack/plugins/security_solution/common/ecs => packages/kbn-securitysolution-ecs/src}/zeek/index.ts (90%)
 create mode 100644 packages/kbn-securitysolution-ecs/tsconfig.json
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/auditd/index.ts
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/cloud/index.ts
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/dns/index.ts
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/geo/index.ts
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/host/index.ts
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/http/index.ts
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/ransomware/index.ts
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/suricata/index.ts
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/tls/index.ts
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/url/index.ts
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/user/index.ts
 delete mode 100644 x-pack/plugins/security_solution/common/ecs/winlog/index.ts
 delete mode 100644 x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/__snapshots__/threat_match_row_renderer.test.tsx.snap
 delete mode 100644 x-pack/plugins/timelines/common/ecs/agent/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/destination/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/ecs_fields/extend_map.test.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/ecs_fields/extend_map.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/ecs_fields/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/endgame/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/event/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/file/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/network/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/process/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/registry/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/rule/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/signal/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/source/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/system/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/threat/index.ts
 delete mode 100644 x-pack/plugins/timelines/common/ecs/zeek/index.ts

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 310371a8cef8ed..174cd07a4f00a6 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -981,6 +981,7 @@ packages/kbn-rison @elastic/kibana-operations
 packages/kbn-rule-data-utils @elastic/security-detections-response @elastic/actionable-observability @elastic/response-ops
 packages/kbn-safer-lodash-set @elastic/kibana-security
 packages/kbn-securitysolution-autocomplete @elastic/security-solution-platform
+packages/kbn-securitysolution-ecs @elastic/security-threat-hunting-explore
 packages/kbn-securitysolution-es-utils @elastic/security-solution-platform
 packages/kbn-securitysolution-exception-list-components @elastic/security-solution-platform
 packages/kbn-securitysolution-hook-utils @elastic/security-solution-platform
diff --git a/package.json b/package.json
index bb399712007151..d7f814d3b4c93c 100644
--- a/package.json
+++ b/package.json
@@ -375,6 +375,7 @@
     "@kbn/rule-data-utils": "link:packages/kbn-rule-data-utils",
     "@kbn/safer-lodash-set": "link:packages/kbn-safer-lodash-set",
     "@kbn/securitysolution-autocomplete": "link:packages/kbn-securitysolution-autocomplete",
+    "@kbn/securitysolution-ecs": "link:packages/kbn-securitysolution-ecs",
     "@kbn/securitysolution-es-utils": "link:packages/kbn-securitysolution-es-utils",
     "@kbn/securitysolution-exception-list-components": "link:packages/kbn-securitysolution-exception-list-components",
     "@kbn/securitysolution-hook-utils": "link:packages/kbn-securitysolution-hook-utils",
diff --git a/packages/kbn-securitysolution-ecs/README.md b/packages/kbn-securitysolution-ecs/README.md
new file mode 100644
index 00000000000000..fa936e252d0850
--- /dev/null
+++ b/packages/kbn-securitysolution-ecs/README.md
@@ -0,0 +1,4 @@
+# @kbn/securitysolution-ecs
+
+Security Solution Ecs
+ - Ecs for the security solution
diff --git a/packages/kbn-securitysolution-ecs/index.ts b/packages/kbn-securitysolution-ecs/index.ts
new file mode 100644
index 00000000000000..de0577ee3ed833
--- /dev/null
+++ b/packages/kbn-securitysolution-ecs/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export * from './src';
diff --git a/packages/kbn-securitysolution-ecs/jest.config.js b/packages/kbn-securitysolution-ecs/jest.config.js
new file mode 100644
index 00000000000000..de4a6806000499
--- /dev/null
+++ b/packages/kbn-securitysolution-ecs/jest.config.js
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../..',
+  roots: ['<rootDir>/packages/kbn-securitysolution-ecs'],
+};
diff --git a/packages/kbn-securitysolution-ecs/kibana.jsonc b/packages/kbn-securitysolution-ecs/kibana.jsonc
new file mode 100644
index 00000000000000..f288e4b2951ce4
--- /dev/null
+++ b/packages/kbn-securitysolution-ecs/kibana.jsonc
@@ -0,0 +1,5 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/securitysolution-ecs",
+  "owner": "@elastic/security-threat-hunting-explore"
+}
diff --git a/packages/kbn-securitysolution-ecs/package.json b/packages/kbn-securitysolution-ecs/package.json
new file mode 100644
index 00000000000000..002c89dada984f
--- /dev/null
+++ b/packages/kbn-securitysolution-ecs/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/securitysolution-ecs",
+  "private": true,
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}
diff --git a/x-pack/plugins/security_solution/common/ecs/agent/index.ts b/packages/kbn-securitysolution-ecs/src/agent/index.ts
similarity index 55%
rename from x-pack/plugins/security_solution/common/ecs/agent/index.ts
rename to packages/kbn-securitysolution-ecs/src/agent/index.ts
index 7084214a9b8763..6f980694deaa21 100644
--- a/x-pack/plugins/security_solution/common/ecs/agent/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/agent/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface AgentEcs {
diff --git a/x-pack/plugins/timelines/common/ecs/auditd/index.ts b/packages/kbn-securitysolution-ecs/src/auditd/index.ts
similarity index 78%
rename from x-pack/plugins/timelines/common/ecs/auditd/index.ts
rename to packages/kbn-securitysolution-ecs/src/auditd/index.ts
index f210f8862dc444..b1abf0e9a552a9 100644
--- a/x-pack/plugins/timelines/common/ecs/auditd/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/auditd/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface AuditdEcs {
diff --git a/x-pack/plugins/timelines/common/ecs/cloud/index.ts b/packages/kbn-securitysolution-ecs/src/cloud/index.ts
similarity index 68%
rename from x-pack/plugins/timelines/common/ecs/cloud/index.ts
rename to packages/kbn-securitysolution-ecs/src/cloud/index.ts
index a169e5561c6b67..4d16c51bee1b72 100644
--- a/x-pack/plugins/timelines/common/ecs/cloud/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/cloud/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface CloudEcs {
diff --git a/x-pack/plugins/security_solution/common/ecs/destination/index.ts b/packages/kbn-securitysolution-ecs/src/destination/index.ts
similarity index 65%
rename from x-pack/plugins/security_solution/common/ecs/destination/index.ts
rename to packages/kbn-securitysolution-ecs/src/destination/index.ts
index b5133062d79355..08b2b76e600cd7 100644
--- a/x-pack/plugins/security_solution/common/ecs/destination/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/destination/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import type { GeoEcs } from '../geo';
diff --git a/x-pack/plugins/security_solution/common/ecs/dll/index.ts b/packages/kbn-securitysolution-ecs/src/dll/index.ts
similarity index 65%
rename from x-pack/plugins/security_solution/common/ecs/dll/index.ts
rename to packages/kbn-securitysolution-ecs/src/dll/index.ts
index 99fb6ae64442fd..89d3753f0ee177 100644
--- a/x-pack/plugins/security_solution/common/ecs/dll/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/dll/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import type { CodeSignature } from '../file';
diff --git a/x-pack/plugins/timelines/common/ecs/dns/index.ts b/packages/kbn-securitysolution-ecs/src/dns/index.ts
similarity index 65%
rename from x-pack/plugins/timelines/common/ecs/dns/index.ts
rename to packages/kbn-securitysolution-ecs/src/dns/index.ts
index e0f142d9cf57a8..a4b4eb9725a43d 100644
--- a/x-pack/plugins/timelines/common/ecs/dns/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/dns/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface DnsEcs {
diff --git a/x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.test.ts b/packages/kbn-securitysolution-ecs/src/ecs_fields/extend_map.test.ts
similarity index 90%
rename from x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.test.ts
rename to packages/kbn-securitysolution-ecs/src/ecs_fields/extend_map.test.ts
index e27b15f021257c..3eecf08dbd5a0e 100644
--- a/x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.test.ts
+++ b/packages/kbn-securitysolution-ecs/src/ecs_fields/extend_map.test.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { extendMap } from './extend_map';
diff --git a/x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.ts b/packages/kbn-securitysolution-ecs/src/ecs_fields/extend_map.ts
similarity index 70%
rename from x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.ts
rename to packages/kbn-securitysolution-ecs/src/ecs_fields/extend_map.ts
index 184e6b4f325665..1a7e45077209e6 100644
--- a/x-pack/plugins/security_solution/common/ecs/ecs_fields/extend_map.ts
+++ b/packages/kbn-securitysolution-ecs/src/ecs_fields/extend_map.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export const extendMap = (
diff --git a/x-pack/plugins/security_solution/common/ecs/ecs_fields/index.ts b/packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts
similarity index 93%
rename from x-pack/plugins/security_solution/common/ecs/ecs_fields/index.ts
rename to packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts
index 2d19f55619535d..982e3fffac159d 100644
--- a/x-pack/plugins/security_solution/common/ecs/ecs_fields/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import { extendMap } from './extend_map';
diff --git a/x-pack/plugins/security_solution/common/ecs/endgame/index.ts b/packages/kbn-securitysolution-ecs/src/endgame/index.ts
similarity index 74%
rename from x-pack/plugins/security_solution/common/ecs/endgame/index.ts
rename to packages/kbn-securitysolution-ecs/src/endgame/index.ts
index f82a9587c75c33..babff6525b085d 100644
--- a/x-pack/plugins/security_solution/common/ecs/endgame/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/endgame/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface EndgameEcs {
diff --git a/x-pack/plugins/security_solution/common/ecs/event/index.ts b/packages/kbn-securitysolution-ecs/src/event/index.ts
similarity index 85%
rename from x-pack/plugins/security_solution/common/ecs/event/index.ts
rename to packages/kbn-securitysolution-ecs/src/event/index.ts
index 56f7d3e84dfa0b..5f8cd0cc330e92 100644
--- a/x-pack/plugins/security_solution/common/ecs/event/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/event/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface EventEcs {
diff --git a/x-pack/plugins/security_solution/common/ecs/file/index.ts b/packages/kbn-securitysolution-ecs/src/file/index.ts
similarity index 89%
rename from x-pack/plugins/security_solution/common/ecs/file/index.ts
rename to packages/kbn-securitysolution-ecs/src/file/index.ts
index 0c9dde20011f49..607b93d21216b2 100644
--- a/x-pack/plugins/security_solution/common/ecs/file/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/file/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 interface Original {
diff --git a/x-pack/plugins/timelines/common/ecs/geo/index.ts b/packages/kbn-securitysolution-ecs/src/geo/index.ts
similarity index 70%
rename from x-pack/plugins/timelines/common/ecs/geo/index.ts
rename to packages/kbn-securitysolution-ecs/src/geo/index.ts
index b6bf0f7b8aaad8..b5e8abdfd33db7 100644
--- a/x-pack/plugins/timelines/common/ecs/geo/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/geo/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface GeoEcs {
diff --git a/x-pack/plugins/timelines/common/ecs/host/index.ts b/packages/kbn-securitysolution-ecs/src/host/index.ts
similarity index 72%
rename from x-pack/plugins/timelines/common/ecs/host/index.ts
rename to packages/kbn-securitysolution-ecs/src/host/index.ts
index 37032c91fc3124..633de4851899f8 100644
--- a/x-pack/plugins/timelines/common/ecs/host/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/host/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface HostEcs {
diff --git a/x-pack/plugins/timelines/common/ecs/http/index.ts b/packages/kbn-securitysolution-ecs/src/http/index.ts
similarity index 75%
rename from x-pack/plugins/timelines/common/ecs/http/index.ts
rename to packages/kbn-securitysolution-ecs/src/http/index.ts
index 89ce6b678181be..ce95fb563be2d0 100644
--- a/x-pack/plugins/timelines/common/ecs/http/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/http/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface HttpEcs {
diff --git a/x-pack/plugins/security_solution/common/ecs/index.ts b/packages/kbn-securitysolution-ecs/src/index.ts
similarity index 66%
rename from x-pack/plugins/security_solution/common/ecs/index.ts
rename to packages/kbn-securitysolution-ecs/src/index.ts
index f77ef70aaf96c1..8b440309db1894 100644
--- a/x-pack/plugins/security_solution/common/ecs/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/index.ts
@@ -1,80 +1,127 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import type { AgentEcs } from './agent';
+import { AgentEcs } from './agent';
 import type { AuditdEcs } from './auditd';
+import type { CloudEcs } from './cloud';
+import type { CodeSignature, FileEcs } from './file';
 import type { DestinationEcs } from './destination';
-import type { DnsEcs } from './dns';
 import type { DllEcs } from './dll';
+import type { DnsEcs } from './dns';
 import type { EndgameEcs } from './endgame';
+import { EventCategory, EventCode } from './event';
 import type { EventEcs } from './event';
-import type { FileEcs } from './file';
 import type { GeoEcs } from './geo';
-import type { HostEcs } from './host';
+import type { HostEcs, OsEcs } from './host';
+import type { HttpEcs } from './http';
+import type { MemoryProtection } from './memory_protection';
 import type { NetworkEcs } from './network';
+import type { ProcessEcs } from './process';
+import type { Ransomware } from './ransomware';
 import type { RegistryEcs } from './registry';
 import type { RuleEcs } from './rule';
 import type { SignalEcs, SignalEcsAAD } from './signal';
 import type { SourceEcs } from './source';
 import type { SuricataEcs } from './suricata';
+import type { SystemEcs } from './system';
+import type { Target } from './target_type';
+import type { ThreatEcs, ThreatIndicatorEcs } from './threat';
 import type { TlsEcs } from './tls';
-import type { ZeekEcs } from './zeek';
-import type { HttpEcs } from './http';
 import type { UrlEcs } from './url';
 import type { UserEcs } from './user';
 import type { WinlogEcs } from './winlog';
-import type { ProcessEcs } from './process';
-import type { SystemEcs } from './system';
-import type { ThreatEcs } from './threat';
-import type { Ransomware } from './ransomware';
-import type { MemoryProtection } from './memory_protection';
-import type { Target } from './target_type';
+import type { ZeekEcs } from './zeek';
+export * from './ecs_fields';
 
-export interface Ecs {
-  _id: string;
-  _index?: string;
+export { EventCategory, EventCode };
+
+export type {
+  AgentEcs,
+  AuditdEcs,
+  CloudEcs,
+  CodeSignature,
+  DestinationEcs,
+  DllEcs,
+  DnsEcs,
+  EndgameEcs,
+  EventEcs,
+  FileEcs,
+  GeoEcs,
+  HostEcs,
+  HttpEcs,
+  MemoryProtection,
+  NetworkEcs,
+  OsEcs,
+  ProcessEcs,
+  Ransomware,
+  RegistryEcs,
+  RuleEcs,
+  SignalEcs,
+  SourceEcs,
+  SuricataEcs,
+  SystemEcs,
+  Target,
+  ThreatEcs,
+  ThreatIndicatorEcs,
+  TlsEcs,
+  UrlEcs,
+  UserEcs,
+  WinlogEcs,
+  ZeekEcs,
+};
+
+// Security Solution Extension of the Elastic Common Schema
+export interface EcsSecurityExtension {
+  // Ecs Overrides
+  // overrides Ecs to support multiple values for security entities
   agent?: AgentEcs;
-  auditd?: AuditdEcs;
   destination?: DestinationEcs;
   dns?: DnsEcs;
-  endgame?: EndgameEcs;
   event?: EventEcs;
-  geo?: GeoEcs;
+  file?: FileEcs;
   host?: HostEcs;
+  http?: HttpEcs;
+  message?: string[];
   network?: NetworkEcs;
+  process?: ProcessEcs;
   registry?: RegistryEcs;
   rule?: RuleEcs;
-  kibana?: {
-    alert: SignalEcsAAD;
-  };
-  signal?: SignalEcs;
   source?: SourceEcs;
-  suricata?: SuricataEcs;
+  threat?: ThreatEcs;
   tls?: TlsEcs;
-  zeek?: ZeekEcs;
-  http?: HttpEcs;
   url?: UrlEcs;
-  timestamp?: string;
-  message?: string[];
   user?: UserEcs;
-  winlog?: WinlogEcs;
-  process?: ProcessEcs;
-  file?: FileEcs;
-  system?: SystemEcs;
-  threat?: ThreatEcs;
-  // This should be temporary
-  eql?: { parentId: string; sequenceNumber: string };
-  Ransomware?: Ransomware;
+
+  // Security Specific Ecs
+  // exists only in security solution Ecs definition
+  _id: string;
+  _index?: string;
+  auditd?: AuditdEcs;
+  endgame?: EndgameEcs;
+  geo?: GeoEcs;
+  kibana?: {
+    alert: SignalEcsAAD;
+  };
+  // I believe these parameters are all snake cased to correspond with how they are sent "over the wire" as request / response
+  // Not representative of the parsed types that are camel cased.
+  'kibana.alert.rule.parameters'?: { index: string[]; data_view_id?: string };
+  'kibana.alert.workflow_status'?: 'open' | 'acknowledged' | 'in-progress' | 'closed';
   // eslint-disable-next-line @typescript-eslint/naming-convention
   Memory_protection?: MemoryProtection;
+  Ransomware?: Ransomware;
   Target?: Target;
   dll?: DllEcs;
-  'kibana.alert.workflow_status'?: 'open' | 'acknowledged' | 'in-progress' | 'closed';
-  // I believe these parameters are all snake cased to correspond with how they are sent "over the wire" as request / response
-  // Not representative of the parsed types that are camel cased.
-  'kibana.alert.rule.parameters'?: { index: string[]; data_view_id?: string };
+  // This should be temporary
+  eql?: { parentId: string; sequenceNumber: string };
+  signal?: SignalEcs;
+  suricata?: SuricataEcs;
+  system?: SystemEcs;
+  timestamp?: string;
+  winlog?: WinlogEcs;
+  zeek?: ZeekEcs;
 }
diff --git a/x-pack/plugins/security_solution/common/ecs/memory_protection/index.ts b/packages/kbn-securitysolution-ecs/src/memory_protection/index.ts
similarity index 63%
rename from x-pack/plugins/security_solution/common/ecs/memory_protection/index.ts
rename to packages/kbn-securitysolution-ecs/src/memory_protection/index.ts
index 8115fc0dcd26e8..3649239b9fb5ed 100644
--- a/x-pack/plugins/security_solution/common/ecs/memory_protection/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/memory_protection/index.ts
@@ -1,9 +1,11 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
+
 export interface MemoryProtection {
   cross_session?: boolean;
   feature?: string;
diff --git a/x-pack/plugins/security_solution/common/ecs/network/index.ts b/packages/kbn-securitysolution-ecs/src/network/index.ts
similarity index 64%
rename from x-pack/plugins/security_solution/common/ecs/network/index.ts
rename to packages/kbn-securitysolution-ecs/src/network/index.ts
index 6cc5dacab1e53b..7d764f249a83ea 100644
--- a/x-pack/plugins/security_solution/common/ecs/network/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/network/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface NetworkEcs {
diff --git a/x-pack/plugins/security_solution/common/ecs/process/index.ts b/packages/kbn-securitysolution-ecs/src/process/index.ts
similarity index 86%
rename from x-pack/plugins/security_solution/common/ecs/process/index.ts
rename to packages/kbn-securitysolution-ecs/src/process/index.ts
index ac432c1e39d065..c6871ad48dd9e4 100644
--- a/x-pack/plugins/security_solution/common/ecs/process/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/process/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import type { CodeSignature, Ext } from '../file';
diff --git a/x-pack/plugins/timelines/common/ecs/ransomware/index.ts b/packages/kbn-securitysolution-ecs/src/ransomware/index.ts
similarity index 76%
rename from x-pack/plugins/timelines/common/ecs/ransomware/index.ts
rename to packages/kbn-securitysolution-ecs/src/ransomware/index.ts
index 1724a264f8a4ca..76998332c74591 100644
--- a/x-pack/plugins/timelines/common/ecs/ransomware/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/ransomware/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface Ransomware {
diff --git a/x-pack/plugins/security_solution/common/ecs/registry/index.ts b/packages/kbn-securitysolution-ecs/src/registry/index.ts
similarity index 65%
rename from x-pack/plugins/security_solution/common/ecs/registry/index.ts
rename to packages/kbn-securitysolution-ecs/src/registry/index.ts
index 6ca6afc10098c7..c06bf4884f22ef 100644
--- a/x-pack/plugins/security_solution/common/ecs/registry/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/registry/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface RegistryEcs {
diff --git a/x-pack/plugins/security_solution/common/ecs/rule/index.ts b/packages/kbn-securitysolution-ecs/src/rule/index.ts
similarity index 84%
rename from x-pack/plugins/security_solution/common/ecs/rule/index.ts
rename to packages/kbn-securitysolution-ecs/src/rule/index.ts
index c52a9253122dcd..4fd38a457b78f1 100644
--- a/x-pack/plugins/security_solution/common/ecs/rule/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/rule/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface RuleEcs {
diff --git a/x-pack/plugins/security_solution/common/ecs/signal/index.ts b/packages/kbn-securitysolution-ecs/src/signal/index.ts
similarity index 78%
rename from x-pack/plugins/security_solution/common/ecs/signal/index.ts
rename to packages/kbn-securitysolution-ecs/src/signal/index.ts
index be2d18c4fec3a5..e63a28ce85fb7a 100644
--- a/x-pack/plugins/security_solution/common/ecs/signal/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/signal/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import type { RuleEcs } from '../rule';
diff --git a/x-pack/plugins/security_solution/common/ecs/source/index.ts b/packages/kbn-securitysolution-ecs/src/source/index.ts
similarity index 65%
rename from x-pack/plugins/security_solution/common/ecs/source/index.ts
rename to packages/kbn-securitysolution-ecs/src/source/index.ts
index fcc2bf31aed3ca..fbdbf21ac17e71 100644
--- a/x-pack/plugins/security_solution/common/ecs/source/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/source/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import type { GeoEcs } from '../geo';
diff --git a/x-pack/plugins/timelines/common/ecs/suricata/index.ts b/packages/kbn-securitysolution-ecs/src/suricata/index.ts
similarity index 69%
rename from x-pack/plugins/timelines/common/ecs/suricata/index.ts
rename to packages/kbn-securitysolution-ecs/src/suricata/index.ts
index 5555a40188432d..8d5fca5362222b 100644
--- a/x-pack/plugins/timelines/common/ecs/suricata/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/suricata/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface SuricataEcs {
diff --git a/x-pack/plugins/security_solution/common/ecs/system/index.ts b/packages/kbn-securitysolution-ecs/src/system/index.ts
similarity index 75%
rename from x-pack/plugins/security_solution/common/ecs/system/index.ts
rename to packages/kbn-securitysolution-ecs/src/system/index.ts
index f2313c78845118..ca7072a383c819 100644
--- a/x-pack/plugins/security_solution/common/ecs/system/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/system/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface SystemEcs {
diff --git a/x-pack/plugins/security_solution/common/ecs/target_type/index.ts b/packages/kbn-securitysolution-ecs/src/target_type/index.ts
similarity index 58%
rename from x-pack/plugins/security_solution/common/ecs/target_type/index.ts
rename to packages/kbn-securitysolution-ecs/src/target_type/index.ts
index 8b8f36b2316121..faaecaa7fcd093 100644
--- a/x-pack/plugins/security_solution/common/ecs/target_type/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/target_type/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import type { ProcessEcs } from '../process';
diff --git a/x-pack/plugins/security_solution/common/ecs/threat/index.ts b/packages/kbn-securitysolution-ecs/src/threat/index.ts
similarity index 77%
rename from x-pack/plugins/security_solution/common/ecs/threat/index.ts
rename to packages/kbn-securitysolution-ecs/src/threat/index.ts
index 3ed272497ce571..85f921dda4e9d0 100644
--- a/x-pack/plugins/security_solution/common/ecs/threat/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/threat/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 import type { EventEcs } from '../event';
@@ -31,9 +32,14 @@ export interface ThreatIndicatorEcs {
   type?: string[];
 }
 
+export interface ThreatFeedEcs {
+  name?: string[];
+}
+
 export interface ThreatEnrichmentEcs {
   indicator?: ThreatIndicatorEcs;
   matched?: ThreatMatchEcs;
+  feed?: ThreatFeedEcs;
 }
 
 export interface ThreatEcs {
diff --git a/x-pack/plugins/timelines/common/ecs/tls/index.ts b/packages/kbn-securitysolution-ecs/src/tls/index.ts
similarity index 77%
rename from x-pack/plugins/timelines/common/ecs/tls/index.ts
rename to packages/kbn-securitysolution-ecs/src/tls/index.ts
index f2e6b3d36653dc..66042ea6e6b97f 100644
--- a/x-pack/plugins/timelines/common/ecs/tls/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/tls/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface TlsEcs {
diff --git a/x-pack/plugins/timelines/common/ecs/url/index.ts b/packages/kbn-securitysolution-ecs/src/url/index.ts
similarity index 60%
rename from x-pack/plugins/timelines/common/ecs/url/index.ts
rename to packages/kbn-securitysolution-ecs/src/url/index.ts
index ea9dc303108e38..438411fc7981e9 100644
--- a/x-pack/plugins/timelines/common/ecs/url/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/url/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface UrlEcs {
diff --git a/x-pack/plugins/timelines/common/ecs/user/index.ts b/packages/kbn-securitysolution-ecs/src/user/index.ts
similarity index 64%
rename from x-pack/plugins/timelines/common/ecs/user/index.ts
rename to packages/kbn-securitysolution-ecs/src/user/index.ts
index b03a8e5e96b415..0f39e46f895ce6 100644
--- a/x-pack/plugins/timelines/common/ecs/user/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/user/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface UserEcs {
diff --git a/x-pack/plugins/timelines/common/ecs/winlog/index.ts b/packages/kbn-securitysolution-ecs/src/winlog/index.ts
similarity index 53%
rename from x-pack/plugins/timelines/common/ecs/winlog/index.ts
rename to packages/kbn-securitysolution-ecs/src/winlog/index.ts
index 27757d05ba6ecd..c368c254741eed 100644
--- a/x-pack/plugins/timelines/common/ecs/winlog/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/winlog/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface WinlogEcs {
diff --git a/x-pack/plugins/security_solution/common/ecs/zeek/index.ts b/packages/kbn-securitysolution-ecs/src/zeek/index.ts
similarity index 90%
rename from x-pack/plugins/security_solution/common/ecs/zeek/index.ts
rename to packages/kbn-securitysolution-ecs/src/zeek/index.ts
index b1a3786ae74aa6..0f40bc0f493cbe 100644
--- a/x-pack/plugins/security_solution/common/ecs/zeek/index.ts
+++ b/packages/kbn-securitysolution-ecs/src/zeek/index.ts
@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 export interface ZeekEcs {
diff --git a/packages/kbn-securitysolution-ecs/tsconfig.json b/packages/kbn-securitysolution-ecs/tsconfig.json
new file mode 100644
index 00000000000000..dcb1ea0d03d93f
--- /dev/null
+++ b/packages/kbn-securitysolution-ecs/tsconfig.json
@@ -0,0 +1,16 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "**/*.ts"
+  ],
+  "exclude": [
+    "target/**/*"
+  ]
+}
diff --git a/tsconfig.base.json b/tsconfig.base.json
index a53ee3a4f73edc..58b859be7395f5 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -990,6 +990,8 @@
       "@kbn/security-test-endpoints-plugin/*": ["x-pack/test/security_functional/plugins/test_endpoints/*"],
       "@kbn/securitysolution-autocomplete": ["packages/kbn-securitysolution-autocomplete"],
       "@kbn/securitysolution-autocomplete/*": ["packages/kbn-securitysolution-autocomplete/*"],
+      "@kbn/securitysolution-ecs": ["packages/kbn-securitysolution-ecs"],
+      "@kbn/securitysolution-ecs/*": ["packages/kbn-securitysolution-ecs/*"],
       "@kbn/securitysolution-es-utils": ["packages/kbn-securitysolution-es-utils"],
       "@kbn/securitysolution-es-utils/*": ["packages/kbn-securitysolution-es-utils/*"],
       "@kbn/securitysolution-exception-list-components": ["packages/kbn-securitysolution-exception-list-components"],
diff --git a/x-pack/plugins/observability/public/pages/alerts/components/observability_actions.tsx b/x-pack/plugins/observability/public/pages/alerts/components/observability_actions.tsx
index eeb9469e400363..cbdf7dde8c2e8d 100644
--- a/x-pack/plugins/observability/public/pages/alerts/components/observability_actions.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/components/observability_actions.tsx
@@ -18,7 +18,7 @@ import React, { useMemo, useState, useCallback } from 'react';
 
 import { CaseAttachmentsWithoutOwner } from '@kbn/cases-plugin/public';
 import { CommentType } from '@kbn/cases-plugin/common';
-import { Ecs } from '@kbn/timelines-plugin/common/ecs';
+import { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { TimelineNonEcsData } from '@kbn/timelines-plugin/common';
 import { isAlertDetailsEnabledPerApp } from '../../../utils/is_alert_details_enabled';
 import { useKibana } from '../../../utils/kibana_react';
diff --git a/x-pack/plugins/observability/tsconfig.json b/x-pack/plugins/observability/tsconfig.json
index 9a2dc1ab3016cc..0460c75bf10117 100644
--- a/x-pack/plugins/observability/tsconfig.json
+++ b/x-pack/plugins/observability/tsconfig.json
@@ -69,6 +69,7 @@
     "@kbn/slo-schema",
     "@kbn/guided-onboarding",
     "@kbn/charts-plugin",
+    "@kbn/securitysolution-ecs",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/security_solution/common/ecs/auditd/index.ts b/x-pack/plugins/security_solution/common/ecs/auditd/index.ts
deleted file mode 100644
index f210f8862dc444..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/auditd/index.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface AuditdEcs {
-  result?: string[];
-
-  session?: string[];
-
-  data?: AuditdDataEcs;
-
-  summary?: SummaryEcs;
-
-  sequence?: string[];
-}
-
-export interface AuditdDataEcs {
-  acct?: string[];
-
-  terminal?: string[];
-
-  op?: string[];
-}
-
-export interface SummaryEcs {
-  actor?: PrimarySecondaryEcs;
-
-  object?: PrimarySecondaryEcs;
-
-  how?: string[];
-
-  message_type?: string[];
-
-  sequence?: string[];
-}
-
-export interface PrimarySecondaryEcs {
-  primary?: string[];
-
-  secondary?: string[];
-
-  type?: string[];
-}
diff --git a/x-pack/plugins/security_solution/common/ecs/cloud/index.ts b/x-pack/plugins/security_solution/common/ecs/cloud/index.ts
deleted file mode 100644
index a169e5561c6b67..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/cloud/index.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface CloudEcs {
-  instance?: CloudInstanceEcs;
-  machine?: CloudMachineEcs;
-  provider?: string[];
-  region?: string[];
-}
-
-export interface CloudMachineEcs {
-  type?: string[];
-}
-
-export interface CloudInstanceEcs {
-  id?: string[];
-}
diff --git a/x-pack/plugins/security_solution/common/ecs/dns/index.ts b/x-pack/plugins/security_solution/common/ecs/dns/index.ts
deleted file mode 100644
index e0f142d9cf57a8..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/dns/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface DnsEcs {
-  question?: DnsQuestionEcs;
-
-  resolved_ip?: string[];
-
-  response_code?: string[];
-}
-
-export interface DnsQuestionEcs {
-  name?: string[];
-
-  type?: string[];
-}
diff --git a/x-pack/plugins/security_solution/common/ecs/geo/index.ts b/x-pack/plugins/security_solution/common/ecs/geo/index.ts
deleted file mode 100644
index b6bf0f7b8aaad8..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/geo/index.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface GeoEcs {
-  city_name?: string[];
-  continent_name?: string[];
-  country_iso_code?: string[];
-  country_name?: string[];
-  location?: Location;
-  region_iso_code?: string[];
-  region_name?: string[];
-}
-
-export interface Location {
-  lon?: number[];
-  lat?: number[];
-}
diff --git a/x-pack/plugins/security_solution/common/ecs/host/index.ts b/x-pack/plugins/security_solution/common/ecs/host/index.ts
deleted file mode 100644
index 37032c91fc3124..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/host/index.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface HostEcs {
-  architecture?: string[];
-
-  id?: string[];
-
-  ip?: string[];
-
-  mac?: string[];
-
-  name?: string[];
-
-  os?: OsEcs;
-
-  type?: string[];
-}
-
-export interface OsEcs {
-  platform?: string[];
-
-  name?: string[];
-
-  full?: string[];
-
-  family?: string[];
-
-  version?: string[];
-
-  kernel?: string[];
-}
diff --git a/x-pack/plugins/security_solution/common/ecs/http/index.ts b/x-pack/plugins/security_solution/common/ecs/http/index.ts
deleted file mode 100644
index 89ce6b678181be..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/http/index.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface HttpEcs {
-  version?: string[];
-
-  request?: HttpRequestData;
-
-  response?: HttpResponseData;
-}
-
-export interface HttpRequestData {
-  method?: string[];
-
-  body?: HttpBodyData;
-
-  referrer?: string[];
-
-  bytes?: number[];
-}
-
-export interface HttpBodyData {
-  content?: string[];
-
-  bytes?: number[];
-}
-
-export interface HttpResponseData {
-  status_code?: number[];
-
-  body?: HttpBodyData;
-
-  bytes?: number[];
-}
diff --git a/x-pack/plugins/security_solution/common/ecs/ransomware/index.ts b/x-pack/plugins/security_solution/common/ecs/ransomware/index.ts
deleted file mode 100644
index 1724a264f8a4ca..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/ransomware/index.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface Ransomware {
-  feature?: string[];
-  score?: string[];
-  version?: number[];
-  child_pids?: string[];
-  files?: RansomwareFiles;
-}
-
-export interface RansomwareFiles {
-  operation?: string[];
-  entropy?: number[];
-  metrics?: string[];
-  extension?: string[];
-  original?: OriginalRansomwareFiles;
-  path?: string[];
-  data?: string[];
-  score?: number[];
-}
-
-export interface OriginalRansomwareFiles {
-  path?: string[];
-  extension?: string[];
-}
diff --git a/x-pack/plugins/security_solution/common/ecs/suricata/index.ts b/x-pack/plugins/security_solution/common/ecs/suricata/index.ts
deleted file mode 100644
index 5555a40188432d..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/suricata/index.ts
+++ /dev/null
@@ -1,24 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface SuricataEcs {
-  eve?: SuricataEveData;
-}
-
-export interface SuricataEveData {
-  alert?: SuricataAlertData;
-
-  flow_id?: number[];
-
-  proto?: string[];
-}
-
-export interface SuricataAlertData {
-  signature?: string[];
-
-  signature_id?: number[];
-}
diff --git a/x-pack/plugins/security_solution/common/ecs/tls/index.ts b/x-pack/plugins/security_solution/common/ecs/tls/index.ts
deleted file mode 100644
index f2e6b3d36653dc..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/tls/index.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface TlsEcs {
-  client_certificate?: TlsClientCertificateData;
-
-  fingerprints?: TlsFingerprintsData;
-
-  server_certificate?: TlsServerCertificateData;
-}
-
-export interface TlsClientCertificateData {
-  fingerprint?: FingerprintData;
-}
-
-export interface FingerprintData {
-  sha1?: string[];
-}
-
-export interface TlsFingerprintsData {
-  ja3?: TlsJa3Data;
-}
-
-export interface TlsJa3Data {
-  hash?: string[];
-}
-
-export interface TlsServerCertificateData {
-  fingerprint?: FingerprintData;
-}
diff --git a/x-pack/plugins/security_solution/common/ecs/url/index.ts b/x-pack/plugins/security_solution/common/ecs/url/index.ts
deleted file mode 100644
index ea9dc303108e38..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/url/index.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface UrlEcs {
-  domain?: string[];
-
-  original?: string[];
-
-  username?: string[];
-
-  password?: string[];
-}
diff --git a/x-pack/plugins/security_solution/common/ecs/user/index.ts b/x-pack/plugins/security_solution/common/ecs/user/index.ts
deleted file mode 100644
index b03a8e5e96b415..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/user/index.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface UserEcs {
-  domain?: string[];
-
-  id?: string[];
-
-  name?: string[];
-
-  full_name?: string[];
-
-  email?: string[];
-
-  hash?: string[];
-
-  group?: string[];
-}
diff --git a/x-pack/plugins/security_solution/common/ecs/winlog/index.ts b/x-pack/plugins/security_solution/common/ecs/winlog/index.ts
deleted file mode 100644
index 27757d05ba6ecd..00000000000000
--- a/x-pack/plugins/security_solution/common/ecs/winlog/index.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface WinlogEcs {
-  event_id?: number[];
-}
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts
index 15e2d99772af86..7f708ab3f6111b 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/common/index.ts
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-import type { CloudEcs } from '../../../../ecs/cloud';
-import type { HostEcs, OsEcs } from '../../../../ecs/host';
+import type { CloudEcs, HostEcs, OsEcs } from '@kbn/securitysolution-ecs';
 import type { Hit, Hits, Maybe, SearchHit, StringOrNumber, TotalValue } from '../../../common';
 import type { EndpointPendingActions, HostStatus } from '../../../../endpoint/types';
 import type { CommonFields } from '../..';
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/uncommon_processes/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/uncommon_processes/index.ts
index 2153426e507a48..584cf223eb38b3 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/uncommon_processes/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/hosts/uncommon_processes/index.ts
@@ -7,9 +7,7 @@
 
 import type { IEsSearchResponse } from '@kbn/data-plugin/common';
 
-import type { HostEcs } from '../../../../ecs/host';
-import type { UserEcs } from '../../../../ecs/user';
-import type { ProcessEcs } from '../../../../ecs/process';
+import type { HostEcs, ProcessEcs, UserEcs } from '@kbn/securitysolution-ecs';
 import type {
   RequestOptionsPaginated,
   SortField,
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/common/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/common/index.ts
index 042164f6311c91..fb9f08bc990f05 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/common/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/common/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { GeoEcs } from '../../../../ecs/geo';
+import type { GeoEcs } from '@kbn/securitysolution-ecs';
 import type { Maybe } from '../../..';
 
 export enum NetworkDirectionEcs {
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/details/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/details/index.ts
index 3e8fd20217656a..da3b7cf9cbac3d 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/details/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/network/details/index.ts
@@ -6,8 +6,7 @@
  */
 
 import type { IEsSearchResponse } from '@kbn/data-plugin/common';
-import type { HostEcs } from '../../../../ecs/host';
-import type { GeoEcs } from '../../../../ecs/geo';
+import type { HostEcs, GeoEcs } from '@kbn/securitysolution-ecs';
 import type { Inspect, Maybe, TotalValue, Hit, ShardsResponse } from '../../../common';
 import type { RequestBasicOptions } from '../..';
 
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/users/authentications/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/users/authentications/index.ts
index e409898e779266..92d54ca56ba646 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/users/authentications/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/users/authentications/index.ts
@@ -7,9 +7,7 @@
 
 import type { IEsSearchResponse } from '@kbn/data-plugin/common';
 
-import type { UserEcs } from '../../../../ecs/user';
-import type { SourceEcs } from '../../../../ecs/source';
-import type { HostEcs } from '../../../../ecs/host';
+import type { UserEcs, SourceEcs, HostEcs } from '@kbn/securitysolution-ecs';
 import type {
   CursorType,
   Inspect,
diff --git a/x-pack/plugins/security_solution/common/search_strategy/security_solution/users/common/index.ts b/x-pack/plugins/security_solution/common/search_strategy/security_solution/users/common/index.ts
index 81ef6daf184a8b..c281ae45cf55f3 100644
--- a/x-pack/plugins/security_solution/common/search_strategy/security_solution/users/common/index.ts
+++ b/x-pack/plugins/security_solution/common/search_strategy/security_solution/users/common/index.ts
@@ -5,9 +5,8 @@
  * 2.0.
  */
 
+import type { HostEcs, UserEcs } from '@kbn/securitysolution-ecs';
 import type { CommonFields, Maybe, RiskScoreFields, RiskSeverity, SortField } from '../../..';
-import type { HostEcs } from '../../../../ecs/host';
-import type { UserEcs } from '../../../../ecs/user';
 
 export interface UserRiskScoreItem {
   _id?: Maybe<string>;
diff --git a/x-pack/plugins/security_solution/common/types/header_actions/index.ts b/x-pack/plugins/security_solution/common/types/header_actions/index.ts
index 8cad7688c723bb..6c533736bf150e 100644
--- a/x-pack/plugins/security_solution/common/types/header_actions/index.ts
+++ b/x-pack/plugins/security_solution/common/types/header_actions/index.ts
@@ -14,8 +14,8 @@ import type {
 import type { IFieldSubType } from '@kbn/es-query';
 import type { FieldBrowserOptions } from '@kbn/triggers-actions-ui-plugin/public';
 import type { ComponentType, JSXElementConstructor, ReactNode } from 'react';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { OnRowSelected, SetEventsDeleted, SetEventsLoading } from '..';
-import type { Ecs } from '../../ecs';
 import type { BrowserFields, TimelineNonEcsData } from '../../search_strategy';
 import type { SortColumnTable } from '../data_table';
 
diff --git a/x-pack/plugins/security_solution/common/types/timeline/cells/index.ts b/x-pack/plugins/security_solution/common/types/timeline/cells/index.ts
index 903c555aa96d09..f5ca9b28628e13 100644
--- a/x-pack/plugins/security_solution/common/types/timeline/cells/index.ts
+++ b/x-pack/plugins/security_solution/common/types/timeline/cells/index.ts
@@ -7,8 +7,8 @@
 
 import type { EuiDataGridCellValueElementProps } from '@elastic/eui';
 import type { Filter } from '@kbn/es-query';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { ColumnHeaderOptions, RowRenderer } from '../..';
-import type { Ecs } from '../../../ecs';
 import type { BrowserFields, TimelineNonEcsData } from '../../../search_strategy';
 
 /** The following props are provided to the function called by `renderCellValue` */
diff --git a/x-pack/plugins/security_solution/public/common/components/data_table/helpers.tsx b/x-pack/plugins/security_solution/public/common/components/data_table/helpers.tsx
index d9d3345b943931..a31c40d45dace9 100644
--- a/x-pack/plugins/security_solution/public/common/components/data_table/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/data_table/helpers.tsx
@@ -9,8 +9,8 @@ import { isEmpty } from 'lodash/fp';
 
 import type { EuiDataGridCellValueElementProps } from '@elastic/eui';
 import type { EuiTheme } from '@kbn/kibana-react-plugin/common';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { SortColumnTable } from '../../../../common/types';
-import type { Ecs } from '../../../../common/ecs';
 import type { TimelineItem, TimelineNonEcsData } from '../../../../common/search_strategy';
 import type { ColumnHeaderOptions, SortDirection } from '../../../../common/types/timeline';
 
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
index bd3c150272b3e3..571b6015eb374e 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
@@ -20,6 +20,7 @@ import React, { useCallback, useMemo, useState } from 'react';
 import styled from 'styled-components';
 import { isEmpty } from 'lodash';
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { SearchHit } from '../../../../common/search_strategy';
 import { getMitreComponentParts } from '../../../detections/mitre/get_mitre_threat_component';
 import { GuidedOnboardingTourStep } from '../guided_onboarding_tour/tour_step';
@@ -37,7 +38,6 @@ import { ThreatSummaryView } from './cti_details/threat_summary_view';
 import { ThreatDetailsView } from './cti_details/threat_details_view';
 import * as i18n from './translations';
 import { AlertSummaryView } from './alert_summary_view';
-import type { Ecs } from '../../../../common/ecs';
 import type { BrowserFields } from '../../containers/source';
 import { useInvestigationTimeEnrichment } from '../../containers/cti/event_enrichment';
 import type { TimelineEventsDetailsItem } from '../../../../common/search_strategy/timeline';
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/get_alert_summary_rows.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/get_alert_summary_rows.tsx
index 96bc3e030f7a20..96f2fcac7a541c 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/get_alert_summary_rows.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/get_alert_summary_rows.tsx
@@ -8,6 +8,7 @@
 import { find, isEmpty, uniqBy } from 'lodash/fp';
 import { ALERT_RULE_PARAMETERS, ALERT_RULE_TYPE } from '@kbn/rule-data-utils';
 
+import { EventCode, EventCategory } from '@kbn/securitysolution-ecs';
 import * as i18n from './translations';
 import type { BrowserFields } from '../../../../common/search_strategy/index_fields';
 import {
@@ -30,7 +31,6 @@ import type { EventSummaryField, EnrichedFieldInfo } from './types';
 import type { TimelineEventsDetailsItem } from '../../../../common/search_strategy/timeline';
 
 import { isAlertFromEndpointEvent } from '../../utils/endpoint_alert_check';
-import { EventCode, EventCategory } from '../../../../common/ecs/event';
 
 const THRESHOLD_TERMS_FIELD = `${ALERT_THRESHOLD_RESULT}.terms.field`;
 const THRESHOLD_TERMS_VALUE = `${ALERT_THRESHOLD_RESULT}.terms.value`;
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/osquery_tab.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/osquery_tab.tsx
index b8c26c4884b47f..46656b20cf9b82 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/osquery_tab.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/osquery_tab.tsx
@@ -9,7 +9,7 @@ import { EuiCode, EuiEmptyPrompt, EuiNotificationBadge, EuiSpacer } from '@elast
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
 import { FormattedMessage } from '@kbn/i18n-react';
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { PERMISSION_DENIED } from '../../../detection_engine/rule_response_actions/osquery/translations';
 import { expandDottedObject } from '../../../../common/utils/expand_dotted';
 import { useIsExperimentalFeatureEnabled } from '../../hooks/use_experimental_features';
diff --git a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/osquery/renderer.tsx b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/osquery/renderer.tsx
index f33dec63a6b18b..20bdb4d7a9e56e 100644
--- a/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/osquery/renderer.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/markdown_editor/plugins/osquery/renderer.tsx
@@ -11,9 +11,9 @@ import { reduce } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import styled from 'styled-components';
 import { EuiButton } from '@elastic/eui';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { BasicAlertDataContext } from '../../../event_details/investigation_guide_view';
 import { expandDottedObject } from '../../../../../../common/utils/expand_dotted';
-import type { Ecs } from '../../../../../../common/ecs';
 import OsqueryLogo from './osquery_icon/osquery.svg';
 import { OsqueryFlyout } from '../../../../../detections/components/osquery/osquery_flyout';
 
diff --git a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/creation.ts b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/creation.ts
index 781718652246d4..951d98d14e5628 100644
--- a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/creation.ts
+++ b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/creation.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const demoEndgameCreationEvent: Ecs = {
   _id: 'BcjPcG0BOpWiDweSou3g',
diff --git a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/dns.ts b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/dns.ts
index bd5061dd3bd6a6..1744bd09afa370 100644
--- a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/dns.ts
+++ b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/dns.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const demoEndgameDnsRequest: Ecs = {
   _id: 'S8jPcG0BOpWiDweSou3g',
diff --git a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/file_events.ts b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/file_events.ts
index 696d51b2e11fac..8dc408aa08a216 100644
--- a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/file_events.ts
+++ b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/file_events.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const demoEndgameFileCreateEvent: Ecs = {
   _id: '98jPcG0BOpWiDweSouzg',
diff --git a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/ipv4.ts b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/ipv4.ts
index c7d9655acb956e..f41104f2970dda 100644
--- a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/ipv4.ts
+++ b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/ipv4.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const demoEndgameIpv4ConnectionAcceptEvent: Ecs = {
   _id: 'LsjPcG0BOpWiDweSCNfu',
diff --git a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/termination.ts b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/termination.ts
index adab55d27c697b..2689fe4cc0448f 100644
--- a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/termination.ts
+++ b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/termination.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const demoEndgameTerminationEvent: Ecs = {
   _id: '2MjPcG0BOpWiDweSoutC',
diff --git a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/user_logon.ts b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/user_logon.ts
index ebc3cdcf1afe68..53f2aabf2d3c28 100644
--- a/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/user_logon.ts
+++ b/x-pack/plugins/security_solution/public/common/demo_data/endgame_ecs/user_logon.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const demoEndgameUserLogon: Ecs = {
   _id: 'QsjPcG0BOpWiDweSeuRE',
diff --git a/x-pack/plugins/security_solution/public/common/demo_data/endpoint/library_load_event.ts b/x-pack/plugins/security_solution/public/common/demo_data/endpoint/library_load_event.ts
index 039115624ab910..a7cd3ec96d22f1 100644
--- a/x-pack/plugins/security_solution/public/common/demo_data/endpoint/library_load_event.ts
+++ b/x-pack/plugins/security_solution/public/common/demo_data/endpoint/library_load_event.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const demoEndpointLibraryLoadEvent: Ecs = {
   file: {
diff --git a/x-pack/plugins/security_solution/public/common/demo_data/endpoint/process_execution_malware_prevention_alert.ts b/x-pack/plugins/security_solution/public/common/demo_data/endpoint/process_execution_malware_prevention_alert.ts
index 1a3657e8672614..252d3a8e76568a 100644
--- a/x-pack/plugins/security_solution/public/common/demo_data/endpoint/process_execution_malware_prevention_alert.ts
+++ b/x-pack/plugins/security_solution/public/common/demo_data/endpoint/process_execution_malware_prevention_alert.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const demoEndpointProcessExecutionMalwarePreventionAlert: Ecs = {
   process: {
diff --git a/x-pack/plugins/security_solution/public/common/demo_data/endpoint/registry_modification_event.ts b/x-pack/plugins/security_solution/public/common/demo_data/endpoint/registry_modification_event.ts
index 2f34360b464438..991df10dd77b03 100644
--- a/x-pack/plugins/security_solution/public/common/demo_data/endpoint/registry_modification_event.ts
+++ b/x-pack/plugins/security_solution/public/common/demo_data/endpoint/registry_modification_event.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const demoEndpointRegistryModificationEvent: Ecs = {
   host: {
diff --git a/x-pack/plugins/security_solution/public/common/demo_data/netflow.ts b/x-pack/plugins/security_solution/public/common/demo_data/netflow.ts
index 51f281a4b056b4..93c9e93de0af62 100644
--- a/x-pack/plugins/security_solution/public/common/demo_data/netflow.ts
+++ b/x-pack/plugins/security_solution/public/common/demo_data/netflow.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { ONE_MILLISECOND_AS_NANOSECONDS } from '../../timelines/components/formatted_duration/helpers';
-import type { Ecs } from '../../../common/ecs';
 
 /** Returns mock data for testing the Netflow component */
 export const getDemoNetflowData = (): Ecs => ({
diff --git a/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.test.tsx b/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.test.tsx
index 6a17fe6df79b69..58d4ed6f3aeb43 100644
--- a/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/lib/cell_actions/default_cell_actions.test.tsx
@@ -11,7 +11,7 @@ import type {
   BrowserFields,
   TimelineNonEcsData,
 } from '@kbn/timelines-plugin/common/search_strategy';
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { defaultCellActions } from './default_cell_actions';
 import { COLUMNS_WITH_LINKS, EmptyComponent } from './helpers';
 
diff --git a/x-pack/plugins/security_solution/public/common/lib/cell_actions/field_value.tsx b/x-pack/plugins/security_solution/public/common/lib/cell_actions/field_value.tsx
index 0e3b64db156ece..8416f8e81ba52d 100644
--- a/x-pack/plugins/security_solution/public/common/lib/cell_actions/field_value.tsx
+++ b/x-pack/plugins/security_solution/public/common/lib/cell_actions/field_value.tsx
@@ -9,9 +9,9 @@ import type { EuiDataGridColumnCellActionProps } from '@elastic/eui';
 import { head, getOr, get, isEmpty } from 'lodash/fp';
 import React, { useMemo } from 'react';
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { ColumnHeaderOptions } from '../../../../common/types';
 import type { TimelineNonEcsData } from '../../../../common/search_strategy';
-import type { Ecs } from '../../../../common/ecs';
 import { useGetMappedNonEcsValue } from '../../../timelines/components/timeline/body/data_driven_columns';
 import { FormattedFieldValue } from '../../../timelines/components/timeline/body/renderers/formatted_field';
 import { parseValue } from '../../../timelines/components/timeline/body/renderers/parse_value';
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts.ts b/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts.ts
index b39d301c39a418..7f52db599135ad 100644
--- a/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const getDetectionAlertMock = (overrides: Partial<Ecs> = {}): Ecs => ({
   ...{
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts_aad.ts b/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts_aad.ts
index 0fddaae8026ab1..920540320c425c 100644
--- a/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts_aad.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_detection_alerts_aad.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const mockAADEcsDataWithAlert: Ecs = {
   _id: '1',
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_endgame_ecs_data.ts b/x-pack/plugins/security_solution/public/common/mock/mock_endgame_ecs_data.ts
index b7a9e0cd4593a8..305450c9b19ed6 100644
--- a/x-pack/plugins/security_solution/public/common/mock/mock_endgame_ecs_data.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_endgame_ecs_data.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 // these "mocks" are used by browser bundles so they were moved out of the mocks and are
 // re-exported here for convenience and internal bwc
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_timeline_data.ts b/x-pack/plugins/security_solution/public/common/mock/mock_timeline_data.ts
index 3ba5aab6a6dd87..6632a97b39a098 100644
--- a/x-pack/plugins/security_solution/public/common/mock/mock_timeline_data.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_timeline_data.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export { demoTimelineData as mockTimelineData } from '../demo_data/timeline';
 export { demoEndpointRegistryModificationEvent as mockEndpointRegistryModificationEvent } from '../demo_data/endpoint/registry_modification_event';
diff --git a/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.test.ts b/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.test.ts
index c6e29cca6a24c1..d62347f6790b3e 100644
--- a/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.test.ts
+++ b/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.test.ts
@@ -6,7 +6,7 @@
  */
 
 import _ from 'lodash';
-import type { Ecs } from '../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { generateMockDetailItemData } from '../mock';
 import { isAlertFromEndpointAlert, isAlertFromEndpointEvent } from './endpoint_alert_check';
 
diff --git a/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.ts b/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.ts
index 9c54d6dc8ff19a..b755094b679d36 100644
--- a/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.ts
+++ b/x-pack/plugins/security_solution/public/common/utils/endpoint_alert_check.ts
@@ -7,7 +7,7 @@
 
 import { find, getOr, some } from 'lodash/fp';
 import type { TimelineEventsDetailsItem } from '@kbn/timelines-plugin/common';
-import type { Ecs } from '../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 /**
  * Check to see if a timeline event item is an Alert (vs an event)
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.test.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.test.tsx
index a9a43ef2e47aa9..d3875415c49c72 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.test.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.test.tsx
@@ -39,7 +39,7 @@ import { getEntryMatchMock } from '@kbn/lists-plugin/common/schemas/types/entry_
 import { getCommentsArrayMock } from '@kbn/lists-plugin/common/schemas/types/comment.mock';
 import { fields } from '@kbn/data-plugin/common/mocks';
 import { ENTRIES, OLD_DATE_RELATIVE_TO_DATE_NOW } from '@kbn/lists-plugin/common/constants.mock';
-import type { CodeSignature } from '../../../../common/ecs/file';
+import type { CodeSignature } from '@kbn/securitysolution-ecs';
 import {
   ALERT_ORIGINAL_EVENT_KIND,
   ALERT_ORIGINAL_EVENT_MODULE,
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.tsx
index b1ee787ef60cdd..6547785e29cc9e 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/helpers.tsx
@@ -34,11 +34,10 @@ import { getNewExceptionItem, addIdToEntries } from '@kbn/securitysolution-list-
 import type { DataViewBase } from '@kbn/es-query';
 import { removeIdFromExceptionItemsEntries } from '@kbn/securitysolution-list-hooks';
 
+import type { EcsSecurityExtension as Ecs, CodeSignature } from '@kbn/securitysolution-ecs';
 import * as i18n from './translations';
 import type { AlertData, Flattened } from './types';
 
-import type { Ecs } from '../../../../common/ecs';
-import type { CodeSignature } from '../../../../common/ecs/file';
 import { WithCopyToClipboard } from '../../../common/lib/clipboard/with_copy_to_clipboard';
 import exceptionableLinuxFields from './exceptionable_linux_fields.json';
 import exceptionableWindowsMacFields from './exceptionable_windows_mac_fields.json';
diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/types.ts b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/types.ts
index 56db2ad8257f84..4e87e89b2964c3 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/types.ts
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/types.ts
@@ -6,8 +6,7 @@
  */
 
 import type { NamespaceType } from '@kbn/securitysolution-io-ts-list-types';
-import type { Ecs } from '../../../../common/ecs';
-import type { CodeSignature } from '../../../../common/ecs/file';
+import type { EcsSecurityExtension as Ecs, CodeSignature } from '@kbn/securitysolution-ecs';
 
 export interface ExceptionListItemIdentifiers {
   id: string;
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
index 47d2426cb17fff..bd58da0521c2c5 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.test.tsx
@@ -31,7 +31,7 @@ import {
   mockTimelineData,
 } from '../../../common/mock';
 import type { CreateTimeline, UpdateTimelineLoading } from './types';
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { DataProvider } from '../../../../common/types/timeline';
 import {
   TimelineId,
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
index 74e9b92fd4956f..98a2903053f88f 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/actions.tsx
@@ -30,6 +30,7 @@ import {
 } from '@kbn/rule-data-utils';
 
 import { lastValueFrom } from 'rxjs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { DataTableModel } from '../../../common/store/data_table/types';
 import {
   ALERT_ORIGINAL_TIME,
@@ -50,7 +51,6 @@ import type {
   GetExceptionFilter,
   CreateTimeline,
 } from './types';
-import type { Ecs } from '../../../../common/ecs';
 import type {
   TimelineEventsDetailsItem,
   TimelineEventsDetailsRequestOptions,
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.test.tsx
index 4efa02f1e6639e..3b6eac21ba05bc 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.test.tsx
@@ -10,7 +10,7 @@ import { AlertContextMenu } from './alert_context_menu';
 import { TableId, TimelineId } from '../../../../../common/types';
 import { TestProviders } from '../../../../common/mock';
 import React from 'react';
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { mockTimelines } from '../../../../common/mock/mock_timelines_plugin';
 import { mockCasesContract } from '@kbn/cases-plugin/public/mocks';
 import { initialUserPrivilegesState as mockInitialUserPrivilegesState } from '../../../../common/components/user_privileges/user_privileges_context';
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
index 2aec4bb0e97e69..c74f7fad2f30a5 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
@@ -13,6 +13,7 @@ import type { ConnectedProps } from 'react-redux';
 import { connect } from 'react-redux';
 import { ExceptionListTypeEnum } from '@kbn/securitysolution-io-ts-list-types';
 import { get } from 'lodash/fp';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { DEFAULT_ACTION_BUTTON_WIDTH } from '../../../../common/components/header_actions';
 import { isActiveTimeline } from '../../../../helpers';
 import { useOsqueryContextActionItem } from '../../osquery/use_osquery_context_action_item';
@@ -21,7 +22,6 @@ import { useRouteSpy } from '../../../../common/utils/route/use_route_spy';
 import { buildGetAlertByIdQuery } from '../../../../detection_engine/rule_exceptions/utils/helpers';
 import { useUserPrivileges } from '../../../../common/components/user_privileges';
 import { EventsTdContent } from '../../../../timelines/components/timeline/styles';
-import type { Ecs } from '../../../../../common/ecs';
 import type { AddExceptionFlyoutProps } from '../../../../detection_engine/rule_exceptions/components/add_exception_flyout';
 import { AddExceptionFlyout } from '../../../../detection_engine/rule_exceptions/components/add_exception_flyout';
 import * as i18n from '../translations';
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.test.tsx
index 365831133e2a89..4695e19d77126d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.test.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { isInvestigateInResolverActionEnabled } from './investigate_in_resolver';
 
 describe('InvestigateInResolverAction', () => {
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx
index ff737ef39b6f4f..365aac96c8f482 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_resolver.tsx
@@ -6,7 +6,7 @@
  */
 
 import { get } from 'lodash/fp';
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 export const isInvestigateInResolverActionEnabled = (ecsData?: Ecs) =>
   (get(['agent', 'type', 0], ecsData) === 'endpoint' ||
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.test.tsx
index f4b581060e1ef7..7173670f80a68e 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.test.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { fireEvent, render, act } from '@testing-library/react';
 import { TestProviders } from '../../../../common/mock';
 import { KibanaServices, useKibana } from '../../../../common/lib/kibana';
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import * as actions from '../actions';
 import { coreMock } from '@kbn/core/public/mocks';
 import { InvestigateInTimelineAction } from './investigate_in_timeline_action';
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
index 2386662074f286..db7a284f569ebf 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/investigate_in_timeline_action.tsx
@@ -6,10 +6,9 @@
  */
 
 import React from 'react';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { ActionIconItem } from '../../../../common/components/header_actions/action_icon_item';
 
-import type { Ecs } from '../../../../../common/ecs';
-
 import {
   ACTION_INVESTIGATE_IN_TIMELINE,
   ACTION_INVESTIGATE_IN_TIMELINE_ARIA_LABEL,
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_to_case_actions.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_to_case_actions.tsx
index fb0d2e17467e80..79b0f43f2af4c6 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_to_case_actions.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_to_case_actions.tsx
@@ -9,6 +9,7 @@ import React, { useCallback, useMemo } from 'react';
 import { EuiContextMenuItem } from '@elastic/eui';
 import { CommentType } from '@kbn/cases-plugin/common';
 import type { CaseAttachmentsWithoutOwner } from '@kbn/cases-plugin/public';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { CasesTourSteps } from '../../../../common/components/guided_onboarding_tour/cases_tour_steps';
 import {
   AlertsCasesTourSteps,
@@ -18,7 +19,6 @@ import {
 import { useTourContext } from '../../../../common/components/guided_onboarding_tour';
 import { useGetUserCasesPermissions, useKibana } from '../../../../common/lib/kibana';
 import type { TimelineNonEcsData } from '../../../../../common/search_strategy';
-import type { Ecs } from '../../../../../common/ecs';
 import { ADD_TO_EXISTING_CASE, ADD_TO_NEW_CASE } from '../translations';
 
 export interface UseAddToCaseActions {
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.test.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.test.tsx
index eaef9169925ae2..21ec523d7d28c6 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.test.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.test.tsx
@@ -8,7 +8,7 @@ import { renderHook, act } from '@testing-library/react-hooks';
 import { fireEvent, render } from '@testing-library/react';
 import { TestProviders } from '../../../../common/mock';
 import { KibanaServices, useKibana } from '../../../../common/lib/kibana';
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { useInvestigateInTimeline } from './use_investigate_in_timeline';
 import * as actions from '../actions';
 import { coreMock } from '@kbn/core/public/mocks';
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.tsx
index f3f0c6921a248c..f65d05110b2fba 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_investigate_in_timeline.tsx
@@ -15,10 +15,10 @@ import type { ExceptionListId } from '@kbn/securitysolution-io-ts-list-types';
 import { useApi } from '@kbn/securitysolution-list-hooks';
 
 import type { Filter } from '@kbn/es-query';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { timelineDefaults } from '../../../../timelines/store/timeline/defaults';
 import { useKibana } from '../../../../common/lib/kibana';
 import { TimelineId, TimelineType } from '../../../../../common/types/timeline';
-import type { Ecs } from '../../../../../common/ecs';
 import { timelineActions, timelineSelectors } from '../../../../timelines/store/timeline';
 import { sendAlertToTimelineAction } from '../actions';
 import { dispatchUpdateTimeline } from '../../../../timelines/components/open_timeline/helpers';
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
index d60515169a2a50..8543649ae6c43d 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/types.ts
@@ -7,8 +7,8 @@
 
 import type { ISearchStart } from '@kbn/data-plugin/public';
 import type { Filter } from '@kbn/es-query';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { Status } from '../../../../common/detection_engine/schemas/common/schemas';
-import type { Ecs } from '../../../../common/ecs';
 import type { NoteResult } from '../../../../common/types/timeline/note';
 import type { DataProvider } from '../../../timelines/components/timeline/data_providers/data_provider';
 import type { TimelineModel } from '../../../timelines/store/timeline/model';
diff --git a/x-pack/plugins/security_solution/public/detections/components/osquery/osquery_flyout.tsx b/x-pack/plugins/security_solution/public/detections/components/osquery/osquery_flyout.tsx
index dc26a0b98499a7..9e6bc857a1dd10 100644
--- a/x-pack/plugins/security_solution/public/detections/components/osquery/osquery_flyout.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/osquery/osquery_flyout.tsx
@@ -9,7 +9,7 @@ import React, { useCallback } from 'react';
 import styled from 'styled-components';
 import { EuiFlyout, EuiFlyoutFooter, EuiFlyoutBody, EuiFlyoutHeader, EuiTitle } from '@elastic/eui';
 import { useQueryClient } from '@tanstack/react-query';
-import type { Ecs } from '../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { useKibana } from '../../../common/lib/kibana';
 import { OsqueryEventDetailsFooter } from './osquery_flyout_footer';
 import { ACTION_OSQUERY } from './translations';
diff --git a/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/index.tsx b/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/index.tsx
index c5f33d34b1997a..4e446f76f64cce 100644
--- a/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/take_action_dropdown/index.tsx
@@ -8,6 +8,7 @@
 import React, { useCallback, useMemo, useState } from 'react';
 import { EuiButton, EuiContextMenuPanel, EuiPopover } from '@elastic/eui';
 import type { ExceptionListTypeEnum } from '@kbn/securitysolution-io-ts-list-types';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { GuidedOnboardingTourStep } from '../../../common/components/guided_onboarding_tour/tour_step';
 import {
   AlertsCasesTourSteps,
@@ -25,7 +26,6 @@ import { useInvestigateInTimeline } from '../alerts_table/timeline_actions/use_i
 import { useEventFilterAction } from '../alerts_table/timeline_actions/use_event_filter_action';
 import { useHostIsolationAction } from '../host_isolation/use_host_isolation_action';
 import { getFieldValue } from '../host_isolation/helpers';
-import type { Ecs } from '../../../../common/ecs';
 import type { Status } from '../../../../common/detection_engine/schemas/common/schemas';
 import { isAlertFromEndpointAlert } from '../../../common/utils/endpoint_alert_check';
 import { useIsExperimentalFeatureEnabled } from '../../../common/hooks/use_experimental_features';
diff --git a/x-pack/plugins/security_solution/public/detections/pages/alert_details/__mocks__/alert_details_response.ts b/x-pack/plugins/security_solution/public/detections/pages/alert_details/__mocks__/alert_details_response.ts
index 67c5415fb2b263..5c4e985abf7175 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/alert_details/__mocks__/alert_details_response.ts
+++ b/x-pack/plugins/security_solution/public/detections/pages/alert_details/__mocks__/alert_details_response.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 // This data was generated using the endpoint test alert generator
 export const getMockAlertDetailsFieldsResponse = () => ({
diff --git a/x-pack/plugins/security_solution/public/detections/pages/alert_details/tabs/summary/alert_renderer_panel/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/alert_details/tabs/summary/alert_renderer_panel/index.tsx
index fcadf9aecde7e3..f930756f4b9bdd 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/alert_details/tabs/summary/alert_renderer_panel/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/alert_details/tabs/summary/alert_renderer_panel/index.tsx
@@ -7,12 +7,12 @@
 
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { defaultRowRenderers } from '../../../../../../timelines/components/timeline/body/renderers';
 import { getRowRenderer } from '../../../../../../timelines/components/timeline/body/renderers/get_row_renderer';
 import { TimelineId } from '../../../../../../../common/types';
 import { SummaryPanel } from '../wrappers';
 import { ALERT_REASON_PANEL_TITLE } from '../translation';
-import type { Ecs } from '../../../../../../../common/ecs';
 
 export interface AlertRendererPanelProps {
   dataAsNestedObject: Ecs | null;
diff --git a/x-pack/plugins/security_solution/public/detections/pages/alert_details/tabs/summary/index.tsx b/x-pack/plugins/security_solution/public/detections/pages/alert_details/tabs/summary/index.tsx
index 64ee09225fbdab..54fda5b335d4a9 100644
--- a/x-pack/plugins/security_solution/public/detections/pages/alert_details/tabs/summary/index.tsx
+++ b/x-pack/plugins/security_solution/public/detections/pages/alert_details/tabs/summary/index.tsx
@@ -8,13 +8,13 @@
 import React from 'react';
 import { EuiFlexGroup } from '@elastic/eui';
 import type { TimelineEventsDetailsItem } from '@kbn/timelines-plugin/common';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { SearchHit } from '../../../../../../common/search_strategy';
 import { TimelineId } from '../../../../../../common/types';
 import { useDetailPanel } from '../../../../../timelines/components/side_panel/hooks/use_detail_panel';
 import { useGetUserCasesPermissions } from '../../../../../common/lib/kibana';
 import type { SelectedDataView } from '../../../../../common/store/sourcerer/model';
 import { SourcererScopeName } from '../../../../../common/store/sourcerer/model';
-import type { Ecs } from '../../../../../../common/ecs';
 import { AlertRendererPanel } from './alert_renderer_panel';
 import { RulePanel } from './rule_panel';
 import { CasesPanel, CasesPanelNoReadPermissions } from './cases_panel';
diff --git a/x-pack/plugins/security_solution/public/explore/hosts/components/hosts_table/index.tsx b/x-pack/plugins/security_solution/public/explore/hosts/components/hosts_table/index.tsx
index c0a00e17699954..3d629213d1b664 100644
--- a/x-pack/plugins/security_solution/public/explore/hosts/components/hosts_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/explore/hosts/components/hosts_table/index.tsx
@@ -8,6 +8,7 @@
 import React, { useMemo, useCallback } from 'react';
 import { useDispatch } from 'react-redux';
 
+import type { HostEcs, OsEcs } from '@kbn/securitysolution-ecs';
 import type {
   Columns,
   Criteria,
@@ -26,7 +27,6 @@ import type {
 } from '../../../../../common/search_strategy/security_solution/hosts';
 import { HostsFields } from '../../../../../common/search_strategy/security_solution/hosts';
 import type { Direction, RiskSeverity } from '../../../../../common/search_strategy';
-import type { HostEcs, OsEcs } from '../../../../../common/ecs/host';
 import { SecurityPageName } from '../../../../../common/constants';
 import { HostsTableType } from '../../store/model';
 import { useNavigateTo } from '../../../../common/lib/kibana/hooks';
diff --git a/x-pack/plugins/security_solution/public/explore/hosts/components/uncommon_process_table/index.tsx b/x-pack/plugins/security_solution/public/explore/hosts/components/uncommon_process_table/index.tsx
index a6475539e2d429..ceef9e8f3bff3c 100644
--- a/x-pack/plugins/security_solution/public/explore/hosts/components/uncommon_process_table/index.tsx
+++ b/x-pack/plugins/security_solution/public/explore/hosts/components/uncommon_process_table/index.tsx
@@ -8,6 +8,7 @@
 import React, { useCallback, useMemo } from 'react';
 import { useDispatch } from 'react-redux';
 
+import type { HostEcs } from '@kbn/securitysolution-ecs';
 import type { HostsUncommonProcessesEdges } from '../../../../../common/search_strategy';
 import { hostsActions, hostsModel, hostsSelectors } from '../../store';
 import { defaultToEmptyTag, getEmptyValue } from '../../../../common/components/empty_value';
@@ -19,7 +20,6 @@ import * as i18n from './translations';
 import { getRowItemDraggables } from '../../../../common/components/tables/helpers';
 import { HostsType } from '../../store/model';
 import { useDeepEqualSelector } from '../../../../common/hooks/use_selector';
-import type { HostEcs } from '../../../../../common/ecs/host';
 
 const tableType = hostsModel.HostsTableType.uncommonProcesses;
 interface UncommonProcessTableProps {
diff --git a/x-pack/plugins/security_solution/public/helpers.tsx b/x-pack/plugins/security_solution/public/helpers.tsx
index 1e24a0eba9f943..7a0f918d4e169d 100644
--- a/x-pack/plugins/security_solution/public/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/helpers.tsx
@@ -13,6 +13,7 @@ import { matchPath, Redirect } from 'react-router-dom';
 
 import type { Capabilities, CoreStart } from '@kbn/core/public';
 import type { DocLinks } from '@kbn/doc-links';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import {
   ALERTS_PATH,
   APP_UI_ID,
@@ -24,7 +25,6 @@ import {
   SERVER_APP_ID,
   THREAT_INTELLIGENCE_PATH,
 } from '../common/constants';
-import type { Ecs } from '../common/ecs';
 import type {
   FactoryQueryTypes,
   StrategyResponseType,
diff --git a/x-pack/plugins/security_solution/public/management/pages/event_filters/test_utils/index.ts b/x-pack/plugins/security_solution/public/management/pages/event_filters/test_utils/index.ts
index 224214d9451af9..bdb08bfe8d2721 100644
--- a/x-pack/plugins/security_solution/public/management/pages/event_filters/test_utils/index.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/event_filters/test_utils/index.ts
@@ -14,7 +14,7 @@ import { EXCEPTION_LIST_ITEM_URL, EXCEPTION_LIST_URL } from '@kbn/securitysoluti
 import { getFoundExceptionListItemSchemaMock } from '@kbn/lists-plugin/common/schemas/response/found_exception_list_item_schema.mock';
 import { getExceptionListItemSchemaMock } from '@kbn/lists-plugin/common/schemas/response/exception_list_item_schema.mock';
 import { getSummaryExceptionListSchemaMock } from '@kbn/lists-plugin/common/schemas/response/exception_list_summary_schema.mock';
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 import type { ResponseProvidersInterface } from '../../../../common/mock/endpoint/http_handler_mock_factory';
 import { httpHandlerMockFactory } from '../../../../common/mock/endpoint/http_handler_mock_factory';
diff --git a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/event_filters_flyout.tsx b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/event_filters_flyout.tsx
index 48936a872b8173..141d92aae47280 100644
--- a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/event_filters_flyout.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/components/event_filters_flyout.tsx
@@ -22,6 +22,7 @@ import {
 } from '@elastic/eui';
 import { lastValueFrom } from 'rxjs';
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { useWithArtifactSubmitData } from '../../../../components/artifact_list_page/hooks/use_with_artifact_submit_data';
 import type {
   ArtifactFormComponentOnChangeCallbackProps,
@@ -30,7 +31,6 @@ import type {
 import { EventFiltersForm } from './form';
 
 import { getInitialExceptionFromEvent } from '../utils';
-import type { Ecs } from '../../../../../../common/ecs';
 import { useHttp, useKibana, useToasts } from '../../../../../common/lib/kibana';
 import { useGetEndpointSpecificPolicies } from '../../../../services/policies/hooks';
 import { getLoadPoliciesError } from '../../../../common/translations';
diff --git a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/utils.ts b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/utils.ts
index 7c423b9e5abfed..9bb81670b7077f 100644
--- a/x-pack/plugins/security_solution/public/management/pages/event_filters/view/utils.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/event_filters/view/utils.ts
@@ -7,7 +7,7 @@
 
 import { v4 as uuidv4 } from 'uuid';
 import type { CreateExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { ENDPOINT_EVENT_FILTERS_LIST_ID } from '../constants';
 
 const osTypeBasedOnAgentType = (data?: Ecs) => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.test.tsx
index d5089b34dd06fd..47a3bc62b91ce0 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.test.tsx
@@ -28,7 +28,7 @@ import {
 import { mockData } from '../../../explore/network/components/details/mock';
 import type { AutonomousSystem } from '../../../../common/search_strategy';
 import { FlowTarget } from '../../../../common/search_strategy';
-import type { HostEcs } from '../../../../common/ecs/host';
+import type { HostEcs } from '@kbn/securitysolution-ecs';
 
 jest.mock('../../../common/lib/kibana');
 jest.mock('../../../common/lib/kibana/kibana_react', () => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.tsx b/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.tsx
index 6b6afc8fec7271..57b782e9895c92 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/field_renderers/field_renderers.tsx
@@ -11,7 +11,7 @@ import { getOr } from 'lodash/fp';
 import React, { useCallback, Fragment, useMemo, useState } from 'react';
 import styled from 'styled-components';
 
-import type { HostEcs } from '../../../../common/ecs/host';
+import type { HostEcs } from '@kbn/securitysolution-ecs';
 import type {
   AutonomousSystem,
   FlowTarget,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
index 7270e7a65f9f2a..f210710f7508e8 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
@@ -18,13 +18,13 @@ import {
 import React from 'react';
 import styled from 'styled-components';
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
 import { getAlertDetailsUrl } from '../../../../common/components/link_to';
 import {
   SecuritySolutionLinkAnchor,
   useGetSecuritySolutionLinkProps,
 } from '../../../../common/components/links';
-import type { Ecs } from '../../../../../common/ecs';
 import type { TimelineTabs } from '../../../../../common/types/timeline';
 import type { BrowserFields } from '../../../../common/containers/source';
 import { EventDetails } from '../../../../common/components/event_details/event_details';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/body.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/body.tsx
index 70fa590d9098ef..446aa27f5a3a55 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/body.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/body.tsx
@@ -8,8 +8,8 @@
 import { EuiFlyoutBody } from '@elastic/eui';
 import styled from 'styled-components';
 import React from 'react';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { EndpointIsolateSuccess } from '../../../../../common/components/endpoint/host_isolation';
-import type { Ecs } from '../../../../../../common/ecs';
 import { HostIsolationPanel } from '../../../../../detections/components/host_isolation';
 import type {
   BrowserFields,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/footer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/footer.test.tsx
index 055d102994c0b8..6f069cb8dc83ed 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/footer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/footer.test.tsx
@@ -10,7 +10,7 @@ import { FlyoutFooter } from './footer';
 import '../../../../../common/mock/match_media';
 import { TestProviders } from '../../../../../common/mock';
 import { TimelineId } from '../../../../../../common/types/timeline';
-import type { Ecs } from '../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { mockAlertDetailsData } from '../../../../../common/components/event_details/__mocks__';
 import type { TimelineEventsDetailsItem } from '../../../../../../common/search_strategy';
 import {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/footer.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/footer.tsx
index 7029a908c3d82a..28c676a710c895 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/footer.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/flyout/footer.tsx
@@ -10,6 +10,7 @@ import { EuiFlyoutFooter, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { find } from 'lodash/fp';
 import type { ConnectedProps } from 'react-redux';
 import { connect } from 'react-redux';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { isActiveTimeline } from '../../../../../helpers';
 import { TakeActionDropdown } from '../../../../../detections/components/take_action_dropdown';
 import type { TimelineEventsDetailsItem } from '../../../../../../common/search_strategy';
@@ -19,7 +20,6 @@ import { EventFiltersFlyout } from '../../../../../management/pages/event_filter
 import { useEventFilterModal } from '../../../../../detections/components/alerts_table/timeline_actions/use_event_filter_modal';
 import { getFieldValue } from '../../../../../detections/components/host_isolation/helpers';
 import type { Status } from '../../../../../../common/detection_engine/schemas/common/schemas';
-import type { Ecs } from '../../../../../../common/ecs';
 import type { inputsModel, State } from '../../../../../common/store';
 import { inputsSelectors } from '../../../../../common/store';
 import { OsqueryFlyout } from '../../../../../detections/components/osquery/osquery_flyout';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.test.tsx
index 6df9ca799ea640..555b1a2eb84fa8 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.test.tsx
@@ -10,7 +10,7 @@ import { EventDetailsPanel } from '.';
 import '../../../../common/mock/match_media';
 import { TestProviders } from '../../../../common/mock';
 import { TimelineId, TimelineTabs } from '../../../../../common/types/timeline';
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import {
   KibanaServices,
   useKibana,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx
index e9066892384b40..a1d65e69dba58c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/data_driven_columns/index.tsx
@@ -10,6 +10,7 @@ import React, { useMemo } from 'react';
 import { getOr } from 'lodash/fp';
 import { DRAGGABLE_KEYBOARD_WRAPPER_CLASS_NAME } from '@kbn/securitysolution-t-grid';
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type {
   SetEventsDeleted,
   SetEventsLoading,
@@ -22,7 +23,6 @@ import type {
   ColumnHeaderOptions,
   TimelineTabs,
 } from '../../../../../../common/types/timeline';
-import type { Ecs } from '../../../../../../common/ecs';
 import type { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import { ARIA_COLUMN_INDEX_OFFSET } from '../../helpers';
 import type { OnRowSelected } from '../../events';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
index 331898f5b593e9..d3d27ba083b7ea 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/events/event_column_view.tsx
@@ -7,13 +7,13 @@
 
 import React, { useMemo } from 'react';
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type {
   ControlColumnProps,
   RowCellRender,
   SetEventsDeleted,
   SetEventsLoading,
 } from '../../../../../../common/types';
-import type { Ecs } from '../../../../../../common/ecs';
 import type { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 import type { OnRowSelected } from '../../events';
 import { EventsTrData, EventsTdGroupActions } from '../../styles';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts
index 25a5b89d7e3d31..8a26235aa77391 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.test.ts
@@ -12,7 +12,7 @@ import {
   getPinTooltip,
   stringifyEvent,
 } from './helpers';
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { TimelineType } from '../../../../../common/types/timeline';
 
 describe('helpers', () => {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
index c05d5d9592d9ea..b753d6850126df 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
@@ -7,7 +7,7 @@
 
 import { isEmpty } from 'lodash/fp';
 
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { TimelineItem, TimelineNonEcsData } from '../../../../../common/search_strategy';
 import type { TimelineEventsType, TimelineTypeLiteral } from '../../../../../common/types/timeline';
 import { TimelineType } from '../../../../../common/types/timeline';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/helpers/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/helpers/index.test.tsx
index b81e8a2c4d714b..18d29bfc3d844f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/helpers/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/helpers/index.test.tsx
@@ -8,7 +8,7 @@
 import { render, screen } from '@testing-library/react';
 import React from 'react';
 
-import type { Ecs } from '../../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { TestProviders } from '../../../../../../../common/mock';
 import { TableId, TimelineId } from '../../../../../../../../common/types';
 import { AlertFieldFlexGroup, DEFAULT_GAP, eventKindMatches, showWith } from '.';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/helpers/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/helpers/index.tsx
index a23c638ea2ec69..63037bd7021f77 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/helpers/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/helpers/index.tsx
@@ -9,7 +9,7 @@ import { EuiFlexGroup } from '@elastic/eui';
 import { has } from 'lodash/fp';
 import styled from 'styled-components';
 
-import type { Ecs } from '../../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { TimelineId } from '../../../../../../../../common/types';
 
 export const DESTINATION_IP = 'destination.ip';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/index.test.tsx
index a1255c7bea49c0..ae6c0e176f0cc4 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/alert_renderer/index.test.tsx
@@ -9,7 +9,7 @@ import { render, screen } from '@testing-library/react';
 import { omit } from 'lodash/fp';
 import React from 'react';
 
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { TestProviders } from '../../../../../../common/mock';
 import {
   DESTINATION_IP,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_details.tsx
index c4e09158109703..bf38784e7595d3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_details.tsx
@@ -9,7 +9,7 @@ import { EuiFlexGroup, EuiSpacer } from '@elastic/eui';
 import { get } from 'lodash/fp';
 import React from 'react';
 
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { DraggableBadge } from '../../../../../../common/components/draggables';
 
 import * as i18n from './translations';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_file_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_file_details.tsx
index be927fd2aac053..62d1bdaf86d77b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_file_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_file_details.tsx
@@ -10,7 +10,7 @@ import { EuiFlexGroup, EuiSpacer } from '@elastic/eui';
 import { get } from 'lodash/fp';
 import React from 'react';
 
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { DraggableBadge } from '../../../../../../common/components/draggables';
 
 import * as i18n from './translations';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_row_renderer.test.tsx
index eb63672fc71b94..7e20623fd12e02 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/auditd/generic_row_renderer.test.tsx
@@ -11,7 +11,7 @@ import React from 'react';
 
 import type { RowRenderer } from '../../../../../../../common/types';
 import { TimelineId } from '../../../../../../../common/types';
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { mockTimelineData, TestProviders } from '../../../../../../common/mock';
 import { useMountAppended } from '../../../../../../common/utils/use_mount_appended';
 import {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts
index 1a470145645bb6..a90aef7224a98d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/column_renderer.ts
@@ -8,8 +8,8 @@
 import type React from 'react';
 import type { Filter } from '@kbn/es-query';
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { ColumnHeaderOptions, RowRenderer } from '../../../../../../common/types';
-import type { Ecs } from '../../../../../../common/ecs';
 import type { TimelineNonEcsData } from '../../../../../../common/search_strategy/timeline';
 
 export interface ColumnRenderer {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/combine_renderers/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/combine_renderers/index.test.tsx
index 98b785d62b9156..a3a490f07fa7e8 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/combine_renderers/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/combine_renderers/index.test.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { RowRendererId, TimelineId } from '../../../../../../../common/types';
 import { combineRenderers } from '.';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/combine_renderers/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/combine_renderers/index.tsx
index d0f63532959b65..6f5ebfe9f5f511 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/combine_renderers/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/combine_renderers/index.tsx
@@ -7,7 +7,7 @@
 
 import React from 'react';
 
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { RowRenderer, RowRendererId } from '../../../../../../../common/types';
 
 export const combineRenderers = ({
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/__snapshots__/threat_match_row_renderer.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/__snapshots__/threat_match_row_renderer.test.tsx.snap
deleted file mode 100644
index 3acdd36faf3dd9..00000000000000
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/__snapshots__/threat_match_row_renderer.test.tsx.snap
+++ /dev/null
@@ -1,32 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`threatMatchRowRenderer #renderRow renders correctly against snapshot 1`] = `
-<span>
-  <RowRendererContainer
-    data-test-subj="threat-match-row-renderer"
-  >
-    <styled.div>
-      <ThreatMatchRow
-        contextId="threat-match-row-timeline-test-1-0"
-        data={
-          Object {
-            "matched": Object {
-              "atomic": Array [
-                "matched.atomic",
-              ],
-              "field": Array [
-                "matched.atomic",
-              ],
-              "type": Array [
-                "matched.domain",
-              ],
-            },
-          }
-        }
-        eventId="1"
-        isDraggable={true}
-      />
-    </styled.div>
-  </RowRendererContainer>
-</span>
-`;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/helpers.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/helpers.ts
index 78e4debb5cbf6a..1858df09a260a1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/helpers.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/helpers.ts
@@ -8,10 +8,9 @@
 import { get, isEmpty } from 'lodash';
 import styled from 'styled-components';
 
+import type { EcsSecurityExtension as Ecs, ThreatIndicatorEcs } from '@kbn/securitysolution-ecs';
 import { ENRICHMENT_DESTINATION_PATH } from '../../../../../../../common/constants';
 import { INDICATOR_MATCH_SUBFIELDS } from '../../../../../../../common/cti/constants';
-import type { Ecs } from '../../../../../../../common/ecs';
-import type { ThreatIndicatorEcs } from '../../../../../../../common/ecs/threat';
 
 const getIndicatorEcs = (data: Ecs): ThreatIndicatorEcs[] => {
   const threatData = get(data, ENRICHMENT_DESTINATION_PATH);
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_row.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_row.tsx
index 14ba63e7adfb6a..958e7b38496d61 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_row.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_row.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { get } from 'lodash';
+import { get, getOr } from 'lodash/fp';
 import React from 'react';
 import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 
@@ -23,9 +23,9 @@ import { IndicatorDetails } from './indicator_details';
 export interface ThreatMatchRowProps {
   contextId: string;
   eventId: string;
-  feedName: string | undefined;
-  indicatorReference: string | undefined;
-  indicatorType: string | undefined;
+  feedName?: string;
+  indicatorReference?: string;
+  indicatorType?: string;
   isDraggable?: boolean;
   sourceField: string;
   sourceValue: string;
@@ -45,12 +45,12 @@ export const ThreatMatchRow = ({
   const props = {
     contextId,
     eventId,
-    indicatorReference: get(data, REFERENCE)[0] as string | undefined,
-    feedName: get(data, FEED_NAME)[0] as string | undefined,
-    indicatorType: get(data, MATCHED_TYPE)[0] as string | undefined,
+    indicatorReference: getOr([], REFERENCE, data)[0] as string | undefined,
+    feedName: getOr([], FEED_NAME, data)[0] as string | undefined,
+    indicatorType: getOr([], MATCHED_TYPE, data)[0] as string | undefined,
     isDraggable,
-    sourceField: get(data, MATCHED_FIELD)[0] as string,
-    sourceValue: get(data, MATCHED_ATOMIC)[0] as string,
+    sourceField: get(MATCHED_FIELD, data)[0] as string,
+    sourceValue: get(MATCHED_ATOMIC, data)[0] as string,
   };
 
   return <ThreatMatchRowView {...props} />;
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_row_renderer.test.tsx
index 8df6da7fab12b8..9be0cd66bca7ce 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/cti/threat_match_row_renderer.test.tsx
@@ -6,25 +6,35 @@
  */
 
 import { TimelineId } from '../../../../../../../common/types';
-import { shallow } from 'enzyme';
+import { render } from '@testing-library/react';
 import React from 'react';
 
-import { getThreatMatchDetectionAlert } from '../../../../../../common/mock';
+import { getThreatMatchDetectionAlert, TestProviders } from '../../../../../../common/mock';
 
 import { threatMatchRowRenderer } from './threat_match_row_renderer';
+import { useKibana } from '../../../../../../common/lib/kibana';
+import { mockTimelines } from '../../../../../../common/mock/mock_timelines_plugin';
 
+jest.mock('../../../../../../common/lib/kibana');
 describe('threatMatchRowRenderer', () => {
   let threatMatchData: ReturnType<typeof getThreatMatchDetectionAlert>;
 
   beforeEach(() => {
     threatMatchData = getThreatMatchDetectionAlert();
+    (useKibana as jest.Mock).mockImplementation(() => {
+      return {
+        services: {
+          timelines: { ...mockTimelines },
+        },
+      };
+    });
   });
 
   describe('#isInstance', () => {
     it('is false for an empty event', () => {
       const emptyEvent = {
         _id: 'my_id',
-        '@timestamp': ['2020-11-17T14:48:08.922Z'],
+        '@timestamp': '2020-11-17T14:48:08.922Z',
       };
       expect(threatMatchRowRenderer.isInstance(emptyEvent)).toBe(false);
     });
@@ -53,14 +63,15 @@ describe('threatMatchRowRenderer', () => {
   });
 
   describe('#renderRow', () => {
-    it('renders correctly against snapshot', () => {
+    it('renders with minimum required props', () => {
       const children = threatMatchRowRenderer.renderRow({
         data: threatMatchData,
         isDraggable: true,
         scopeId: TimelineId.test,
       });
-      const wrapper = shallow(<span>{children}</span>);
-      expect(wrapper).toMatchSnapshot();
+      const { getByTestId } = render(<TestProviders>{children}</TestProviders>);
+
+      expect(getByTestId('threat-match-details')).toBeInTheDocument();
     });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/dns/dns_request_event_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/dns/dns_request_event_details.tsx
index d35e8c329de921..aae395042cdeb1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/dns/dns_request_event_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/dns/dns_request_event_details.tsx
@@ -9,8 +9,8 @@ import { EuiSpacer } from '@elastic/eui';
 import { get } from 'lodash/fp';
 import React from 'react';
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { Details } from '../helpers';
-import type { Ecs } from '../../../../../../../common/ecs';
 import { NetflowRenderer } from '../netflow';
 
 import { DnsRequestEventDetailsLine } from './dns_request_event_details_line';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/endgame/endgame_security_event_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/endgame/endgame_security_event_details.tsx
index e7a8798a3189fa..efa6b640f6895d 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/endgame/endgame_security_event_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/endgame/endgame_security_event_details.tsx
@@ -9,7 +9,7 @@ import { EuiSpacer } from '@elastic/eui';
 import { get } from 'lodash/fp';
 import React from 'react';
 
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { NetflowRenderer } from '../netflow';
 
 import { EndgameSecurityEventDetailsLine } from './endgame_security_event_details_line';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/event_summary_column_renderer.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/event_summary_column_renderer.tsx
index f989a2da1b4dd5..42b7435e62406b 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/event_summary_column_renderer.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/event_summary_column_renderer.tsx
@@ -10,8 +10,8 @@ import { isEqual } from 'lodash/fp';
 import React, { useMemo } from 'react';
 
 import styled from 'styled-components';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { ColumnHeaderOptions, RowRenderer } from '../../../../../../common/types';
-import type { Ecs } from '../../../../../../common/ecs';
 import type { ColumnRenderer } from './column_renderer';
 import { EVENT_SUMMARY_FIELD_NAME } from './constants';
 import { getRowRenderer } from './get_row_renderer';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx
index ea06fd70bbbf2f..b82b0e2597fc14 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.test.tsx
@@ -13,7 +13,7 @@ import React from 'react';
 import { removeExternalLinkText } from '@kbn/securitysolution-io-ts-utils';
 import { alertRenderer } from './alert_renderer';
 import '../../../../../common/mock/match_media';
-import type { Ecs } from '../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { mockTimelineData } from '../../../../../common/mock';
 import { TestProviders } from '../../../../../common/mock/test_providers';
 import { useMountAppended } from '../../../../../common/utils/use_mount_appended';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.ts b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.ts
index 22917ff0390ec9..a6a90c7e7b9940 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.ts
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/get_row_renderer.ts
@@ -5,10 +5,10 @@
  * 2.0.
  */
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { alertRenderer } from './alert_renderer';
 import { combineRenderers } from './combine_renderers';
 import type { RowRenderer } from '../../../../../../common/types';
-import type { Ecs } from '../../../../../../common/ecs';
 
 /**
  * This function may be used by both Timeline and the `Event Rendered view` in
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx
index c332f82a3b1c24..6750ea79e3434c 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow.tsx
@@ -8,7 +8,7 @@
 import { get } from 'lodash/fp';
 import React from 'react';
 
-import type { Ecs } from '../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { asArrayIfExists } from '../../../../../common/lib/helpers';
 import {
   TLS_CLIENT_CERTIFICATE_FINGERPRINT_SHA1_FIELD_NAME,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.test.tsx
index 668c9f8eafa87e..aa01ef7d203313 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/netflow/netflow_row_renderer.test.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 import { render, screen } from '@testing-library/react';
 
 import '../../../../../../common/mock/match_media';
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { getMockNetflowData, TestProviders } from '../../../../../../common/mock';
 
 import {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_row_renderer.test.tsx
index f8c9589c008ec1..da9e4bb0e1bfa3 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/plain_row_renderer.test.tsx
@@ -10,7 +10,7 @@ import { mount, shallow } from 'enzyme';
 import { cloneDeep } from 'lodash';
 import React from 'react';
 
-import type { Ecs } from '../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { mockTimelineData } from '../../../../../common/mock';
 import { plainRowRenderer } from './plain_row_renderer';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.tsx
index 24822626606ae5..d252989e7a14bf 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/reason_column_renderer.tsx
@@ -9,9 +9,9 @@ import { EuiPanel, EuiText } from '@elastic/eui';
 import { isEqual } from 'lodash/fp';
 import React, { useMemo } from 'react';
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { ColumnHeaderOptions, RowRenderer } from '../../../../../../common/types';
 import { TableId } from '../../../../../../common/types';
-import type { Ecs } from '../../../../../../common/ecs';
 import type { ColumnRenderer } from './column_renderer';
 import { REASON_FIELD_NAME } from './constants';
 import { getRowRenderer } from './get_row_renderer';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/registry/registry_event_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/registry/registry_event_details.tsx
index 4cf05e62fc9ffa..fea72a77f99b2f 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/registry/registry_event_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/registry/registry_event_details.tsx
@@ -8,8 +8,8 @@
 import { get } from 'lodash/fp';
 import React from 'react';
 
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { Details, isNillEmptyOrNotFinite } from '../helpers';
-import type { Ecs } from '../../../../../../../common/ecs';
 
 import { RegistryEventDetailsLine } from './registry_event_details_line';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_details.tsx
index 1012a675c65efb..3d69711f0cabc7 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_details.tsx
@@ -10,7 +10,7 @@ import { get } from 'lodash/fp';
 import React from 'react';
 import styled from 'styled-components';
 
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 import { NetflowRenderer } from '../netflow';
 import { SuricataSignature } from './suricata_signature';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_row_renderer.test.tsx
index 67fb4fe5dfce81..30ee6496dece24 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/suricata/suricata_row_renderer.test.tsx
@@ -11,7 +11,7 @@ import React from 'react';
 import { waitFor } from '@testing-library/react';
 
 import { removeExternalLinkText } from '@kbn/securitysolution-io-ts-utils';
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { mockTimelineData } from '../../../../../../common/mock';
 import '../../../../../../common/mock/match_media';
 import { TestProviders } from '../../../../../../common/mock/test_providers';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_details.tsx
index 5d343f6f41588f..4acc15e4fee0d7 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_details.tsx
@@ -9,7 +9,7 @@ import { EuiFlexGroup, EuiSpacer } from '@elastic/eui';
 import { get } from 'lodash/fp';
 import React from 'react';
 
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { DraggableBadge } from '../../../../../../common/components/draggables';
 import { OverflowField } from '../../../../../../common/components/tables/helpers';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx
index 34fa5c2804852c..d36a89c4da68d1 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_file_details.tsx
@@ -9,7 +9,7 @@ import { EuiFlexGroup, EuiSpacer } from '@elastic/eui';
 import { get } from 'lodash/fp';
 import React from 'react';
 
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { DraggableBadge } from '../../../../../../common/components/draggables';
 import { OverflowField } from '../../../../../../common/components/tables/helpers';
 
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_row_renderer.test.tsx
index 2f758646416e20..4ac60a17f22ebc 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/system/generic_row_renderer.test.tsx
@@ -10,7 +10,7 @@ import { cloneDeep } from 'lodash/fp';
 import React from 'react';
 
 import { removeExternalLinkText } from '@kbn/securitysolution-io-ts-utils';
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import {
   mockDnsEvent,
   mockEndpointProcessExecutionMalwarePreventionAlert,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_details.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_details.tsx
index d3620e4a61c881..9c21ec25177fad 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_details.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_details.tsx
@@ -9,7 +9,7 @@ import { EuiSpacer } from '@elastic/eui';
 import React from 'react';
 import styled from 'styled-components';
 
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 import { NetflowRenderer } from '../netflow';
 import { ZeekSignature } from './zeek_signature';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_row_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_row_renderer.test.tsx
index ad92027a9ee053..e06717fc6a7aaf 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_row_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_row_renderer.test.tsx
@@ -10,7 +10,7 @@ import { cloneDeep } from 'lodash/fp';
 import React from 'react';
 
 import { removeExternalLinkText } from '@kbn/securitysolution-io-ts-utils';
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { mockTimelineData, TestProviders } from '../../../../../../common/mock';
 import '../../../../../../common/mock/match_media';
 import { useMountAppended } from '../../../../../../common/utils/use_mount_appended';
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.test.tsx
index a33269d317465e..8b2287ff5fa816 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.test.tsx
@@ -11,7 +11,7 @@ import React from 'react';
 
 import { removeExternalLinkText } from '@kbn/securitysolution-io-ts-utils';
 import '../../../../../../common/mock/match_media';
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { mockTimelineData, TestProviders } from '../../../../../../common/mock';
 import { useMountAppended } from '../../../../../../common/utils/use_mount_appended';
 import {
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.tsx
index 7f0895cd421ed1..6e4b8793620308 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/zeek/zeek_signature.tsx
@@ -10,7 +10,7 @@ import { get } from 'lodash/fp';
 import React, { useCallback, useMemo } from 'react';
 import styled from 'styled-components';
 
-import type { Ecs } from '../../../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import {
   DragEffects,
   DraggableWrapper,
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx
index 6d9715b69b56ff..34f57d567951cb 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.test.tsx
@@ -17,7 +17,7 @@ import { mockBrowserFields } from '../../../../common/containers/source/mock';
 import { defaultHeaders, mockTimelineData, TestProviders } from '../../../../common/mock';
 import { DefaultCellRenderer } from './default_cell_renderer';
 import type { BrowserFields } from '@kbn/timelines-plugin/common/search_strategy';
-import type { Ecs } from '../../../../../common/ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 
 jest.mock('../../../../common/lib/kibana');
 
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
index 0444510776d67a..13841859c37ff4 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
@@ -14,6 +14,7 @@ import { Subscription } from 'rxjs';
 import type { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { isCompleteResponse, isErrorResponse } from '@kbn/data-plugin/common';
 import { EntityType } from '@kbn/timelines-plugin/common';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { useKibana } from '../../../common/lib/kibana';
 import type {
   SearchHit,
@@ -24,7 +25,6 @@ import type {
 import { TimelineEventsQueries } from '../../../../common/search_strategy';
 import { useAppToasts } from '../../../common/hooks/use_app_toasts';
 import * as i18n from './translations';
-import type { Ecs } from '../../../../common/ecs';
 
 export interface EventsArgs {
   detailsData: TimelineEventsDetailsItem[] | null;
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.ts
index 93ce3a15009b7a..8707f10ed01cb8 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/helpers.ts
@@ -7,7 +7,7 @@
 
 import { set } from '@kbn/safer-lodash-set/fp';
 import { get, has } from 'lodash/fp';
-import { hostFieldsMap } from '../../../../../../common/ecs/ecs_fields';
+import { hostFieldsMap } from '@kbn/securitysolution-ecs';
 import type {
   HostAggEsItem,
   HostsEdges,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
index 88d70e1065a9a2..6a5cc8d0085631 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/all/query.all_hosts.dsl.ts
@@ -6,6 +6,7 @@
  */
 
 import type { ISearchRequestParams } from '@kbn/data-plugin/common';
+import { hostFieldsMap } from '@kbn/securitysolution-ecs';
 import type {
   Direction,
   HostsRequestOptions,
@@ -15,7 +16,6 @@ import { HostsFields } from '../../../../../../common/search_strategy';
 import { createQueryFilterClauses, reduceFields } from '../../../../../utils/build_query';
 import { assertUnreachable } from '../../../../../../common/utility_types';
 import { HOSTS_FIELDS } from './helpers';
-import { hostFieldsMap } from '../../../../../../common/ecs/ecs_fields';
 
 export const buildHostsQuery = ({
   defaultIndex,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
index eba0c0917564dd..aa07acd20c8964 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
@@ -12,7 +12,7 @@ import type {
   KibanaRequest,
   SavedObjectsClientContract,
 } from '@kbn/core/server';
-import { hostFieldsMap } from '../../../../../../common/ecs/ecs_fields';
+import { hostFieldsMap } from '@kbn/securitysolution-ecs';
 import { Direction } from '../../../../../../common/search_strategy/common';
 import type {
   AggregationRequest,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts
index 8ed65cef7d7360..9fdf6560e511c9 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/details/query.host_details.dsl.ts
@@ -6,7 +6,7 @@
  */
 
 import type { ISearchRequestParams } from '@kbn/data-plugin/common';
-import { cloudFieldsMap, hostFieldsMap } from '../../../../../../common/ecs/ecs_fields';
+import { cloudFieldsMap, hostFieldsMap } from '@kbn/securitysolution-ecs';
 import type { HostDetailsRequestOptions } from '../../../../../../common/search_strategy/security_solution';
 import { reduceFields } from '../../../../../utils/build_query/reduce_fields';
 import { HOST_DETAILS_FIELDS, buildFieldsTermAggregation } from './helpers';
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts
index 2f00e05834bdae..abb65529084c33 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/dsl/query.dsl.ts
@@ -5,13 +5,9 @@
  * 2.0.
  */
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import { hostFieldsMap, processFieldsMap, userFieldsMap } from '@kbn/securitysolution-ecs';
 import { createQueryFilterClauses } from '../../../../../../utils/build_query';
 import { reduceFields } from '../../../../../../utils/build_query/reduce_fields';
-import {
-  hostFieldsMap,
-  processFieldsMap,
-  userFieldsMap,
-} from '../../../../../../../common/ecs/ecs_fields';
 import type { RequestOptionsPaginated } from '../../../../../../../common/search_strategy/security_solution';
 import { UNCOMMON_PROCESSES_FIELDS } from '../helpers';
 
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/helpers.test.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/helpers.test.ts
index c64864b67051bf..6258e3cfa94112 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/helpers.test.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/helpers.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { processFieldsMap } from '../../../../../../common/ecs/ecs_fields';
+import { processFieldsMap } from '@kbn/securitysolution-ecs';
 
 import type {
   HostsUncommonProcessesEdges,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts
index 1e03e187434f3e..dfa63911c8d8a8 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/hosts/uncommon_processes/index.ts
@@ -9,9 +9,9 @@ import { getOr } from 'lodash/fp';
 
 import type { IEsSearchResponse } from '@kbn/data-plugin/common';
 
+import { processFieldsMap, userFieldsMap } from '@kbn/securitysolution-ecs';
 import { DEFAULT_MAX_TABLE_QUERY_SIZE } from '../../../../../../common/constants';
 import type { HostsQueries } from '../../../../../../common/search_strategy/security_solution';
-import { processFieldsMap, userFieldsMap } from '../../../../../../common/ecs/ecs_fields';
 import type {
   HostsUncommonProcessesRequestOptions,
   HostsUncommonProcessesStrategyResponse,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/helpers.ts
index f7fa3667ec82a4..e17eb7ec499c6b 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/network/details/helpers.ts
@@ -6,11 +6,11 @@
  */
 
 import { getOr } from 'lodash/fp';
+import type { GeoEcs } from '@kbn/securitysolution-ecs';
 import {
   unflattenObject,
   transformLocationFields,
 } from '../../../../helpers/format_response_object_values';
-import type { GeoEcs } from '../../../../../../common/ecs/geo';
 import type {
   AutonomousSystem,
   NetworkHit,
diff --git a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/users/authentications/helpers.ts b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/users/authentications/helpers.ts
index 53623d44205b37..06452c915009c0 100644
--- a/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/users/authentications/helpers.ts
+++ b/x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/users/authentications/helpers.ts
@@ -7,8 +7,8 @@
 
 import { get, getOr, isEmpty } from 'lodash/fp';
 import { set } from '@kbn/safer-lodash-set/fp';
+import { sourceFieldsMap, hostFieldsMap } from '@kbn/securitysolution-ecs';
 import { toObjectArrayOfStrings } from '../../../../../../common/utils/to_array';
-import { sourceFieldsMap, hostFieldsMap } from '../../../../../../common/ecs/ecs_fields';
 import type {
   AuthenticationsEdges,
   AuthenticationHit,
diff --git a/x-pack/plugins/security_solution/tsconfig.json b/x-pack/plugins/security_solution/tsconfig.json
index a342df68147358..f9a3820b27971f 100644
--- a/x-pack/plugins/security_solution/tsconfig.json
+++ b/x-pack/plugins/security_solution/tsconfig.json
@@ -135,5 +135,6 @@
     "@kbn/shared-ux-utility",
     "@kbn/user-profile-components",
     "@kbn/guided-onboarding",
+    "@kbn/securitysolution-ecs",
   ]
 }
diff --git a/x-pack/plugins/timelines/common/ecs/agent/index.ts b/x-pack/plugins/timelines/common/ecs/agent/index.ts
deleted file mode 100644
index 2332b60f1a3cad..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/agent/index.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface AgentEcs {
-  type?: string[];
-}
diff --git a/x-pack/plugins/timelines/common/ecs/destination/index.ts b/x-pack/plugins/timelines/common/ecs/destination/index.ts
deleted file mode 100644
index 2d3b6154276b94..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/destination/index.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { GeoEcs } from '../geo';
-
-export interface DestinationEcs {
-  bytes?: number[];
-
-  ip?: string[];
-
-  port?: number[];
-
-  domain?: string[];
-
-  geo?: GeoEcs;
-
-  packets?: number[];
-}
diff --git a/x-pack/plugins/timelines/common/ecs/ecs_fields/extend_map.test.ts b/x-pack/plugins/timelines/common/ecs/ecs_fields/extend_map.test.ts
deleted file mode 100644
index e27b15f021257c..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/ecs_fields/extend_map.test.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { extendMap } from './extend_map';
-
-describe('ecs_fields test', () => {
-  describe('extendMap', () => {
-    test('it should extend a record', () => {
-      const osFieldsMap: Readonly<Record<string, string>> = {
-        'os.platform': 'os.platform',
-        'os.full': 'os.full',
-        'os.family': 'os.family',
-        'os.version': 'os.version',
-        'os.kernel': 'os.kernel',
-      };
-      const expected: Record<string, string> = {
-        'host.os.family': 'host.os.family',
-        'host.os.full': 'host.os.full',
-        'host.os.kernel': 'host.os.kernel',
-        'host.os.platform': 'host.os.platform',
-        'host.os.version': 'host.os.version',
-      };
-      expect(extendMap('host', osFieldsMap)).toEqual(expected);
-    });
-
-    test('it should extend a sample hosts record', () => {
-      const hostMap: Record<string, string> = {
-        'host.id': 'host.id',
-        'host.ip': 'host.ip',
-        'host.name': 'host.name',
-      };
-      const osFieldsMap: Readonly<Record<string, string>> = {
-        'os.platform': 'os.platform',
-        'os.full': 'os.full',
-        'os.family': 'os.family',
-        'os.version': 'os.version',
-        'os.kernel': 'os.kernel',
-      };
-      const expected: Record<string, string> = {
-        'host.id': 'host.id',
-        'host.ip': 'host.ip',
-        'host.name': 'host.name',
-        'host.os.family': 'host.os.family',
-        'host.os.full': 'host.os.full',
-        'host.os.kernel': 'host.os.kernel',
-        'host.os.platform': 'host.os.platform',
-        'host.os.version': 'host.os.version',
-      };
-      const output = { ...hostMap, ...extendMap('host', osFieldsMap) };
-      expect(output).toEqual(expected);
-    });
-  });
-});
diff --git a/x-pack/plugins/timelines/common/ecs/ecs_fields/extend_map.ts b/x-pack/plugins/timelines/common/ecs/ecs_fields/extend_map.ts
deleted file mode 100644
index 184e6b4f325665..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/ecs_fields/extend_map.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export const extendMap = (
-  path: string,
-  map: Readonly<Record<string, string>>
-): Readonly<Record<string, string>> =>
-  Object.entries(map).reduce<Record<string, string>>((accum, [key, value]) => {
-    accum[`${path}.${key}`] = `${path}.${value}`;
-    return accum;
-  }, {});
diff --git a/x-pack/plugins/timelines/common/ecs/ecs_fields/index.ts b/x-pack/plugins/timelines/common/ecs/ecs_fields/index.ts
deleted file mode 100644
index 239e295a1f8b13..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/ecs_fields/index.ts
+++ /dev/null
@@ -1,360 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { extendMap } from './extend_map';
-
-export const auditdMap: Readonly<Record<string, string>> = {
-  'auditd.result': 'auditd.result',
-  'auditd.session': 'auditd.session',
-  'auditd.data.acct': 'auditd.data.acct',
-  'auditd.data.terminal': 'auditd.data.terminal',
-  'auditd.data.op': 'auditd.data.op',
-  'auditd.summary.actor.primary': 'auditd.summary.actor.primary',
-  'auditd.summary.actor.secondary': 'auditd.summary.actor.secondary',
-  'auditd.summary.object.primary': 'auditd.summary.object.primary',
-  'auditd.summary.object.secondary': 'auditd.summary.object.secondary',
-  'auditd.summary.object.type': 'auditd.summary.object.type',
-  'auditd.summary.how': 'auditd.summary.how',
-  'auditd.summary.message_type': 'auditd.summary.message_type',
-  'auditd.summary.sequence': 'auditd.summary.sequence',
-};
-
-export const cloudFieldsMap: Readonly<Record<string, string>> = {
-  'cloud.account.id': 'cloud.account.id',
-  'cloud.availability_zone': 'cloud.availability_zone',
-  'cloud.instance.id': 'cloud.instance.id',
-  'cloud.instance.name': 'cloud.instance.name',
-  'cloud.machine.type': 'cloud.machine.type',
-  'cloud.provider': 'cloud.provider',
-  'cloud.region': 'cloud.region',
-};
-
-export const fileMap: Readonly<Record<string, string>> = {
-  'file.name': 'file.name',
-  'file.path': 'file.path',
-  'file.target_path': 'file.target_path',
-  'file.extension': 'file.extension',
-  'file.type': 'file.type',
-  'file.device': 'file.device',
-  'file.inode': 'file.inode',
-  'file.uid': 'file.uid',
-  'file.owner': 'file.owner',
-  'file.gid': 'file.gid',
-  'file.group': 'file.group',
-  'file.mode': 'file.mode',
-  'file.size': 'file.size',
-  'file.mtime': 'file.mtime',
-  'file.ctime': 'file.ctime',
-};
-
-export const osFieldsMap: Readonly<Record<string, string>> = {
-  'os.platform': 'os.platform',
-  'os.name': 'os.name',
-  'os.full': 'os.full',
-  'os.family': 'os.family',
-  'os.version': 'os.version',
-  'os.kernel': 'os.kernel',
-};
-
-export const hostFieldsMap: Readonly<Record<string, string>> = {
-  'host.architecture': 'host.architecture',
-  'host.id': 'host.id',
-  'host.ip': 'host.ip',
-  'host.mac': 'host.mac',
-  'host.name': 'host.name',
-  ...extendMap('host', osFieldsMap),
-};
-
-export const processFieldsMap: Readonly<Record<string, string>> = {
-  'process.hash.md5': 'process.hash.md5',
-  'process.hash.sha1': 'process.hash.sha1',
-  'process.hash.sha256': 'process.hash.sha256',
-  'process.pid': 'process.pid',
-  'process.name': 'process.name',
-  'process.ppid': 'process.ppid',
-  'process.args': 'process.args',
-  'process.entity_id': 'process.entity_id',
-  'process.executable': 'process.executable',
-  'process.title': 'process.title',
-  'process.thread': 'process.thread',
-  'process.working_directory': 'process.working_directory',
-};
-
-export const agentFieldsMap: Readonly<Record<string, string>> = {
-  'agent.type': 'agent.type',
-};
-
-export const userFieldsMap: Readonly<Record<string, string>> = {
-  'user.domain': 'user.domain',
-  'user.id': 'user.id',
-  'user.name': 'user.name',
-  // NOTE: This field is not tested and available from ECS. Please remove this tag once it is
-  'user.full_name': 'user.full_name',
-  // NOTE: This field is not tested and available from ECS. Please remove this tag once it is
-  'user.email': 'user.email',
-  // NOTE: This field is not tested and available from ECS. Please remove this tag once it is
-  'user.hash': 'user.hash',
-  // NOTE: This field is not tested and available from ECS. Please remove this tag once it is
-  'user.group': 'user.group',
-};
-
-export const winlogFieldsMap: Readonly<Record<string, string>> = {
-  'winlog.event_id': 'winlog.event_id',
-};
-
-export const suricataFieldsMap: Readonly<Record<string, string>> = {
-  'suricata.eve.flow_id': 'suricata.eve.flow_id',
-  'suricata.eve.proto': 'suricata.eve.proto',
-  'suricata.eve.alert.signature': 'suricata.eve.alert.signature',
-  'suricata.eve.alert.signature_id': 'suricata.eve.alert.signature_id',
-};
-
-export const tlsFieldsMap: Readonly<Record<string, string>> = {
-  'tls.client_certificate.fingerprint.sha1': 'tls.client_certificate.fingerprint.sha1',
-  'tls.fingerprints.ja3.hash': 'tls.fingerprints.ja3.hash',
-  'tls.server_certificate.fingerprint.sha1': 'tls.server_certificate.fingerprint.sha1',
-};
-
-export const urlFieldsMap: Readonly<Record<string, string>> = {
-  'url.original': 'url.original',
-  'url.domain': 'url.domain',
-  'user.username': 'user.username',
-  'user.password': 'user.password',
-};
-
-export const httpFieldsMap: Readonly<Record<string, string>> = {
-  'http.version': 'http.version',
-  'http.request': 'http.request',
-  'http.request.method': 'http.request.method',
-  'http.request.body.bytes': 'http.request.body.bytes',
-  'http.request.body.content': 'http.request.body.content',
-  'http.request.referrer': 'http.request.referrer',
-  'http.response.status_code': 'http.response.status_code',
-  'http.response.body': 'http.response.body',
-  'http.response.body.bytes': 'http.response.body.bytes',
-  'http.response.body.content': 'http.response.body.content',
-};
-
-export const zeekFieldsMap: Readonly<Record<string, string>> = {
-  'zeek.session_id': 'zeek.session_id',
-  'zeek.connection.local_resp': 'zeek.connection.local_resp',
-  'zeek.connection.local_orig': 'zeek.connection.local_orig',
-  'zeek.connection.missed_bytes': 'zeek.connection.missed_bytes',
-  'zeek.connection.state': 'zeek.connection.state',
-  'zeek.connection.history': 'zeek.connection.history',
-  'zeek.notice.suppress_for': 'zeek.notice.suppress_for',
-  'zeek.notice.msg': 'zeek.notice.msg',
-  'zeek.notice.note': 'zeek.notice.note',
-  'zeek.notice.sub': 'zeek.notice.sub',
-  'zeek.notice.dst': 'zeek.notice.dst',
-  'zeek.notice.dropped': 'zeek.notice.dropped',
-  'zeek.notice.peer_descr': 'zeek.notice.peer_descr',
-  'zeek.dns.AA': 'zeek.dns.AA',
-  'zeek.dns.qclass_name': 'zeek.dns.qclass_name',
-  'zeek.dns.RD': 'zeek.dns.RD',
-  'zeek.dns.qtype_name': 'zeek.dns.qtype_name',
-  'zeek.dns.qtype': 'zeek.dns.qtype',
-  'zeek.dns.query': 'zeek.dns.query',
-  'zeek.dns.trans_id': 'zeek.dns.trans_id',
-  'zeek.dns.qclass': 'zeek.dns.qclass',
-  'zeek.dns.RA': 'zeek.dns.RA',
-  'zeek.dns.TC': 'zeek.dns.TC',
-  'zeek.http.resp_mime_types': 'zeek.http.resp_mime_types',
-  'zeek.http.trans_depth': 'zeek.http.trans_depth',
-  'zeek.http.status_msg': 'zeek.http.status_msg',
-  'zeek.http.resp_fuids': 'zeek.http.resp_fuids',
-  'zeek.http.tags': 'zeek.http.tags',
-  'zeek.files.session_ids': 'zeek.files.session_ids',
-  'zeek.files.timedout': 'zeek.files.timedout',
-  'zeek.files.local_orig': 'zeek.files.local_orig',
-  'zeek.files.tx_host': 'zeek.files.tx_host',
-  'zeek.files.source': 'zeek.files.source',
-  'zeek.files.is_orig': 'zeek.files.is_orig',
-  'zeek.files.overflow_bytes': 'zeek.files.overflow_bytes',
-  'zeek.files.sha1': 'zeek.files.sha1',
-  'zeek.files.duration': 'zeek.files.duration',
-  'zeek.files.depth': 'zeek.files.depth',
-  'zeek.files.analyzers': 'zeek.files.analyzers',
-  'zeek.files.mime_type': 'zeek.files.mime_type',
-  'zeek.files.rx_host': 'zeek.files.rx_host',
-  'zeek.files.total_bytes': 'zeek.files.total_bytes',
-  'zeek.files.fuid': 'zeek.files.fuid',
-  'zeek.files.seen_bytes': 'zeek.files.seen_bytes',
-  'zeek.files.missing_bytes': 'zeek.files.missing_bytes',
-  'zeek.files.md5': 'zeek.files.md5',
-  'zeek.ssl.cipher': 'zeek.ssl.cipher',
-  'zeek.ssl.established': 'zeek.ssl.established',
-  'zeek.ssl.resumed': 'zeek.ssl.resumed',
-  'zeek.ssl.version': 'zeek.ssl.version',
-};
-
-export const sourceFieldsMap: Readonly<Record<string, string>> = {
-  'source.bytes': 'source.bytes',
-  'source.ip': 'source.ip',
-  'source.packets': 'source.packets',
-  'source.port': 'source.port',
-  'source.domain': 'source.domain',
-  'source.geo.continent_name': 'source.geo.continent_name',
-  'source.geo.country_name': 'source.geo.country_name',
-  'source.geo.country_iso_code': 'source.geo.country_iso_code',
-  'source.geo.city_name': 'source.geo.city_name',
-  'source.geo.region_iso_code': 'source.geo.region_iso_code',
-  'source.geo.region_name': 'source.geo.region_name',
-};
-
-export const destinationFieldsMap: Readonly<Record<string, string>> = {
-  'destination.bytes': 'destination.bytes',
-  'destination.ip': 'destination.ip',
-  'destination.packets': 'destination.packets',
-  'destination.port': 'destination.port',
-  'destination.domain': 'destination.domain',
-  'destination.geo.continent_name': 'destination.geo.continent_name',
-  'destination.geo.country_name': 'destination.geo.country_name',
-  'destination.geo.country_iso_code': 'destination.geo.country_iso_code',
-  'destination.geo.city_name': 'destination.geo.city_name',
-  'destination.geo.region_iso_code': 'destination.geo.region_iso_code',
-  'destination.geo.region_name': 'destination.geo.region_name',
-};
-
-export const networkFieldsMap: Readonly<Record<string, string>> = {
-  'network.bytes': 'network.bytes',
-  'network.community_id': 'network.community_id',
-  'network.direction': 'network.direction',
-  'network.packets': 'network.packets',
-  'network.protocol': 'network.protocol',
-  'network.transport': 'network.transport',
-};
-
-export const geoFieldsMap: Readonly<Record<string, string>> = {
-  'geo.region_name': 'destination.geo.region_name',
-  'geo.country_iso_code': 'destination.geo.country_iso_code',
-};
-
-export const dnsFieldsMap: Readonly<Record<string, string>> = {
-  'dns.question.name': 'dns.question.name',
-  'dns.question.type': 'dns.question.type',
-  'dns.resolved_ip': 'dns.resolved_ip',
-  'dns.response_code': 'dns.response_code',
-};
-
-export const endgameFieldsMap: Readonly<Record<string, string>> = {
-  'endgame.exit_code': 'endgame.exit_code',
-  'endgame.file_name': 'endgame.file_name',
-  'endgame.file_path': 'endgame.file_path',
-  'endgame.logon_type': 'endgame.logon_type',
-  'endgame.parent_process_name': 'endgame.parent_process_name',
-  'endgame.pid': 'endgame.pid',
-  'endgame.process_name': 'endgame.process_name',
-  'endgame.subject_domain_name': 'endgame.subject_domain_name',
-  'endgame.subject_logon_id': 'endgame.subject_logon_id',
-  'endgame.subject_user_name': 'endgame.subject_user_name',
-  'endgame.target_domain_name': 'endgame.target_domain_name',
-  'endgame.target_logon_id': 'endgame.target_logon_id',
-  'endgame.target_user_name': 'endgame.target_user_name',
-};
-
-export const eventBaseFieldsMap: Readonly<Record<string, string>> = {
-  'event.action': 'event.action',
-  'event.category': 'event.category',
-  'event.code': 'event.code',
-  'event.created': 'event.created',
-  'event.dataset': 'event.dataset',
-  'event.duration': 'event.duration',
-  'event.end': 'event.end',
-  'event.hash': 'event.hash',
-  'event.id': 'event.id',
-  'event.kind': 'event.kind',
-  'event.module': 'event.module',
-  'event.original': 'event.original',
-  'event.outcome': 'event.outcome',
-  'event.risk_score': 'event.risk_score',
-  'event.risk_score_norm': 'event.risk_score_norm',
-  'event.severity': 'event.severity',
-  'event.start': 'event.start',
-  'event.timezone': 'event.timezone',
-  'event.type': 'event.type',
-};
-
-export const systemFieldsMap: Readonly<Record<string, string>> = {
-  'system.audit.package.arch': 'system.audit.package.arch',
-  'system.audit.package.entity_id': 'system.audit.package.entity_id',
-  'system.audit.package.name': 'system.audit.package.name',
-  'system.audit.package.size': 'system.audit.package.size',
-  'system.audit.package.summary': 'system.audit.package.summary',
-  'system.audit.package.version': 'system.audit.package.version',
-  'system.auth.ssh.signature': 'system.auth.ssh.signature',
-  'system.auth.ssh.method': 'system.auth.ssh.method',
-};
-
-export const signalFieldsMap: Readonly<Record<string, string>> = {
-  'signal.original_time': 'signal.original_time',
-  'signal.reason': 'signal.reason',
-  'signal.rule.id': 'signal.rule.id',
-  'signal.rule.saved_id': 'signal.rule.saved_id',
-  'signal.rule.timeline_id': 'signal.rule.timeline_id',
-  'signal.rule.timeline_title': 'signal.rule.timeline_title',
-  'signal.rule.output_index': 'signal.rule.output_index',
-  'signal.rule.from': 'signal.rule.from',
-  'signal.rule.index': 'signal.rule.index',
-  'signal.rule.language': 'signal.rule.language',
-  'signal.rule.query': 'signal.rule.query',
-  'signal.rule.to': 'signal.rule.to',
-  'signal.rule.filters': 'signal.rule.filters',
-  'signal.rule.rule_id': 'signal.rule.rule_id',
-  'signal.rule.false_positives': 'signal.rule.false_positives',
-  'signal.rule.max_signals': 'signal.rule.max_signals',
-  'signal.rule.risk_score': 'signal.rule.risk_score',
-  'signal.rule.description': 'signal.rule.description',
-  'signal.rule.name': 'signal.rule.name',
-  'signal.rule.immutable': 'signal.rule.immutable',
-  'signal.rule.references': 'signal.rule.references',
-  'signal.rule.severity': 'signal.rule.severity',
-  'signal.rule.tags': 'signal.rule.tags',
-  'signal.rule.threat': 'signal.rule.threat',
-  'signal.rule.type': 'signal.rule.type',
-  'signal.rule.size': 'signal.rule.size',
-  'signal.rule.enabled': 'signal.rule.enabled',
-  'signal.rule.created_at': 'signal.rule.created_at',
-  'signal.rule.updated_at': 'signal.rule.updated_at',
-  'signal.rule.created_by': 'signal.rule.created_by',
-  'signal.rule.updated_by': 'signal.rule.updated_by',
-  'signal.rule.version': 'signal.rule.version',
-  'signal.rule.note': 'signal.rule.note',
-  'signal.rule.threshold': 'signal.rule.threshold',
-  'signal.rule.exceptions_list': 'signal.rule.exceptions_list',
-};
-
-export const ruleFieldsMap: Readonly<Record<string, string>> = {
-  'rule.reference': 'rule.reference',
-};
-
-export const eventFieldsMap: Readonly<Record<string, string>> = {
-  timestamp: '@timestamp',
-  '@timestamp': '@timestamp',
-  message: 'message',
-  ...{ ...agentFieldsMap },
-  ...{ ...auditdMap },
-  ...{ ...destinationFieldsMap },
-  ...{ ...dnsFieldsMap },
-  ...{ ...endgameFieldsMap },
-  ...{ ...eventBaseFieldsMap },
-  ...{ ...fileMap },
-  ...{ ...geoFieldsMap },
-  ...{ ...hostFieldsMap },
-  ...{ ...networkFieldsMap },
-  ...{ ...ruleFieldsMap },
-  ...{ ...signalFieldsMap },
-  ...{ ...sourceFieldsMap },
-  ...{ ...suricataFieldsMap },
-  ...{ ...systemFieldsMap },
-  ...{ ...tlsFieldsMap },
-  ...{ ...zeekFieldsMap },
-  ...{ ...httpFieldsMap },
-  ...{ ...userFieldsMap },
-  ...{ ...winlogFieldsMap },
-  ...{ ...processFieldsMap },
-};
diff --git a/x-pack/plugins/timelines/common/ecs/endgame/index.ts b/x-pack/plugins/timelines/common/ecs/endgame/index.ts
deleted file mode 100644
index f82a9587c75c33..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/endgame/index.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface EndgameEcs {
-  exit_code?: number[];
-  file_name?: string[];
-  file_path?: string[];
-  logon_type?: number[];
-  parent_process_name?: string[];
-  pid?: number[];
-  process_name?: string[];
-  subject_domain_name?: string[];
-  subject_logon_id?: string[];
-  subject_user_name?: string[];
-  target_domain_name?: string[];
-  target_logon_id?: string[];
-  target_user_name?: string[];
-}
diff --git a/x-pack/plugins/timelines/common/ecs/event/index.ts b/x-pack/plugins/timelines/common/ecs/event/index.ts
deleted file mode 100644
index 4e38bacefd351b..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/event/index.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface EventEcs {
-  action?: string[];
-
-  category?: string[];
-
-  code?: string[];
-
-  created?: string[];
-
-  dataset?: string[];
-
-  duration?: number[];
-
-  end?: string[];
-
-  hash?: string[];
-
-  id?: string[];
-
-  kind?: string[];
-
-  module?: string[];
-
-  original?: string[];
-
-  outcome?: string[];
-
-  risk_score?: number[];
-
-  risk_score_norm?: number[];
-
-  severity?: number[];
-
-  start?: string[];
-
-  timezone?: string[];
-
-  type?: string[];
-}
diff --git a/x-pack/plugins/timelines/common/ecs/file/index.ts b/x-pack/plugins/timelines/common/ecs/file/index.ts
deleted file mode 100644
index 5e409b1095cf59..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/file/index.ts
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-interface Original {
-  name?: string[];
-  path?: string[];
-}
-
-export interface CodeSignature {
-  subject_name: string[];
-  trusted: string[];
-}
-export interface Ext {
-  code_signature?: CodeSignature[] | CodeSignature;
-  original?: Original;
-}
-export interface Hash {
-  md5?: string[];
-  sha1?: string[];
-  sha256: string[];
-}
-
-export interface FileEcs {
-  name?: string[];
-
-  path?: string[];
-
-  target_path?: string[];
-
-  extension?: string[];
-
-  Ext?: Ext;
-
-  type?: string[];
-
-  device?: string[];
-
-  inode?: string[];
-
-  uid?: string[];
-
-  owner?: string[];
-
-  gid?: string[];
-
-  group?: string[];
-
-  mode?: string[];
-
-  size?: number[];
-
-  mtime?: string[];
-
-  ctime?: string[];
-
-  hash?: Hash;
-}
diff --git a/x-pack/plugins/timelines/common/ecs/index.ts b/x-pack/plugins/timelines/common/ecs/index.ts
deleted file mode 100644
index 6c3313668ba95e..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/index.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { AgentEcs } from './agent';
-import { AuditdEcs } from './auditd';
-import { DestinationEcs } from './destination';
-import { DnsEcs } from './dns';
-import { EndgameEcs } from './endgame';
-import { EventEcs } from './event';
-import { FileEcs } from './file';
-import { GeoEcs } from './geo';
-import { HostEcs } from './host';
-import { NetworkEcs } from './network';
-import { RegistryEcs } from './registry';
-import { RuleEcs } from './rule';
-import { SignalEcs } from './signal';
-import { SourceEcs } from './source';
-import { SuricataEcs } from './suricata';
-import { TlsEcs } from './tls';
-import { ZeekEcs } from './zeek';
-import { HttpEcs } from './http';
-import { UrlEcs } from './url';
-import { UserEcs } from './user';
-import { WinlogEcs } from './winlog';
-import { ProcessEcs } from './process';
-import { SystemEcs } from './system';
-import { ThreatEcs } from './threat';
-import { Ransomware } from './ransomware';
-
-export type SignalEcsAAD = Exclude<SignalEcs, 'rule' | 'status'> & {
-  rule?: Exclude<RuleEcs, 'id'> & { parameters: Record<string, unknown>; uuid: string[] };
-  building_block_type?: string[];
-  workflow_status?: string[];
-  suppression?: {
-    docs_count: string[];
-  };
-};
-export interface Ecs {
-  _id: string;
-  _index?: string;
-  agent?: AgentEcs;
-  auditd?: AuditdEcs;
-  destination?: DestinationEcs;
-  dns?: DnsEcs;
-  endgame?: EndgameEcs;
-  event?: EventEcs;
-  geo?: GeoEcs;
-  host?: HostEcs;
-  network?: NetworkEcs;
-  registry?: RegistryEcs;
-  rule?: RuleEcs;
-  signal?: SignalEcs;
-  kibana?: {
-    alert: SignalEcsAAD;
-  };
-  source?: SourceEcs;
-  suricata?: SuricataEcs;
-  tls?: TlsEcs;
-  zeek?: ZeekEcs;
-  http?: HttpEcs;
-  url?: UrlEcs;
-  timestamp?: string;
-  message?: string[];
-  user?: UserEcs;
-  winlog?: WinlogEcs;
-  process?: ProcessEcs;
-  file?: FileEcs;
-  system?: SystemEcs;
-  threat?: ThreatEcs;
-  // This should be temporary
-  eql?: { parentId: string; sequenceNumber: string };
-  Ransomware?: Ransomware;
-}
diff --git a/x-pack/plugins/timelines/common/ecs/network/index.ts b/x-pack/plugins/timelines/common/ecs/network/index.ts
deleted file mode 100644
index 6cc5dacab1e53b..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/network/index.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface NetworkEcs {
-  bytes?: number[];
-  community_id?: string[];
-  direction?: string[];
-  packets?: number[];
-  protocol?: string[];
-  transport?: string[];
-}
diff --git a/x-pack/plugins/timelines/common/ecs/process/index.ts b/x-pack/plugins/timelines/common/ecs/process/index.ts
deleted file mode 100644
index b3abf363e28767..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/process/index.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { Ext } from '../file';
-
-export interface ProcessEcs {
-  Ext?: Ext;
-  entity_id?: string[];
-  entry_leader?: ProcessSessionData;
-  session_leader?: ProcessSessionData;
-  group_leader?: ProcessSessionData;
-  exit_code?: number[];
-  hash?: ProcessHashData;
-  parent?: ProcessParentData;
-  pid?: number[];
-  name?: string[];
-  ppid?: number[];
-  args?: string[];
-  executable?: string[];
-  title?: string[];
-  thread?: Thread;
-  working_directory?: string[];
-}
-
-export interface ProcessSessionData {
-  entity_id?: string[];
-  pid?: string[];
-  name?: string[];
-}
-
-export interface ProcessHashData {
-  md5?: string[];
-  sha1?: string[];
-  sha256?: string[];
-}
-
-export interface ProcessParentData {
-  name?: string[];
-  pid?: number[];
-}
-
-export interface Thread {
-  id?: number[];
-  start?: string[];
-}
diff --git a/x-pack/plugins/timelines/common/ecs/registry/index.ts b/x-pack/plugins/timelines/common/ecs/registry/index.ts
deleted file mode 100644
index c756fb139199e7..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/registry/index.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface RegistryEcs {
-  hive?: string[];
-  key?: string[];
-  path?: string[];
-  value?: string[];
-}
diff --git a/x-pack/plugins/timelines/common/ecs/rule/index.ts b/x-pack/plugins/timelines/common/ecs/rule/index.ts
deleted file mode 100644
index ae7e5064a8eced..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/rule/index.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface RuleEcs {
-  id?: string[];
-  rule_id?: string[];
-  name?: string[];
-  false_positives?: string[];
-  saved_id?: string[];
-  timeline_id?: string[];
-  timeline_title?: string[];
-  max_signals?: number[];
-  risk_score?: string[];
-  output_index?: string[];
-  description?: string[];
-  from?: string[];
-  immutable?: boolean[];
-  index?: string[];
-  interval?: string[];
-  language?: string[];
-  query?: string[];
-  references?: string[];
-  severity?: string[];
-  tags?: string[];
-  threat?: unknown;
-  threshold?: unknown;
-  type?: string[];
-  size?: string[];
-  to?: string[];
-  enabled?: boolean[];
-  filters?: unknown;
-  created_at?: string[];
-  updated_at?: string[];
-  created_by?: string[];
-  updated_by?: string[];
-  version?: string[];
-  note?: string[];
-  building_block_type?: string[];
-}
diff --git a/x-pack/plugins/timelines/common/ecs/signal/index.ts b/x-pack/plugins/timelines/common/ecs/signal/index.ts
deleted file mode 100644
index 45e1f04d2b405f..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/signal/index.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { RuleEcs } from '../rule';
-
-export interface SignalEcs {
-  rule?: RuleEcs;
-  original_time?: string[];
-  status?: string[];
-  group?: {
-    id?: string[];
-  };
-  threshold_result?: unknown;
-}
diff --git a/x-pack/plugins/timelines/common/ecs/source/index.ts b/x-pack/plugins/timelines/common/ecs/source/index.ts
deleted file mode 100644
index 10a2025eb43ec9..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/source/index.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { GeoEcs } from '../geo';
-
-export interface SourceEcs {
-  bytes?: number[];
-  ip?: string[];
-  port?: number[];
-  domain?: string[];
-  geo?: GeoEcs;
-  packets?: number[];
-}
diff --git a/x-pack/plugins/timelines/common/ecs/system/index.ts b/x-pack/plugins/timelines/common/ecs/system/index.ts
deleted file mode 100644
index f2313c78845118..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/system/index.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface SystemEcs {
-  audit?: AuditEcs;
-
-  auth?: AuthEcs;
-}
-
-export interface AuditEcs {
-  package?: PackageEcs;
-}
-
-export interface PackageEcs {
-  arch?: string[];
-
-  entity_id?: string[];
-
-  name?: string[];
-
-  size?: number[];
-
-  summary?: string[];
-
-  version?: string[];
-}
-
-export interface AuthEcs {
-  ssh?: SshEcs;
-}
-
-export interface SshEcs {
-  method?: string[];
-
-  signature?: string[];
-}
diff --git a/x-pack/plugins/timelines/common/ecs/threat/index.ts b/x-pack/plugins/timelines/common/ecs/threat/index.ts
deleted file mode 100644
index 84a1098de69d84..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/threat/index.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { EventEcs } from '../event';
-import { UrlEcs } from '../url';
-
-interface ThreatMatchEcs {
-  atomic?: string[];
-  field?: string[];
-  id?: string[];
-  index?: string[];
-  type?: string[];
-}
-
-export interface LegacyThreatIndicatorEcs {
-  domain?: string[];
-  matched?: ThreatMatchEcs;
-  event?: EventEcs & { reference?: string[] };
-  provider?: string[];
-  type?: string[];
-}
-
-export interface ThreatIndicatorEcs {
-  url?: UrlEcs;
-  provider?: string[];
-  reference?: string[];
-  type?: string[];
-}
-
-export interface ThreatFeedEcs {
-  name?: string[];
-}
-
-export interface ThreatEnrichmentEcs {
-  indicator?: ThreatIndicatorEcs;
-  matched?: ThreatMatchEcs;
-  feed?: ThreatFeedEcs;
-}
-
-export interface ThreatEcs {
-  indicator?: LegacyThreatIndicatorEcs[];
-  enrichments?: ThreatEnrichmentEcs[];
-}
diff --git a/x-pack/plugins/timelines/common/ecs/zeek/index.ts b/x-pack/plugins/timelines/common/ecs/zeek/index.ts
deleted file mode 100644
index b1a3786ae74aa6..00000000000000
--- a/x-pack/plugins/timelines/common/ecs/zeek/index.ts
+++ /dev/null
@@ -1,134 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-export interface ZeekEcs {
-  session_id?: string[];
-
-  connection?: ZeekConnectionData;
-
-  notice?: ZeekNoticeData;
-
-  dns?: ZeekDnsData;
-
-  http?: ZeekHttpData;
-
-  files?: ZeekFileData;
-
-  ssl?: ZeekSslData;
-}
-
-export interface ZeekConnectionData {
-  local_resp?: boolean[];
-
-  local_orig?: boolean[];
-
-  missed_bytes?: number[];
-
-  state?: string[];
-
-  history?: string[];
-}
-
-export interface ZeekNoticeData {
-  suppress_for?: number[];
-
-  msg?: string[];
-
-  note?: string[];
-
-  sub?: string[];
-
-  dst?: string[];
-
-  dropped?: boolean[];
-
-  peer_descr?: string[];
-}
-
-export interface ZeekDnsData {
-  AA?: boolean[];
-
-  qclass_name?: string[];
-
-  RD?: boolean[];
-
-  qtype_name?: string[];
-
-  rejected?: boolean[];
-
-  qtype?: string[];
-
-  query?: string[];
-
-  trans_id?: number[];
-
-  qclass?: string[];
-
-  RA?: boolean[];
-
-  TC?: boolean[];
-}
-
-export interface ZeekHttpData {
-  resp_mime_types?: string[];
-
-  trans_depth?: string[];
-
-  status_msg?: string[];
-
-  resp_fuids?: string[];
-
-  tags?: string[];
-}
-
-export interface ZeekFileData {
-  session_ids?: string[];
-
-  timedout?: boolean[];
-
-  local_orig?: boolean[];
-
-  tx_host?: string[];
-
-  source?: string[];
-
-  is_orig?: boolean[];
-
-  overflow_bytes?: number[];
-
-  sha1?: string[];
-
-  duration?: number[];
-
-  depth?: number[];
-
-  analyzers?: string[];
-
-  mime_type?: string[];
-
-  rx_host?: string[];
-
-  total_bytes?: number[];
-
-  fuid?: string[];
-
-  seen_bytes?: number[];
-
-  missing_bytes?: number[];
-
-  md5?: string[];
-}
-
-export interface ZeekSslData {
-  cipher?: string[];
-
-  established?: boolean[];
-
-  resumed?: boolean[];
-
-  version?: string[];
-}
diff --git a/x-pack/plugins/timelines/common/search_strategy/timeline/events/all/index.ts b/x-pack/plugins/timelines/common/search_strategy/timeline/events/all/index.ts
index 2fa24cc2466cec..ff8a61602239c3 100644
--- a/x-pack/plugins/timelines/common/search_strategy/timeline/events/all/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/timeline/events/all/index.ts
@@ -9,7 +9,7 @@ import { JsonObject } from '@kbn/utility-types';
 
 import { MappingRuntimeFields } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { IEsSearchResponse } from '@kbn/data-plugin/common';
-import type { Ecs } from '../../../../ecs';
+import type { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import type { CursorType, Inspect, Maybe, PaginationInputPaginated } from '../../../common';
 import type { TimelineRequestOptionsPaginated } from '../..';
 
diff --git a/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts b/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
index ccc558e96bf341..036a7ddb8462f0 100644
--- a/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
@@ -8,9 +8,9 @@
 import { JsonObject } from '@kbn/utility-types';
 
 import type { IEsSearchResponse } from '@kbn/data-plugin/common';
+import { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { Inspect, Maybe } from '../../../common';
 import { TimelineRequestOptionsPaginated } from '../..';
-import { Ecs } from '../../../../ecs';
 
 export interface TimelineEventsDetailsItem {
   ariaRowindex?: Maybe<number>;
diff --git a/x-pack/plugins/timelines/common/types/timeline/actions/index.ts b/x-pack/plugins/timelines/common/types/timeline/actions/index.ts
index a4c24b6f78f56a..b2edb9f439ef33 100644
--- a/x-pack/plugins/timelines/common/types/timeline/actions/index.ts
+++ b/x-pack/plugins/timelines/common/types/timeline/actions/index.ts
@@ -8,7 +8,7 @@
 import { EuiDataGridColumn, EuiDataGridColumnCellActionProps } from '@elastic/eui';
 import { IFieldSubType } from '@kbn/es-query';
 import { ReactNode } from 'react';
-import { Ecs } from '../../../ecs';
+import { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { BrowserFields, TimelineNonEcsData } from '../../../search_strategy';
 
 export type ColumnHeaderType = 'not-filtered' | 'text-filter';
diff --git a/x-pack/plugins/timelines/common/types/timeline/cells/index.ts b/x-pack/plugins/timelines/common/types/timeline/cells/index.ts
index 923d9092f1c5b0..0ca7f97802ef5c 100644
--- a/x-pack/plugins/timelines/common/types/timeline/cells/index.ts
+++ b/x-pack/plugins/timelines/common/types/timeline/cells/index.ts
@@ -7,8 +7,8 @@
 
 import { EuiDataGridCellValueElementProps } from '@elastic/eui';
 import type { Filter } from '@kbn/es-query';
+import { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { ColumnHeaderOptions, RowRenderer } from '../..';
-import { Ecs } from '../../../ecs';
 import { BrowserFields, TimelineNonEcsData } from '../../../search_strategy';
 
 /** The following props are provided to the function called by `renderCellValue` */
diff --git a/x-pack/plugins/timelines/common/types/timeline/index.ts b/x-pack/plugins/timelines/common/types/timeline/index.ts
index ae3a5969f84c9d..b7973820763298 100644
--- a/x-pack/plugins/timelines/common/types/timeline/index.ts
+++ b/x-pack/plugins/timelines/common/types/timeline/index.ts
@@ -7,9 +7,9 @@
 
 import * as runtimeTypes from 'io-ts';
 
+import { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { unionWithNullType } from '../../utility_types';
 import { Direction } from '../../search_strategy';
-import { Ecs } from '../../ecs';
 
 export * from './actions';
 export * from './cells';
diff --git a/x-pack/plugins/timelines/common/types/timeline/rows/index.ts b/x-pack/plugins/timelines/common/types/timeline/rows/index.ts
index eba1ee787c4f9b..c4740c03e01c7d 100644
--- a/x-pack/plugins/timelines/common/types/timeline/rows/index.ts
+++ b/x-pack/plugins/timelines/common/types/timeline/rows/index.ts
@@ -5,8 +5,8 @@
  * 2.0.
  */
 
+import { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { RowRendererId } from '..';
-import { Ecs } from '../../../ecs';
 
 export interface RowRenderer {
   id: RowRendererId;
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/build_ecs_objects.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/build_ecs_objects.ts
index 621fa656cb406a..0f24be8526d052 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/build_ecs_objects.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/build_ecs_objects.ts
@@ -6,9 +6,9 @@
  */
 
 import { has, merge } from 'lodash/fp';
+import { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { EventHit } from '../../../../../common/search_strategy';
 import { ECS_METADATA_FIELDS, TIMELINE_EVENTS_FIELDS } from './constants';
-import { Ecs } from '../../../../../common/ecs';
 import { getTimestamp } from './get_timestamp';
 import { buildObjectRecursive } from './build_object_recursive';
 import { getNestedParentPath } from './get_nested_parent_path';
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/build_object_recursive.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/build_object_recursive.ts
index 2d7096a211a7f6..55284812d6d5a5 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/build_object_recursive.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/helpers/build_object_recursive.ts
@@ -7,7 +7,7 @@
 
 import { set } from '@kbn/safer-lodash-set';
 import { get } from 'lodash/fp';
-import { Ecs } from '../../../../../common/ecs';
+import { EcsSecurityExtension as Ecs } from '@kbn/securitysolution-ecs';
 import { Fields } from '../../../../../common/search_strategy';
 import { toStringArray } from '../../../../../common/utils/to_array';
 import { getNestedParentPath } from './get_nested_parent_path';
diff --git a/x-pack/plugins/timelines/tsconfig.json b/x-pack/plugins/timelines/tsconfig.json
index 1e18b5881ec610..288701db08c55a 100644
--- a/x-pack/plugins/timelines/tsconfig.json
+++ b/x-pack/plugins/timelines/tsconfig.json
@@ -20,6 +20,7 @@
     "@kbn/alerting-plugin",
     "@kbn/utility-types",
     "@kbn/es-query",
+    "@kbn/securitysolution-ecs",
     "@kbn/securitysolution-t-grid",
     "@kbn/rule-data-utils",
     "@kbn/rule-registry-plugin",
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/group6/alerts/alerts_compatibility.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/group6/alerts/alerts_compatibility.ts
index 343de21a3ebf52..3b710bdfd4287f 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/group6/alerts/alerts_compatibility.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/group6/alerts/alerts_compatibility.ts
@@ -12,7 +12,7 @@ import {
   DETECTION_ENGINE_QUERY_SIGNALS_URL,
   DETECTION_ENGINE_SIGNALS_MIGRATION_STATUS_URL,
 } from '@kbn/security-solution-plugin/common/constants';
-import { ThreatEcs } from '@kbn/security-solution-plugin/common/ecs/threat';
+import { ThreatEcs } from '@kbn/securitysolution-ecs';
 import {
   EqlRuleCreateProps,
   QueryRuleCreateProps,
diff --git a/x-pack/test/tsconfig.json b/x-pack/test/tsconfig.json
index 8c353849ed0899..b3be2d080e7fe0 100644
--- a/x-pack/test/tsconfig.json
+++ b/x-pack/test/tsconfig.json
@@ -113,5 +113,6 @@
     "@kbn/alerting-fixture-plugin",
     "@kbn/stdio-dev-helpers",
     "@kbn/alerting-api-integration-helpers",
+    "@kbn/securitysolution-ecs",
   ]
 }
diff --git a/yarn.lock b/yarn.lock
index 432eca0c8f1246..a540fd8ad5564d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3941,6 +3941,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/securitysolution-ecs@link:packages/kbn-securitysolution-ecs":
+  version "0.0.0"
+  uid ""
+
 "@kbn/securitysolution-es-utils@link:packages/kbn-securitysolution-es-utils":
   version "0.0.0"
   uid ""

From a31328cedbdf6ef4ef0b578f84d29278015a3c03 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 23 Jan 2023 11:18:01 -0700
Subject: [PATCH 14/54] Update dependency xstate to ^4.35.2 (main) (#148844)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index d7f814d3b4c93c..a494bb32a83528 100644
--- a/package.json
+++ b/package.json
@@ -708,7 +708,7 @@
     "vinyl": "^2.2.0",
     "whatwg-fetch": "^3.0.0",
     "xml2js": "^0.4.22",
-    "xstate": "^4.35.1",
+    "xstate": "^4.35.2",
     "xterm": "^5.0.0",
     "yauzl": "^2.10.0",
     "yazl": "^2.5.1"
diff --git a/yarn.lock b/yarn.lock
index a540fd8ad5564d..544b8a19e336f0 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -28553,10 +28553,10 @@ xpath@0.0.32:
   resolved "https://registry.yarnpkg.com/xpath/-/xpath-0.0.32.tgz#1b73d3351af736e17ec078d6da4b8175405c48af"
   integrity sha512-rxMJhSIoiO8vXcWvSifKqhvV96GjiD5wYb8/QHdoRyQvraTpp4IEv944nhGausZZ3u7dhQXteZuZbaqfpB7uYw==
 
-xstate@^4.35.1:
-  version "4.35.1"
-  resolved "https://registry.yarnpkg.com/xstate/-/xstate-4.35.1.tgz#f2ea205e6e47cca285336a8f44ef2c154c9629a5"
-  integrity sha512-imxk6+76HJRt7qHrUnWnAjaHHhAsUKoVa+PXkyaPd3Gll0VjZsy6/L+FkatIJnjI5Kpwp0R8k63KfIFnzVLskQ==
+xstate@^4.35.2:
+  version "4.35.2"
+  resolved "https://registry.yarnpkg.com/xstate/-/xstate-4.35.2.tgz#92916638e315c448f1d26e920273187907256817"
+  integrity sha512-5X7EyJv5OHHtGQwN7DsmCAbSnDs3Mxl1cXQ4PVaLwi+7p/RRapERnd1dFyHjYin+KQoLLfuXpl1dPBThgyIGNg==
 
 "xtend@>=4.0.0 <4.1.0-0", xtend@^4.0.0, xtend@^4.0.1, xtend@^4.0.2, xtend@~4.0.0, xtend@~4.0.1:
   version "4.0.2"

From a78fece18b6a3af6e680a2456dc0f8089d924c5c Mon Sep 17 00:00:00 2001
From: Jonathan Buttner <56361221+jonathan-buttner@users.noreply.github.com>
Date: Mon, 23 Jan 2023 13:25:41 -0500
Subject: [PATCH 15/54] [Cases] Adding _find API for user actions (#148861)

This PR adds a new find API for retrieving a subset of the user actions
for a case.

Issue: https://github.com/elastic/kibana/issues/134344

```
GET /api/cases/<case_id>/user_actions/_find
Query Paramaters
{
  types?: Array of "assignees" | "comment" | "connector" | "description" | "pushed" | "tags" | "title" | "status" | "settings" | "severity" | "create_case" | "delete_case" | "action" | "alert" | "user" | "attachment"
  sortOrder?: "asc" | "desc"
  page?: number as a string
  perPage?: number as a string
}
```

<details><summary>Example request and response</summary>

Request
```
curl --location --request GET 'http://localhost:5601/api/cases/8df5fe00-96b1-11ed-9341-471c9630b5ec/user_actions/_find?types=create_case&sortOrder=asc' \
--header 'kbn-xsrf: hello' \
--header 'Authorization: Basic ZWxhc3RpYzpjaGFuZ2VtZQ==' \
--data-raw ''
```


Response
```
{
    "userActions": [
        {
            "created_at": "2023-01-17T21:54:45.527Z",
            "created_by": {
                "username": "elastic",
                "full_name": null,
                "email": null,
                "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
            },
            "owner": "cases",
            "action": "create",
            "payload": {
                "title": "Awesome case",
                "tags": [],
                "severity": "low",
                "description": "super",
                "assignees": [],
                "connector": {
                    "name": "none",
                    "type": ".none",
                    "fields": null,
                    "id": "none"
                },
                "settings": {
                    "syncAlerts": false
                },
                "owner": "cases",
                "status": "open"
            },
            "type": "create_case",
            "id": "8e121180-96b1-11ed-9341-471c9630b5ec",
            "case_id": "8df5fe00-96b1-11ed-9341-471c9630b5ec",
            "comment_id": null
        }
    ],
    "page": 1,
    "perPage": 20,
    "total": 1
}
```

</details>

## Notable Changes
- Created the new `_find` route
- Created a new `UserActionFinder` class and moved the find* methods
from the `index.ts` file into there as well as the new find logic
- Extracted the transform logic to its own file since its shared between
multiple files now
- Extracted the user action related integration test functions to the
`user_action.ts` utility file

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: lcawl <lcawley@elastic.co>
---
 .../cases/case-apis-passthru.asciidoc         | 127 ++-
 docs/user/security/audit-logging.asciidoc     |   9 +
 .../common/api/cases/user_actions/common.ts   |  21 +
 .../common/api/cases/user_actions/index.ts    |  75 +-
 .../api/cases/user_actions/operations/find.ts |  45 +
 .../cases/user_actions/operations/index.ts    |   8 +
 .../common/api/cases/user_actions/response.ts | 111 +++
 x-pack/plugins/cases/common/api/helpers.ts    |   5 +
 x-pack/plugins/cases/common/constants.ts      |   1 +
 x-pack/plugins/cases/docs/openapi/README.md   |  10 +-
 .../plugins/cases/docs/openapi/bundled.json   | 351 ++++++-
 .../plugins/cases/docs/openapi/bundled.yaml   | 241 ++++-
 .../examples/find_case_activity_response.yaml |  64 ++
 ...user_actions_find_response_properties.yaml |  69 ++
 .../user_actions_response_properties.yaml     |   2 +-
 .../cases/docs/openapi/entrypoint.yaml        |   2 +
 .../paths/s@{spaceid}@api@cases@_find.yaml    |  24 +-
 ...api@cases@{caseid}@user_actions@_find.yaml |  91 ++
 .../__snapshots__/audit_logger.test.ts.snap   |  84 ++
 .../cases/server/authorization/index.ts       |   8 +
 .../cases/server/authorization/types.ts       |   1 +
 x-pack/plugins/cases/server/client/client.ts  |   2 +-
 .../client/metrics/get_case_metrics.test.ts   |   2 +-
 .../server/client/metrics/lifespan.test.ts    |  37 +-
 .../cases/server/client/metrics/lifespan.ts   |   8 +-
 .../client/metrics/test_utils/lifespan.ts     |   9 +-
 x-pack/plugins/cases/server/client/mocks.ts   |   1 +
 .../server/client/user_actions/client.ts      |  26 +-
 .../server/client/user_actions/connectors.ts  |  12 +-
 .../cases/server/client/user_actions/find.ts  |  79 ++
 .../cases/server/client/user_actions/get.ts   |  10 +-
 .../cases/server/client/user_actions/types.ts |   7 +
 .../cases/server/client/user_actions/utils.ts |  25 +
 x-pack/plugins/cases/server/client/utils.ts   |  18 +-
 .../server/routes/api/get_external_routes.ts  |   2 +
 .../api/user_actions/find_user_actions.ts     |  40 +
 x-pack/plugins/cases/server/services/mocks.ts |  24 +-
 .../__snapshots__/transform.test.ts.snap      | 333 +++++++
 .../services/user_actions/index.test.ts       | 600 +-----------
 .../server/services/user_actions/index.ts     | 217 +----
 .../services/user_actions/operations/find.ts  | 228 +++++
 .../services/user_actions/test_utils.ts       | 286 ++++++
 .../services/user_actions/transform.test.ts   | 229 +++++
 .../server/services/user_actions/transform.ts | 200 ++++
 .../server/services/user_actions/types.ts     |  11 +-
 x-pack/plugins/cases/tsconfig.json            |   1 +
 .../common/lib/user_actions.ts                |  70 ++
 .../cases_api_integration/common/lib/utils.ts |  33 +-
 .../external_references.ts                    |   2 +-
 .../persistable_state.ts                      |   2 +-
 .../tests/common/cases/delete_cases.ts        |   2 +-
 .../tests/common/cases/import_export.ts       |   2 +-
 .../tests/common/cases/patch_cases.ts         |   6 +-
 .../tests/common/cases/post_case.ts           |   6 +-
 .../tests/common/comments/post_comment.ts     |   6 +-
 .../security_and_spaces/tests/common/index.ts |   1 +
 .../internal/bulk_create_attachments.ts       |   6 +-
 .../common/user_actions/find_user_actions.ts  | 920 ++++++++++++++++++
 .../user_actions/get_all_user_actions.ts      |  19 +-
 .../tests/common/user_actions/migrations.ts   |   3 +-
 .../cases/user_actions/find_user_actions.ts   | 120 +++
 .../user_actions/get_all_user_actions.ts      |   2 +-
 .../security_and_spaces/tests/trial/index.ts  |   1 +
 .../tests/trial/internal/get_connectors.ts    |   2 +-
 .../tests/trial/user_profiles/get_current.ts  |   2 +-
 .../user_actions/get_all_user_actions.ts      |   8 +-
 66 files changed, 3948 insertions(+), 1021 deletions(-)
 create mode 100644 x-pack/plugins/cases/common/api/cases/user_actions/operations/find.ts
 create mode 100644 x-pack/plugins/cases/common/api/cases/user_actions/operations/index.ts
 create mode 100644 x-pack/plugins/cases/common/api/cases/user_actions/response.ts
 create mode 100644 x-pack/plugins/cases/docs/openapi/components/examples/find_case_activity_response.yaml
 create mode 100644 x-pack/plugins/cases/docs/openapi/components/schemas/user_actions_find_response_properties.yaml
 create mode 100644 x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@user_actions@_find.yaml
 create mode 100644 x-pack/plugins/cases/server/client/user_actions/find.ts
 create mode 100644 x-pack/plugins/cases/server/client/user_actions/utils.ts
 create mode 100644 x-pack/plugins/cases/server/routes/api/user_actions/find_user_actions.ts
 create mode 100644 x-pack/plugins/cases/server/services/user_actions/__snapshots__/transform.test.ts.snap
 create mode 100644 x-pack/plugins/cases/server/services/user_actions/operations/find.ts
 create mode 100644 x-pack/plugins/cases/server/services/user_actions/test_utils.ts
 create mode 100644 x-pack/plugins/cases/server/services/user_actions/transform.test.ts
 create mode 100644 x-pack/plugins/cases/server/services/user_actions/transform.ts
 create mode 100644 x-pack/test/cases_api_integration/common/lib/user_actions.ts
 create mode 100644 x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/find_user_actions.ts
 create mode 100644 x-pack/test/cases_api_integration/security_and_spaces/tests/trial/cases/user_actions/find_user_actions.ts

diff --git a/docs/api-generated/cases/case-apis-passthru.asciidoc b/docs/api-generated/cases/case-apis-passthru.asciidoc
index b95159d606ab18..5801fe57ec0750 100644
--- a/docs/api-generated/cases/case-apis-passthru.asciidoc
+++ b/docs/api-generated/cases/case-apis-passthru.asciidoc
@@ -23,6 +23,7 @@ Any modifications made to this file will be overwritten.
   <li><a href="#deleteCase"><code><span class="http-method">delete</span> /s/{spaceId}/api/cases</code></a></li>
   <li><a href="#deleteCaseComment"><code><span class="http-method">delete</span> /s/{spaceId}/api/cases/{caseId}/comments/{commentId}</code></a></li>
   <li><a href="#deleteCaseComments"><code><span class="http-method">delete</span> /s/{spaceId}/api/cases/{caseId}/comments</code></a></li>
+  <li><a href="#findCaseActivity"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/user_actions/_find</code></a></li>
   <li><a href="#getAllCaseComments"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/comments</code></a></li>
   <li><a href="#getCase"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}</code></a></li>
   <li><a href="#getCaseActivity"><code><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/user_actions</code></a></li>
@@ -435,6 +436,102 @@ Any modifications made to this file will be overwritten.
         <a href="#4xx_response">4xx_response</a>
   </div> <!-- method -->
   <hr/>
+  <div class="method"><a name="findCaseActivity"/>
+    <div class="method-path">
+    <a class="up" href="#__Methods">Up</a>
+    <pre class="get"><code class="huge"><span class="http-method">get</span> /s/{spaceId}/api/cases/{caseId}/user_actions/_find</code></pre></div>
+    <div class="method-summary">Finds user activity for a case. (<span class="nickname">findCaseActivity</span>)</div>
+    <div class="method-notes">You must have <code>read</code> privileges for the <strong>Cases</strong> feature in the <strong>Management</strong>, <strong>Observability</strong>, or <strong>Security</strong> section of the Kibana feature privileges, depending on the owner of the case you're seeking.</div>
+
+    <h3 class="field-label">Path parameters</h3>
+    <div class="field-items">
+      <div class="param">caseId (required)</div>
+
+      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; The identifier for the case. To retrieve case IDs, use the find cases API. All non-ASCII characters must be URL encoded. default: null </div><div class="param">spaceId (required)</div>
+
+      <div class="param-desc"><span class="param-type">Path Parameter</span> &mdash; An identifier for the space. If <code>/s/</code> and the identifier are omitted from the path, the default space is used. default: null </div>
+    </div>  <!-- field-items -->
+
+
+
+
+    <h3 class="field-label">Query parameters</h3>
+    <div class="field-items">
+      <div class="param">page (optional)</div>
+
+      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">perPage (optional)</div>
+
+      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of user actions to return per page. default: 20 </div><div class="param">sortOrder (optional)</div>
+
+      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the sort order. default: asc </div><div class="param">types (optional)</div>
+
+      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the types of user actions to return. default: null </div>
+    </div>  <!-- field-items -->
+
+
+    <h3 class="field-label">Return type</h3>
+    <div class="return-type">
+      <a href="#findCaseActivity_200_response">findCaseActivity_200_response</a>
+      
+    </div>
+
+    <!--Todo: process Response Object and its headers, schema, examples -->
+
+    <h3 class="field-label">Example data</h3>
+    <div class="example-data-content-type">Content-Type: application/json</div>
+    <pre class="example"><code>{
+  "userActions" : [ {
+    "owner" : "cases",
+    "case_id" : "22df07d0-03b1-11ed-920c-974bfa104448",
+    "action" : "create",
+    "created_at" : "2022-05-13T09:16:17.416Z",
+    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
+    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
+    "type" : "create_case",
+    "created_by" : {
+      "full_name" : "full_name",
+      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
+      "email" : "email",
+      "username" : "elastic"
+    },
+    "version" : "WzM1ODg4LDFd"
+  }, {
+    "owner" : "cases",
+    "case_id" : "22df07d0-03b1-11ed-920c-974bfa104448",
+    "action" : "create",
+    "created_at" : "2022-05-13T09:16:17.416Z",
+    "id" : "22fd3e30-03b1-11ed-920c-974bfa104448",
+    "comment_id" : "578608d0-03b1-11ed-920c-974bfa104448",
+    "type" : "create_case",
+    "created_by" : {
+      "full_name" : "full_name",
+      "profile_uid" : "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0",
+      "email" : "email",
+      "username" : "elastic"
+    },
+    "version" : "WzM1ODg4LDFd"
+  } ],
+  "total" : 1,
+  "perPage" : 6,
+  "page" : 0
+}</code></pre>
+
+    <h3 class="field-label">Produces</h3>
+    This API call produces the following media types according to the <span class="header">Accept</span> request header;
+    the media type will be conveyed by the <span class="header">Content-Type</span> response header.
+    <ul>
+      <li><code>application/json</code></li>
+    </ul>
+
+    <h3 class="field-label">Responses</h3>
+    <h4 class="field-label">200</h4>
+    Indicates a successful call.
+        <a href="#findCaseActivity_200_response">findCaseActivity_200_response</a>
+    <h4 class="field-label">401</h4>
+    Authorization information is missing or invalid.
+        <a href="#4xx_response">4xx_response</a>
+  </div> <!-- method -->
+  <hr/>
   <div class="method"><a name="getAllCaseComments"/>
     <div class="method-path">
     <a class="up" href="#__Methods">Up</a>
@@ -1162,7 +1259,7 @@ Any modifications made to this file will be overwritten.
 
       <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">perPage (optional)</div>
 
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of rules to return per page. default: 20 </div><div class="param">reporters (optional)</div>
+      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of cases to return per page. default: 20 </div><div class="param">reporters (optional)</div>
 
       <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by the user name of the reporter. default: null </div><div class="param">search (optional)</div>
 
@@ -1998,6 +2095,7 @@ Any modifications made to this file will be overwritten.
     <li><a href="#create_case_request"><code>create_case_request</code> - Create case request</a></li>
     <li><a href="#create_case_request_connector"><code>create_case_request_connector</code> - </a></li>
     <li><a href="#external_service"><code>external_service</code> - </a></li>
+    <li><a href="#findCaseActivity_200_response"><code>findCaseActivity_200_response</code> - </a></li>
     <li><a href="#getCaseComment_200_response"><code>getCaseComment_200_response</code> - </a></li>
     <li><a href="#getCaseConfiguration_200_response_inner"><code>getCaseConfiguration_200_response_inner</code> - </a></li>
     <li><a href="#getCaseConfiguration_200_response_inner_connector"><code>getCaseConfiguration_200_response_inner_connector</code> - </a></li>
@@ -2043,6 +2141,7 @@ Any modifications made to this file will be overwritten.
     <li><a href="#update_case_request"><code>update_case_request</code> - Update case request</a></li>
     <li><a href="#update_case_request_cases_inner"><code>update_case_request_cases_inner</code> - </a></li>
     <li><a href="#update_user_comment_request_properties"><code>update_user_comment_request_properties</code> - Update case comment request properties for user comments</a></li>
+    <li><a href="#user_actions_find_response_properties"><code>user_actions_find_response_properties</code> - </a></li>
     <li><a href="#user_actions_response_properties"><code>user_actions_response_properties</code> - </a></li>
     <li><a href="#user_actions_response_properties_created_by"><code>user_actions_response_properties_created_by</code> - </a></li>
     <li><a href="#user_actions_response_properties_payload"><code>user_actions_response_properties_payload</code> - </a></li>
@@ -2450,6 +2549,16 @@ Any modifications made to this file will be overwritten.
 <div class="param">pushed_by (optional)</div><div class="param-desc"><span class="param-type"><a href="#getCaseConfiguration_200_response_inner_updated_by">getCaseConfiguration_200_response_inner_updated_by</a></span>  </div>
     </div>  <!-- field-items -->
   </div>
+  <div class="model">
+    <h3><a name="findCaseActivity_200_response"><code>findCaseActivity_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
+    <div class='model-description'></div>
+    <div class="field-items">
+      <div class="param">page (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
+<div class="param">perPage (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
+<div class="param">total (optional)</div><div class="param-desc"><span class="param-type"><a href="#integer">Integer</a></span>  </div>
+<div class="param">userActions (optional)</div><div class="param-desc"><span class="param-type"><a href="#user_actions_find_response_properties">array[user_actions_find_response_properties]</a></span>  </div>
+    </div>  <!-- field-items -->
+  </div>
   <div class="model">
     <h3><a name="getCaseComment_200_response"><code>getCaseComment_200_response</code> - </a> <a class="up" href="#__Models">Up</a></h3>
     <div class='model-description'></div>
@@ -2887,6 +2996,22 @@ Any modifications made to this file will be overwritten.
 <div class="param">version </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The current comment version. To retrieve version values, use the get comments API. </div>
     </div>  <!-- field-items -->
   </div>
+  <div class="model">
+    <h3><a name="user_actions_find_response_properties"><code>user_actions_find_response_properties</code> - </a> <a class="up" href="#__Models">Up</a></h3>
+    <div class='model-description'></div>
+    <div class="field-items">
+      <div class="param">action </div><div class="param-desc"><span class="param-type"><a href="#actions">actions</a></span>  </div>
+<div class="param">case_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
+<div class="param">comment_id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
+<div class="param">created_at </div><div class="param-desc"><span class="param-type"><a href="#DateTime">Date</a></span>  format: date-time</div>
+<div class="param">created_by </div><div class="param-desc"><span class="param-type"><a href="#user_actions_response_properties_created_by">user_actions_response_properties_created_by</a></span>  </div>
+<div class="param">id </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
+<div class="param">owner </div><div class="param-desc"><span class="param-type"><a href="#owners">owners</a></span>  </div>
+<div class="param">payload </div><div class="param-desc"><span class="param-type"><a href="#user_actions_response_properties_payload">user_actions_response_properties_payload</a></span>  </div>
+<div class="param">version </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span>  </div>
+<div class="param">type </div><div class="param-desc"><span class="param-type"><a href="#action_types">action_types</a></span>  </div>
+    </div>  <!-- field-items -->
+  </div>
   <div class="model">
     <h3><a name="user_actions_response_properties"><code>user_actions_response_properties</code> - </a> <a class="up" href="#__Models">Up</a></h3>
     <div class='model-description'></div>
diff --git a/docs/user/security/audit-logging.asciidoc b/docs/user/security/audit-logging.asciidoc
index 7605573c71a0f7..68bc507cc846c0 100644
--- a/docs/user/security/audit-logging.asciidoc
+++ b/docs/user/security/audit-logging.asciidoc
@@ -400,10 +400,19 @@ Refer to the corresponding {es} logs for potential write errors.
 | `success` | User has accessed the user activity of a case.
 | `failure` | User is not authorized to access the user activity of a case.
 
+
+.2+| `case_user_actions_find`
+| `success` | User has accessed the user activity of a case as part of a search operation.
+| `failure` | User is not authorized to access the user activity of a case.
+
 .2+| `case_user_action_get_metrics`
 | `success` | User has accessed metrics for the user activity of a case.
 | `failure` | User is not authorized to access metrics for the user activity of a case.
 
+.2+| `case_connectors_get`
+| `success` | User has accessed the connectors of a case.
+| `failure` | User is not authorized to access the connectors of a case.
+
 3+a|
 ===== Category: web
 
diff --git a/x-pack/plugins/cases/common/api/cases/user_actions/common.ts b/x-pack/plugins/cases/common/api/cases/user_actions/common.ts
index 7e302ade2bcca1..efcdbea0030be4 100644
--- a/x-pack/plugins/cases/common/api/cases/user_actions/common.ts
+++ b/x-pack/plugins/cases/common/api/cases/user_actions/common.ts
@@ -8,6 +8,10 @@
 import * as rt from 'io-ts';
 import { UserRT } from '../../user';
 
+/**
+ * These values are used in a number of places including to define the accepted values in the
+ * user_actions/_find api. These values should not be removed only new values can be added.
+ */
 export const ActionTypes = {
   assignees: 'assignees',
   comment: 'comment',
@@ -43,6 +47,10 @@ export const UserActionCommonAttributesRt = rt.type({
   action: ActionsRt,
 });
 
+/**
+ * This should only be used for the getAll route and it should be removed when the route is removed
+ * @deprecated use CaseUserActionInjectedIdsRt instead
+ */
 export const CaseUserActionSavedObjectIdsRt = rt.type({
   action_id: rt.string,
   case_id: rt.string,
@@ -51,3 +59,16 @@ export const CaseUserActionSavedObjectIdsRt = rt.type({
 
 export type UserActionWithAttributes<T> = T & rt.TypeOf<typeof UserActionCommonAttributesRt>;
 export type UserActionWithResponse<T> = T & rt.TypeOf<typeof CaseUserActionSavedObjectIdsRt>;
+
+/**
+ * This should be used for all user action types going forward it will be renamed to CaseUserActionSavedObjectIdsRt
+ * Once the UI is switched to using the new user actions _find API
+ */
+export const CaseUserActionInjectedIdsRt = rt.type({
+  comment_id: rt.union([rt.string, rt.null]),
+});
+
+/**
+ * Temporary type until CaseUserActionInjectedIdsRt replaces CaseUserActionSavedObjectIdsRt
+ */
+export type UserActionWithResponseInjection<T> = T & rt.TypeOf<typeof CaseUserActionInjectedIdsRt>;
diff --git a/x-pack/plugins/cases/common/api/cases/user_actions/index.ts b/x-pack/plugins/cases/common/api/cases/user_actions/index.ts
index 2fd840e4532cd3..9dcb8dba887892 100644
--- a/x-pack/plugins/cases/common/api/cases/user_actions/index.ts
+++ b/x-pack/plugins/cases/common/api/cases/user_actions/index.ts
@@ -5,23 +5,6 @@
  * 2.0.
  */
 
-import * as rt from 'io-ts';
-
-import type { ActionsRt, ActionTypeValues } from './common';
-import { UserActionCommonAttributesRt, CaseUserActionSavedObjectIdsRt } from './common';
-import { CreateCaseUserActionRt } from './create_case';
-import { DescriptionUserActionRt } from './description';
-import { CommentUserActionRt } from './comment';
-import { ConnectorUserActionRt } from './connector';
-import { PushedUserActionRt } from './pushed';
-import { TagsUserActionRt } from './tags';
-import { TitleUserActionRt } from './title';
-import { SettingsUserActionRt } from './settings';
-import { StatusUserActionRt } from './status';
-import { DeleteCaseUserActionRt } from './delete_case';
-import { SeverityUserActionRt } from './severity';
-import { AssigneesUserActionRt } from './assignees';
-
 export * from './common';
 export * from './comment';
 export * from './connector';
@@ -34,59 +17,5 @@ export * from './status';
 export * from './tags';
 export * from './title';
 export * from './assignees';
-
-const CommonUserActionsRt = rt.union([
-  DescriptionUserActionRt,
-  CommentUserActionRt,
-  TagsUserActionRt,
-  TitleUserActionRt,
-  SettingsUserActionRt,
-  StatusUserActionRt,
-  SeverityUserActionRt,
-  AssigneesUserActionRt,
-]);
-
-export const UserActionsRt = rt.union([
-  CommonUserActionsRt,
-  CreateCaseUserActionRt,
-  ConnectorUserActionRt,
-  PushedUserActionRt,
-  DeleteCaseUserActionRt,
-]);
-
-export const UserActionsWithoutConnectorIdRt = rt.union([
-  CommonUserActionsRt,
-  CreateCaseUserActionRt,
-  ConnectorUserActionRt,
-  PushedUserActionRt,
-  DeleteCaseUserActionRt,
-]);
-
-const CaseUserActionBasicRt = rt.intersection([UserActionsRt, UserActionCommonAttributesRt]);
-const CaseUserActionBasicWithoutConnectorIdRt = rt.intersection([
-  UserActionsWithoutConnectorIdRt,
-  UserActionCommonAttributesRt,
-]);
-
-const CaseUserActionResponseRt = rt.intersection([
-  CaseUserActionBasicRt,
-  CaseUserActionSavedObjectIdsRt,
-]);
-
-export const CaseUserActionAttributesRt = CaseUserActionBasicRt;
-export const CaseUserActionsResponseRt = rt.array(CaseUserActionResponseRt);
-
-export type CaseUserActionAttributes = rt.TypeOf<typeof CaseUserActionAttributesRt>;
-export type CaseUserActionAttributesWithoutConnectorId = rt.TypeOf<
-  typeof CaseUserActionAttributesRt
->;
-export type CaseUserActionsResponse = rt.TypeOf<typeof CaseUserActionsResponseRt>;
-export type CaseUserActionResponse = rt.TypeOf<typeof CaseUserActionResponseRt>;
-
-export type UserAction = rt.TypeOf<typeof ActionsRt>;
-export type UserActionTypes = ActionTypeValues;
-
-export type CaseUserAction = rt.TypeOf<typeof CaseUserActionBasicRt>;
-export type CaseUserActionWithoutConnectorId = rt.TypeOf<
-  typeof CaseUserActionBasicWithoutConnectorIdRt
->;
+export * from './operations';
+export * from './response';
diff --git a/x-pack/plugins/cases/common/api/cases/user_actions/operations/find.ts b/x-pack/plugins/cases/common/api/cases/user_actions/operations/find.ts
new file mode 100644
index 00000000000000..062fce38978d7c
--- /dev/null
+++ b/x-pack/plugins/cases/common/api/cases/user_actions/operations/find.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as rt from 'io-ts';
+import { CaseUserActionsResponseWithoutActionIdRt } from '../response';
+import { ActionTypes } from '../common';
+import { NumberFromString } from '../../../saved_object';
+
+const AdditionalFilterTypes = {
+  action: 'action',
+  alert: 'alert',
+  user: 'user',
+  attachment: 'attachment',
+} as const;
+
+export const FindTypes = {
+  ...ActionTypes,
+  ...AdditionalFilterTypes,
+} as const;
+
+const FindTypeFieldRt = rt.keyof(FindTypes);
+
+export type FindTypeField = rt.TypeOf<typeof FindTypeFieldRt>;
+
+export const UserActionFindRequestRt = rt.partial({
+  types: rt.array(FindTypeFieldRt),
+  sortOrder: rt.union([rt.literal('desc'), rt.literal('asc')]),
+  page: NumberFromString,
+  perPage: NumberFromString,
+});
+
+export type UserActionFindRequest = rt.TypeOf<typeof UserActionFindRequestRt>;
+
+export const UserActionFindResponseRt = rt.type({
+  userActions: CaseUserActionsResponseWithoutActionIdRt,
+  page: rt.number,
+  perPage: rt.number,
+  total: rt.number,
+});
+
+export type UserActionFindResponse = rt.TypeOf<typeof UserActionFindResponseRt>;
diff --git a/x-pack/plugins/cases/common/api/cases/user_actions/operations/index.ts b/x-pack/plugins/cases/common/api/cases/user_actions/operations/index.ts
new file mode 100644
index 00000000000000..b72f461560fe24
--- /dev/null
+++ b/x-pack/plugins/cases/common/api/cases/user_actions/operations/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './find';
diff --git a/x-pack/plugins/cases/common/api/cases/user_actions/response.ts b/x-pack/plugins/cases/common/api/cases/user_actions/response.ts
new file mode 100644
index 00000000000000..4d0a0ae3d34a4a
--- /dev/null
+++ b/x-pack/plugins/cases/common/api/cases/user_actions/response.ts
@@ -0,0 +1,111 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as rt from 'io-ts';
+
+import type { ActionsRt, ActionTypeValues } from './common';
+import {
+  CaseUserActionInjectedIdsRt,
+  CaseUserActionSavedObjectIdsRt,
+  UserActionCommonAttributesRt,
+} from './common';
+import { CreateCaseUserActionRt } from './create_case';
+import { DescriptionUserActionRt } from './description';
+import { CommentUserActionRt } from './comment';
+import { ConnectorUserActionRt } from './connector';
+import { PushedUserActionRt } from './pushed';
+import { TagsUserActionRt } from './tags';
+import { TitleUserActionRt } from './title';
+import { SettingsUserActionRt } from './settings';
+import { StatusUserActionRt } from './status';
+import { DeleteCaseUserActionRt } from './delete_case';
+import { SeverityUserActionRt } from './severity';
+import { AssigneesUserActionRt } from './assignees';
+
+const CommonUserActionsRt = rt.union([
+  DescriptionUserActionRt,
+  CommentUserActionRt,
+  TagsUserActionRt,
+  TitleUserActionRt,
+  SettingsUserActionRt,
+  StatusUserActionRt,
+  SeverityUserActionRt,
+  AssigneesUserActionRt,
+]);
+
+export const UserActionsRt = rt.union([
+  CommonUserActionsRt,
+  CreateCaseUserActionRt,
+  ConnectorUserActionRt,
+  PushedUserActionRt,
+  DeleteCaseUserActionRt,
+]);
+
+export const UserActionsWithoutConnectorIdRt = rt.union([
+  CommonUserActionsRt,
+  CreateCaseUserActionRt,
+  ConnectorUserActionRt,
+  PushedUserActionRt,
+  DeleteCaseUserActionRt,
+]);
+
+const CaseUserActionBasicRt = rt.intersection([UserActionsRt, UserActionCommonAttributesRt]);
+const CaseUserActionBasicWithoutConnectorIdRt = rt.intersection([
+  UserActionsWithoutConnectorIdRt,
+  UserActionCommonAttributesRt,
+]);
+
+const CaseUserActionResponseRt = rt.intersection([
+  CaseUserActionBasicRt,
+  CaseUserActionSavedObjectIdsRt,
+]);
+
+/**
+ * This includes the comment_id but not the action_id or case_id
+ */
+const CaseUserActionInjectedAttributesWithoutActionIdRt = rt.intersection([
+  CaseUserActionBasicRt,
+  CaseUserActionInjectedIdsRt,
+]);
+
+/**
+ * Rename to CaseUserActionResponseRt when the UI is switching to the new user action _find API
+ */
+const CaseUserActionResponseWithoutActionIdRt = rt.intersection([
+  CaseUserActionInjectedAttributesWithoutActionIdRt,
+  rt.type({
+    id: rt.string,
+    version: rt.string,
+  }),
+]);
+
+export const CaseUserActionAttributesRt = CaseUserActionBasicRt;
+export const CaseUserActionsResponseRt = rt.array(CaseUserActionResponseRt);
+export const CaseUserActionsResponseWithoutActionIdRt = rt.array(
+  CaseUserActionResponseWithoutActionIdRt
+);
+
+export type CaseUserActionAttributes = rt.TypeOf<typeof CaseUserActionAttributesRt>;
+export type CaseUserActionAttributesWithoutConnectorId = rt.TypeOf<
+  typeof CaseUserActionAttributesRt
+>;
+export type CaseUserActionsResponse = rt.TypeOf<typeof CaseUserActionsResponseRt>;
+export type CaseUserActionResponse = rt.TypeOf<typeof CaseUserActionResponseRt>;
+export type CaseUserActionInjectedAttributesWithoutActionId = rt.TypeOf<
+  typeof CaseUserActionInjectedAttributesWithoutActionIdRt
+>;
+export type CaseUserActionsResponseWithoutActionId = rt.TypeOf<
+  typeof CaseUserActionsResponseWithoutActionIdRt
+>;
+
+export type UserAction = rt.TypeOf<typeof ActionsRt>;
+export type UserActionTypes = ActionTypeValues;
+
+export type CaseUserAction = rt.TypeOf<typeof CaseUserActionBasicRt>;
+export type CaseUserActionWithoutConnectorId = rt.TypeOf<
+  typeof CaseUserActionBasicWithoutConnectorIdRt
+>;
diff --git a/x-pack/plugins/cases/common/api/helpers.ts b/x-pack/plugins/cases/common/api/helpers.ts
index 0fe187389cae1d..2f2fe14a4f991e 100644
--- a/x-pack/plugins/cases/common/api/helpers.ts
+++ b/x-pack/plugins/cases/common/api/helpers.ts
@@ -15,6 +15,7 @@ import {
   CASE_CONFIGURE_DETAILS_URL,
   CASE_ALERTS_URL,
   CASE_COMMENT_DELETE_URL,
+  CASE_FIND_USER_ACTIONS_URL,
 } from '../constants';
 
 export const getCaseDetailsUrl = (id: string): string => {
@@ -41,6 +42,10 @@ export const getCaseUserActionUrl = (id: string): string => {
   return CASE_USER_ACTIONS_URL.replace('{case_id}', id);
 };
 
+export const getCaseFindUserActionsUrl = (id: string): string => {
+  return CASE_FIND_USER_ACTIONS_URL.replace('{case_id}', id);
+};
+
 export const getCasePushUrl = (caseId: string, connectorId: string): string => {
   return CASE_PUSH_URL.replace('{case_id}', caseId).replace('{connector_id}', connectorId);
 };
diff --git a/x-pack/plugins/cases/common/constants.ts b/x-pack/plugins/cases/common/constants.ts
index 1f8d6031a1c56f..c1e65087224cf7 100644
--- a/x-pack/plugins/cases/common/constants.ts
+++ b/x-pack/plugins/cases/common/constants.ts
@@ -73,6 +73,7 @@ export const CASE_REPORTERS_URL = `${CASES_URL}/reporters` as const;
 export const CASE_STATUS_URL = `${CASES_URL}/status` as const;
 export const CASE_TAGS_URL = `${CASES_URL}/tags` as const;
 export const CASE_USER_ACTIONS_URL = `${CASE_DETAILS_URL}/user_actions` as const;
+export const CASE_FIND_USER_ACTIONS_URL = `${CASE_USER_ACTIONS_URL}/_find` as const;
 
 export const CASE_ALERTS_URL = `${CASES_URL}/alerts/{alert_id}` as const;
 export const CASE_DETAILS_ALERTS_URL = `${CASE_DETAILS_URL}/alerts` as const;
diff --git a/x-pack/plugins/cases/docs/openapi/README.md b/x-pack/plugins/cases/docs/openapi/README.md
index cf0ea6c76da7cf..fedb9635abc827 100644
--- a/x-pack/plugins/cases/docs/openapi/README.md
+++ b/x-pack/plugins/cases/docs/openapi/README.md
@@ -1,6 +1,6 @@
 # OpenAPI (Experimental)
 
-The current self-contained spec file is [as JSON](https://raw.githubusercontent.com/elastic/kibana/master/x-pack/plugins/cases/common/openapi/bundled.json) or [as YAML](https://raw.githubusercontent.com/elastic/kibana/master/x-pack/plugins/cases/common/openapi/bundled.yaml) and can be used for online tools like those found at https://openapi.tools/. 
+The current self-contained spec file is [as JSON](https://raw.githubusercontent.com/elastic/kibana/master/x-pack/plugins/cases/common/openapi/bundled.json) or [as YAML](https://raw.githubusercontent.com/elastic/kibana/master/x-pack/plugins/cases/common/openapi/bundled.yaml) and can be used for online tools like those found at <https://openapi.tools/>.
 This spec is experimental and may be incomplete or change later.
 
 A guide about the openApi specification can be found at [https://swagger.io/docs/specification/about/](https://swagger.io/docs/specification/about/).
@@ -16,19 +16,19 @@ A guide about the openApi specification can be found at [https://swagger.io/docs
 It is possible to validate the docs before bundling them with the following
 command in the `x-pack/plugins/cases/docs/openapi/` folder:
 
-  ```
+  ```bash
     npx swagger-cli validate entrypoint.yaml
   ```
 
 Then you can generate the `bundled` files by running the following commands:
 
-  ```
+  ```bash
     npx @redocly/cli bundle entrypoint.yaml --output bundled.yaml --ext yaml
     npx @redocly/cli bundle entrypoint.yaml --output bundled.json --ext json
   ```
 
-You can run additional linting with the following command:
+After generating the json bundle ensure that it is also valid by running the following command:
 
-  ```
+  ```bash
      npx @redocly/cli lint bundled.json
   ```
diff --git a/x-pack/plugins/cases/docs/openapi/bundled.json b/x-pack/plugins/cases/docs/openapi/bundled.json
index 3fad9872c07bf1..7260061d76b0b6 100644
--- a/x-pack/plugins/cases/docs/openapi/bundled.json
+++ b/x-pack/plugins/cases/docs/openapi/bundled.json
@@ -282,7 +282,7 @@
           {
             "name": "perPage",
             "in": "query",
-            "description": "The number of rules to return per page.",
+            "description": "The number of cases to return per page.",
             "schema": {
               "type": "integer",
               "default": 20
@@ -2089,6 +2089,141 @@
           "url": "https://localhost:5601"
         }
       ]
+    },
+    "/s/{spaceId}/api/cases/{caseId}/user_actions/_find": {
+      "get": {
+        "summary": "Finds user activity for a case.",
+        "description": "You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.\n",
+        "operationId": "findCaseActivity",
+        "tags": [
+          "cases"
+        ],
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/case_id"
+          },
+          {
+            "$ref": "#/components/parameters/space_id"
+          },
+          {
+            "name": "page",
+            "in": "query",
+            "description": "The page number to return.",
+            "schema": {
+              "type": "string",
+              "default": 1
+            },
+            "example": 1
+          },
+          {
+            "name": "perPage",
+            "in": "query",
+            "description": "The number of user actions to return per page.",
+            "schema": {
+              "type": "string",
+              "default": 20
+            },
+            "example": 20
+          },
+          {
+            "name": "sortOrder",
+            "in": "query",
+            "description": "Determines the sort order.",
+            "schema": {
+              "type": "string",
+              "enum": [
+                "asc",
+                "desc"
+              ],
+              "default": "asc"
+            },
+            "example": "asc"
+          },
+          {
+            "name": "types",
+            "in": "query",
+            "description": "Determines the types of user actions to return.",
+            "schema": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": [
+                  "action",
+                  "alert",
+                  "assignees",
+                  "attachment",
+                  "comment",
+                  "connector",
+                  "create_case",
+                  "description",
+                  "pushed",
+                  "settings",
+                  "severity",
+                  "status",
+                  "tags",
+                  "title",
+                  "user"
+                ]
+              }
+            },
+            "example": "create_case"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Indicates a successful call.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "page": {
+                      "type": "integer"
+                    },
+                    "perPage": {
+                      "type": "integer"
+                    },
+                    "total": {
+                      "type": "integer"
+                    },
+                    "userActions": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/user_actions_find_response_properties"
+                      }
+                    }
+                  }
+                },
+                "examples": {
+                  "findCaseActivityResponse": {
+                    "$ref": "#/components/examples/find_case_activity_response"
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Authorization information is missing or invalid.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/4xx_response"
+                }
+              }
+            }
+          }
+        },
+        "servers": [
+          {
+            "url": "https://localhost:5601"
+          }
+        ]
+      },
+      "servers": [
+        {
+          "url": "https://localhost:5601"
+        }
+      ]
     }
   },
   "components": {
@@ -4126,6 +4261,136 @@
             "$ref": "#/components/schemas/action_types"
           }
         }
+      },
+      "user_actions_find_response_properties": {
+        "type": "object",
+        "required": [
+          "action",
+          "comment_id",
+          "created_at",
+          "created_by",
+          "id",
+          "owner",
+          "payload",
+          "type",
+          "version"
+        ],
+        "properties": {
+          "action": {
+            "$ref": "#/components/schemas/actions"
+          },
+          "comment_id": {
+            "type": "string",
+            "nullable": true,
+            "example": "578608d0-03b1-11ed-920c-974bfa104448"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time",
+            "example": "2022-05-13T09:16:17.416Z"
+          },
+          "created_by": {
+            "type": "object",
+            "properties": {
+              "email": {
+                "type": "string",
+                "example": null,
+                "nullable": true
+              },
+              "full_name": {
+                "type": "string",
+                "example": null,
+                "nullable": true
+              },
+              "username": {
+                "type": "string",
+                "example": "elastic",
+                "nullable": true
+              },
+              "profile_uid": {
+                "type": "string",
+                "example": "u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0"
+              }
+            },
+            "required": [
+              "email",
+              "full_name",
+              "username"
+            ]
+          },
+          "id": {
+            "type": "string",
+            "example": "22fd3e30-03b1-11ed-920c-974bfa104448"
+          },
+          "owner": {
+            "$ref": "#/components/schemas/owners"
+          },
+          "payload": {
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/payload_alert_comment"
+              },
+              {
+                "$ref": "#/components/schemas/payload_assignees"
+              },
+              {
+                "$ref": "#/components/schemas/payload_connector"
+              },
+              {
+                "$ref": "#/components/schemas/payload_create_case"
+              },
+              {
+                "$ref": "#/components/schemas/payload_delete"
+              },
+              {
+                "$ref": "#/components/schemas/payload_description"
+              },
+              {
+                "$ref": "#/components/schemas/payload_pushed"
+              },
+              {
+                "$ref": "#/components/schemas/payload_settings"
+              },
+              {
+                "$ref": "#/components/schemas/payload_severity"
+              },
+              {
+                "$ref": "#/components/schemas/payload_status"
+              },
+              {
+                "$ref": "#/components/schemas/payload_tags"
+              },
+              {
+                "$ref": "#/components/schemas/payload_title"
+              },
+              {
+                "$ref": "#/components/schemas/payload_user_comment"
+              }
+            ]
+          },
+          "version": {
+            "type": "string",
+            "example": "WzM1ODg4LDFd"
+          },
+          "type": {
+            "type": "string",
+            "description": "The type of action.",
+            "enum": [
+              "assignees",
+              "create_case",
+              "comment",
+              "connector",
+              "description",
+              "pushed",
+              "tags",
+              "title",
+              "status",
+              "settings",
+              "severity"
+            ],
+            "example": "create_case"
+          }
+        }
       }
     },
     "examples": {
@@ -4838,6 +5103,90 @@
             "type": "delete_case"
           }
         ]
+      },
+      "find_case_activity_response": {
+        "summary": "Retrieves all activity for a case",
+        "value": {
+          "page": 1,
+          "perPage": 20,
+          "total": 4,
+          "userActions": [
+            {
+              "id": "b4cd0770-07c9-11ed-a5fd-47154cb8767e",
+              "action": "create",
+              "comment_id": "578608d0-03b1-11ed-920c-974bfa104448",
+              "created_at": "2022-07-20T01:17:22.150Z",
+              "created_by": {
+                "username": "elastic",
+                "email": null,
+                "full_name": null
+              },
+              "owner": "cases",
+              "payload": {
+                "assignees": null,
+                "connector": {
+                  "name": "none",
+                  "type": ".none",
+                  "fields": null,
+                  "id": "none"
+                },
+                "description": "test",
+                "tags": [
+                  "mine"
+                ],
+                "title": "test-case",
+                "owner": "cases",
+                "settings": {
+                  "syncAlerts": false
+                },
+                "severity": "low",
+                "status": "open",
+                "type": "create_case"
+              },
+              "version": "WzM1ODg4LDFd",
+              "type": "comment"
+            },
+            {
+              "id": "57af14a0-03b1-11ed-920c-974bfa104448",
+              "action": "create",
+              "comment_id": "578608d0-03b1-11ed-920c-974bfa104448",
+              "created_at": "2022-07-14T20:12:53.354Z",
+              "created_by": {
+                "username": "elastic",
+                "email": null,
+                "full_name": null
+              },
+              "owner": "cases",
+              "payload": {
+                "comment": "A new comment",
+                "owner": "cases",
+                "type": "user"
+              },
+              "version": "WzM1ODg4LDFa",
+              "type": "comment"
+            },
+            {
+              "id": "573c6980-6123-11ed-aa41-81a0a61fe447",
+              "action": "add",
+              "comment_id": null,
+              "created_at": "2022-07-20T01:10:28.238Z",
+              "created_by": {
+                "username": "elastic",
+                "email": null,
+                "full_name": null,
+                "profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
+              },
+              "owner": "cases",
+              "payload": {
+                "assignees": {
+                  "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
+                }
+              },
+              "version": "WzM1ODg4LDFb",
+              "type": "assignees"
+            }
+          ]
+        }
       }
     }
   },
diff --git a/x-pack/plugins/cases/docs/openapi/bundled.yaml b/x-pack/plugins/cases/docs/openapi/bundled.yaml
index 129bf13a79b48c..aa55e180191cb2 100644
--- a/x-pack/plugins/cases/docs/openapi/bundled.yaml
+++ b/x-pack/plugins/cases/docs/openapi/bundled.yaml
@@ -171,7 +171,7 @@ paths:
           example: 1
         - name: perPage
           in: query
-          description: The number of rules to return per page.
+          description: The number of cases to return per page.
           schema:
             type: integer
             default: 20
@@ -1293,6 +1293,96 @@ paths:
         - url: https://localhost:5601
     servers:
       - url: https://localhost:5601
+  /s/{spaceId}/api/cases/{caseId}/user_actions/_find:
+    get:
+      summary: Finds user activity for a case.
+      description: |
+        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.
+      operationId: findCaseActivity
+      tags:
+        - cases
+      parameters:
+        - $ref: '#/components/parameters/case_id'
+        - $ref: '#/components/parameters/space_id'
+        - name: page
+          in: query
+          description: The page number to return.
+          schema:
+            type: string
+            default: 1
+          example: 1
+        - name: perPage
+          in: query
+          description: The number of user actions to return per page.
+          schema:
+            type: string
+            default: 20
+          example: 20
+        - name: sortOrder
+          in: query
+          description: Determines the sort order.
+          schema:
+            type: string
+            enum:
+              - asc
+              - desc
+            default: asc
+          example: asc
+        - name: types
+          in: query
+          description: Determines the types of user actions to return.
+          schema:
+            type: array
+            items:
+              type: string
+              enum:
+                - action
+                - alert
+                - assignees
+                - attachment
+                - comment
+                - connector
+                - create_case
+                - description
+                - pushed
+                - settings
+                - severity
+                - status
+                - tags
+                - title
+                - user
+          example: create_case
+      responses:
+        '200':
+          description: Indicates a successful call.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  page:
+                    type: integer
+                  perPage:
+                    type: integer
+                  total:
+                    type: integer
+                  userActions:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/user_actions_find_response_properties'
+              examples:
+                findCaseActivityResponse:
+                  $ref: '#/components/examples/find_case_activity_response'
+        '401':
+          description: Authorization information is missing or invalid.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/4xx_response'
+      servers:
+        - url: https://localhost:5601
+    servers:
+      - url: https://localhost:5601
 components:
   securitySchemes:
     basicAuth:
@@ -2758,6 +2848,90 @@ components:
             - $ref: '#/components/schemas/payload_user_comment'
         type:
           $ref: '#/components/schemas/action_types'
+    user_actions_find_response_properties:
+      type: object
+      required:
+        - action
+        - comment_id
+        - created_at
+        - created_by
+        - id
+        - owner
+        - payload
+        - type
+        - version
+      properties:
+        action:
+          $ref: '#/components/schemas/actions'
+        comment_id:
+          type: string
+          nullable: true
+          example: 578608d0-03b1-11ed-920c-974bfa104448
+        created_at:
+          type: string
+          format: date-time
+          example: '2022-05-13T09:16:17.416Z'
+        created_by:
+          type: object
+          properties:
+            email:
+              type: string
+              example: null
+              nullable: true
+            full_name:
+              type: string
+              example: null
+              nullable: true
+            username:
+              type: string
+              example: elastic
+              nullable: true
+            profile_uid:
+              type: string
+              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
+          required:
+            - email
+            - full_name
+            - username
+        id:
+          type: string
+          example: 22fd3e30-03b1-11ed-920c-974bfa104448
+        owner:
+          $ref: '#/components/schemas/owners'
+        payload:
+          oneOf:
+            - $ref: '#/components/schemas/payload_alert_comment'
+            - $ref: '#/components/schemas/payload_assignees'
+            - $ref: '#/components/schemas/payload_connector'
+            - $ref: '#/components/schemas/payload_create_case'
+            - $ref: '#/components/schemas/payload_delete'
+            - $ref: '#/components/schemas/payload_description'
+            - $ref: '#/components/schemas/payload_pushed'
+            - $ref: '#/components/schemas/payload_settings'
+            - $ref: '#/components/schemas/payload_severity'
+            - $ref: '#/components/schemas/payload_status'
+            - $ref: '#/components/schemas/payload_tags'
+            - $ref: '#/components/schemas/payload_title'
+            - $ref: '#/components/schemas/payload_user_comment'
+        version:
+          type: string
+          example: WzM1ODg4LDFd
+        type:
+          type: string
+          description: The type of action.
+          enum:
+            - assignees
+            - create_case
+            - comment
+            - connector
+            - description
+            - pushed
+            - tags
+            - title
+            - status
+            - settings
+            - severity
+          example: create_case
   examples:
     create_case_request:
       summary: Create a security case that uses a Jira connector.
@@ -3315,6 +3489,71 @@ components:
           owner: cases
           payload: null
           type: delete_case
+    find_case_activity_response:
+      summary: Retrieves all activity for a case
+      value:
+        page: 1
+        perPage: 20
+        total: 4
+        userActions:
+          - id: b4cd0770-07c9-11ed-a5fd-47154cb8767e
+            action: create
+            comment_id: 578608d0-03b1-11ed-920c-974bfa104448
+            created_at: '2022-07-20T01:17:22.150Z'
+            created_by:
+              username: elastic
+              email: null
+              full_name: null
+            owner: cases
+            payload:
+              assignees: null
+              connector:
+                name: none
+                type: .none
+                fields: null
+                id: none
+              description: test
+              tags:
+                - mine
+              title: test-case
+              owner: cases
+              settings:
+                syncAlerts: false
+              severity: low
+              status: open
+              type: create_case
+            version: WzM1ODg4LDFd
+            type: comment
+          - id: 57af14a0-03b1-11ed-920c-974bfa104448
+            action: create
+            comment_id: 578608d0-03b1-11ed-920c-974bfa104448
+            created_at: '2022-07-14T20:12:53.354Z'
+            created_by:
+              username: elastic
+              email: null
+              full_name: null
+            owner: cases
+            payload:
+              comment: A new comment
+              owner: cases
+              type: user
+            version: WzM1ODg4LDFa
+            type: comment
+          - id: 573c6980-6123-11ed-aa41-81a0a61fe447
+            action: add
+            comment_id: null
+            created_at: '2022-07-20T01:10:28.238Z'
+            created_by:
+              username: elastic
+              email: null
+              full_name: null
+              profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
+            owner: cases
+            payload:
+              assignees:
+                uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
+            version: WzM1ODg4LDFb
+            type: assignees
 security:
   - basicAuth: []
   - apiKeyAuth: []
diff --git a/x-pack/plugins/cases/docs/openapi/components/examples/find_case_activity_response.yaml b/x-pack/plugins/cases/docs/openapi/components/examples/find_case_activity_response.yaml
new file mode 100644
index 00000000000000..49d5bd7684a740
--- /dev/null
+++ b/x-pack/plugins/cases/docs/openapi/components/examples/find_case_activity_response.yaml
@@ -0,0 +1,64 @@
+summary: Retrieves all activity for a case
+value:
+  page: 1
+  perPage: 20
+  total: 4
+  userActions:
+    - id: b4cd0770-07c9-11ed-a5fd-47154cb8767e
+      action: create
+      comment_id: 578608d0-03b1-11ed-920c-974bfa104448
+      created_at: 2022-07-20T01:17:22.150Z
+      created_by:
+        username: elastic
+        email: null
+        full_name: null
+      owner: cases
+      payload:
+        assignees:
+        connector:
+          name: none
+          type: .none
+          fields: null
+          id: none
+        description: test
+        tags:
+          - mine
+        title: test-case
+        owner: cases
+        settings:
+          syncAlerts: false
+        severity: low
+        status: open
+        type: create_case
+      version: WzM1ODg4LDFd
+      type: comment
+    - id: 57af14a0-03b1-11ed-920c-974bfa104448
+      action: create
+      comment_id: 578608d0-03b1-11ed-920c-974bfa104448
+      created_at: 2022-07-14T20:12:53.354Z
+      created_by:
+        username: elastic
+        email: null
+        full_name: null
+      owner: cases
+      payload:
+        comment: A new comment
+        owner: cases
+        type: user
+      version: WzM1ODg4LDFa
+      type: comment
+    - id: 573c6980-6123-11ed-aa41-81a0a61fe447
+      action: add
+      comment_id: null
+      created_at: 2022-07-20T01:10:28.238Z
+      created_by:
+        username: elastic
+        email: null
+        full_name: null
+        profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
+      owner: cases
+      payload:
+        assignees:
+          uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
+      version: WzM1ODg4LDFb
+      type: assignees
diff --git a/x-pack/plugins/cases/docs/openapi/components/schemas/user_actions_find_response_properties.yaml b/x-pack/plugins/cases/docs/openapi/components/schemas/user_actions_find_response_properties.yaml
new file mode 100644
index 00000000000000..a17f98d8007ade
--- /dev/null
+++ b/x-pack/plugins/cases/docs/openapi/components/schemas/user_actions_find_response_properties.yaml
@@ -0,0 +1,69 @@
+type: object
+required:
+  - action
+  - comment_id
+  - created_at
+  - created_by
+  - id
+  - owner
+  - payload
+  - type
+  - version
+properties:
+  action:
+    $ref: 'actions.yaml'
+  comment_id:
+    type: string
+    nullable: true
+    example: 578608d0-03b1-11ed-920c-974bfa104448
+  created_at:
+    type: string
+    format: date-time
+    example: 2022-05-13T09:16:17.416Z
+  created_by:
+    type: object
+    properties:
+      $ref: 'user_properties.yaml'
+    required:
+      - email
+      - full_name
+      - username
+  id:
+    type: string
+    example: 22fd3e30-03b1-11ed-920c-974bfa104448
+  owner:
+    $ref: 'owners.yaml'
+  payload:
+    oneOf:
+      - $ref: 'payload_alert_comment.yaml'
+      - $ref: 'payload_assignees.yaml'
+      - $ref: 'payload_connector.yaml'
+      - $ref: 'payload_create_case.yaml'
+      - $ref: 'payload_delete.yaml'
+      - $ref: 'payload_description.yaml'
+      - $ref: 'payload_pushed.yaml'
+      - $ref: 'payload_settings.yaml'
+      - $ref: 'payload_severity.yaml'
+      - $ref: 'payload_status.yaml'
+      - $ref: 'payload_tags.yaml'
+      - $ref: 'payload_title.yaml'
+      - $ref: 'payload_user_comment.yaml'
+  version:
+    type: string
+    example: WzM1ODg4LDFd
+  type:
+    type: string
+    description: The type of action.
+    enum:
+      - assignees
+      - create_case
+      - comment
+      - connector
+      - description
+      - pushed
+      - tags
+      - title
+      - status
+      - settings
+      - severity
+    example: create_case
diff --git a/x-pack/plugins/cases/docs/openapi/components/schemas/user_actions_response_properties.yaml b/x-pack/plugins/cases/docs/openapi/components/schemas/user_actions_response_properties.yaml
index d7e30dfecac19c..ef39c531c357d9 100644
--- a/x-pack/plugins/cases/docs/openapi/components/schemas/user_actions_response_properties.yaml
+++ b/x-pack/plugins/cases/docs/openapi/components/schemas/user_actions_response_properties.yaml
@@ -52,4 +52,4 @@ properties:
       - $ref: 'payload_title.yaml'
       - $ref: 'payload_user_comment.yaml'
   type:
-    $ref: 'action_types.yaml'
\ No newline at end of file
+    $ref: 'action_types.yaml'
diff --git a/x-pack/plugins/cases/docs/openapi/entrypoint.yaml b/x-pack/plugins/cases/docs/openapi/entrypoint.yaml
index 6f467f77ef93cd..1347cb30732379 100644
--- a/x-pack/plugins/cases/docs/openapi/entrypoint.yaml
+++ b/x-pack/plugins/cases/docs/openapi/entrypoint.yaml
@@ -45,6 +45,8 @@ paths:
     $ref: 'paths/s@{spaceid}@api@cases@{caseid}@connector@{connectorid}@_push.yaml'
   '/s/{spaceId}/api/cases/{caseId}/user_actions':
     $ref: 'paths/s@{spaceid}@api@cases@{caseid}@user_actions.yaml'
+  '/s/{spaceId}/api/cases/{caseId}/user_actions/_find':
+    $ref: 'paths/s@{spaceid}@api@cases@{caseid}@user_actions@_find.yaml'
 components:
   securitySchemes:
     basicAuth:
diff --git a/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@_find.yaml b/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@_find.yaml
index e4eb42e73f0b2c..f64fdbf0b9bf8d 100644
--- a/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@_find.yaml
+++ b/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@_find.yaml
@@ -54,7 +54,7 @@ get:
       example: 1
     - name: perPage
       in: query
-      description:  The number of rules to return per page.
+      description: The number of cases to return per page.
       schema:
         type: integer
         default: 20
@@ -83,7 +83,7 @@ get:
           - type: array
             items:
               type: string
-    - $ref: '../components/parameters/severity.yaml' 
+    - $ref: '../components/parameters/severity.yaml'
     - name: sortField
       in: query
       description: Determines which field is used to sort the results.
@@ -94,7 +94,7 @@ get:
           - updatedAt
         default: createdAt
       example: updatedAt
-    - name: sortOrder 
+    - name: sortOrder
       in: query
       description: Determines the sort order.
       schema:
@@ -104,17 +104,17 @@ get:
           - desc
         default: desc
       example: asc
-    - name: status 
+    - name: status
       in: query
       description: Filters the returned cases by state.
       schema:
-       type: string
-       enum:
-         - closed
-         - in-progress
-         - open
+        type: string
+        enum:
+          - closed
+          - in-progress
+          - open
       example: open
-    - name: tags 
+    - name: tags
       in: query
       description: Filters the returned cases by tags.
       schema:
@@ -140,7 +140,7 @@ get:
     '200':
       description: Indicates a successful call.
       content:
-         application/json:
+        application/json:
           schema:
             type: object
             properties:
@@ -172,4 +172,4 @@ get:
   servers:
     - url: https://localhost:5601
 servers:
-    - url: https://localhost:5601
\ No newline at end of file
+  - url: https://localhost:5601
diff --git a/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@user_actions@_find.yaml b/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@user_actions@_find.yaml
new file mode 100644
index 00000000000000..8ec83b50416efa
--- /dev/null
+++ b/x-pack/plugins/cases/docs/openapi/paths/s@{spaceid}@api@cases@{caseid}@user_actions@_find.yaml
@@ -0,0 +1,91 @@
+get:
+  summary: Finds user activity for a case.
+  description: >
+    You must have `read` privileges for the **Cases** feature in the
+    **Management**, **Observability**, or **Security** section of the Kibana
+    feature privileges, depending on the owner of the case you're seeking.
+  operationId: findCaseActivity
+  tags:
+    - cases
+  parameters:
+    - $ref: '../components/parameters/case_id.yaml'
+    - $ref: '../components/parameters/space_id.yaml'
+    - name: page
+      in: query
+      description: The page number to return.
+      schema:
+        type: string
+        default: 1
+      example: 1
+    - name: perPage
+      in: query
+      description: The number of user actions to return per page.
+      schema:
+        type: string
+        default: 20
+      example: 20
+    - name: sortOrder
+      in: query
+      description: Determines the sort order.
+      schema:
+        type: string
+        enum:
+          - asc
+          - desc
+        default: asc
+      example: asc
+    - name: types
+      in: query
+      description: Determines the types of user actions to return.
+      schema:
+        type: array
+        items:
+          type: string
+          enum:
+            - action
+            - alert
+            - assignees
+            - attachment
+            - comment
+            - connector
+            - create_case
+            - description
+            - pushed
+            - settings
+            - severity
+            - status
+            - tags
+            - title
+            - user
+      example: create_case
+  responses:
+    '200':
+      description: Indicates a successful call.
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              page:
+                type: integer
+              perPage:
+                type: integer
+              total:
+                type: integer
+              userActions:
+                type: array
+                items:
+                  $ref: '../components/schemas/user_actions_find_response_properties.yaml'
+          examples:
+            findCaseActivityResponse:
+              $ref: '../components/examples/find_case_activity_response.yaml'
+    '401':
+      description: Authorization information is missing or invalid.
+      content:
+        application/json:
+          schema:
+            $ref: '../components/schemas/4xx_response.yaml'
+  servers:
+    - url: https://localhost:5601
+servers:
+  - url: https://localhost:5601
diff --git a/x-pack/plugins/cases/server/authorization/__snapshots__/audit_logger.test.ts.snap b/x-pack/plugins/cases/server/authorization/__snapshots__/audit_logger.test.ts.snap
index 6e824f460a722d..183f6b4f1710f2 100644
--- a/x-pack/plugins/cases/server/authorization/__snapshots__/audit_logger.test.ts.snap
+++ b/x-pack/plugins/cases/server/authorization/__snapshots__/audit_logger.test.ts.snap
@@ -840,6 +840,90 @@ Object {
 }
 `;
 
+exports[`audit_logger log function event structure creates the correct audit event for operation: "findUserActions" with an error and entity 1`] = `
+Object {
+  "error": Object {
+    "code": "Error",
+    "message": "an error",
+  },
+  "event": Object {
+    "action": "case_user_actions_find",
+    "category": Array [
+      "database",
+    ],
+    "outcome": "failure",
+    "type": Array [
+      "access",
+    ],
+  },
+  "kibana": Object {
+    "saved_object": Object {
+      "id": "1",
+      "type": "cases-user-actions",
+    },
+  },
+  "message": "Failed attempt to access cases-user-actions [id=1] as owner \\"awesome\\"",
+}
+`;
+
+exports[`audit_logger log function event structure creates the correct audit event for operation: "findUserActions" with an error but no entity 1`] = `
+Object {
+  "error": Object {
+    "code": "Error",
+    "message": "an error",
+  },
+  "event": Object {
+    "action": "case_user_actions_find",
+    "category": Array [
+      "database",
+    ],
+    "outcome": "failure",
+    "type": Array [
+      "access",
+    ],
+  },
+  "message": "Failed attempt to access a user actions as any owners",
+}
+`;
+
+exports[`audit_logger log function event structure creates the correct audit event for operation: "findUserActions" without an error but with an entity 1`] = `
+Object {
+  "event": Object {
+    "action": "case_user_actions_find",
+    "category": Array [
+      "database",
+    ],
+    "outcome": "success",
+    "type": Array [
+      "access",
+    ],
+  },
+  "kibana": Object {
+    "saved_object": Object {
+      "id": "5",
+      "type": "cases-user-actions",
+    },
+  },
+  "message": "User has accessed cases-user-actions [id=5] as owner \\"super\\"",
+}
+`;
+
+exports[`audit_logger log function event structure creates the correct audit event for operation: "findUserActions" without an error or entity 1`] = `
+Object {
+  "event": Object {
+    "action": "case_user_actions_find",
+    "category": Array [
+      "database",
+    ],
+    "outcome": "success",
+    "type": Array [
+      "access",
+    ],
+  },
+  "message": "User has accessed a user actions as any owners",
+}
+`;
+
 exports[`audit_logger log function event structure creates the correct audit event for operation: "getAlertsAttachedToCase" with an error and entity 1`] = `
 Object {
   "error": Object {
diff --git a/x-pack/plugins/cases/server/authorization/index.ts b/x-pack/plugins/cases/server/authorization/index.ts
index 0c301f372ba5d7..392974fa56979d 100644
--- a/x-pack/plugins/cases/server/authorization/index.ts
+++ b/x-pack/plugins/cases/server/authorization/index.ts
@@ -310,6 +310,14 @@ export const Operations: Record<ReadOperations | WriteOperations, OperationDetai
     docType: 'cases',
     savedObjectType: CASE_SAVED_OBJECT,
   },
+  [ReadOperations.FindUserActions]: {
+    ecsType: EVENT_TYPES.access,
+    name: ACCESS_USER_ACTION_OPERATION,
+    action: 'case_user_actions_find',
+    verbs: accessVerbs,
+    docType: 'user actions',
+    savedObjectType: CASE_USER_ACTION_SAVED_OBJECT,
+  },
   [ReadOperations.GetUserActions]: {
     ecsType: EVENT_TYPES.access,
     name: ACCESS_USER_ACTION_OPERATION,
diff --git a/x-pack/plugins/cases/server/authorization/types.ts b/x-pack/plugins/cases/server/authorization/types.ts
index f92c6b4f4b0e19..57735803e69bfa 100644
--- a/x-pack/plugins/cases/server/authorization/types.ts
+++ b/x-pack/plugins/cases/server/authorization/types.ts
@@ -37,6 +37,7 @@ export enum ReadOperations {
   GetTags = 'getTags',
   GetReporters = 'getReporters',
   FindConfigurations = 'findConfigurations',
+  FindUserActions = 'findUserActions',
   GetUserActions = 'getUserActions',
   GetConnectors = 'getConnectors',
   GetAlertsAttachedToCase = 'getAlertsAttachedToCase',
diff --git a/x-pack/plugins/cases/server/client/client.ts b/x-pack/plugins/cases/server/client/client.ts
index c37a96db89a1b5..092ee5a4c93bae 100644
--- a/x-pack/plugins/cases/server/client/client.ts
+++ b/x-pack/plugins/cases/server/client/client.ts
@@ -34,7 +34,7 @@ export class CasesClient {
     this._casesClientInternal = createCasesClientInternal(args);
     this._cases = createCasesSubClient(args, this, this._casesClientInternal);
     this._attachments = createAttachmentsSubClient(args, this, this._casesClientInternal);
-    this._userActions = createUserActionsSubClient(args);
+    this._userActions = createUserActionsSubClient(args, this);
     this._configure = createConfigurationSubClient(args, this._casesClientInternal);
     this._metrics = createMetricsSubClient(args, this);
   }
diff --git a/x-pack/plugins/cases/server/client/metrics/get_case_metrics.test.ts b/x-pack/plugins/cases/server/client/metrics/get_case_metrics.test.ts
index 60a64add168fbe..7f980204af2a2c 100644
--- a/x-pack/plugins/cases/server/client/metrics/get_case_metrics.test.ts
+++ b/x-pack/plugins/cases/server/client/metrics/get_case_metrics.test.ts
@@ -202,7 +202,7 @@ function createMockClientArgs() {
   const logger = loggingSystemMock.createLogger();
 
   const userActionService = createUserActionServiceMock();
-  userActionService.findStatusChanges.mockImplementation(async () => {
+  userActionService.finder.findStatusChanges.mockImplementation(async () => {
     return [
       createStatusChangeSavedObject(CaseStatuses['in-progress'], new Date('2021-11-23T20:00:43Z')),
     ];
diff --git a/x-pack/plugins/cases/server/client/metrics/lifespan.test.ts b/x-pack/plugins/cases/server/client/metrics/lifespan.test.ts
index be31705a295d40..1488a09e5350e4 100644
--- a/x-pack/plugins/cases/server/client/metrics/lifespan.test.ts
+++ b/x-pack/plugins/cases/server/client/metrics/lifespan.test.ts
@@ -6,9 +6,10 @@
  */
 
 import type { SavedObject } from '@kbn/core/server';
-import type { CaseUserActionResponse } from '../../../common/api';
+import type { CaseUserActionInjectedAttributesWithoutActionId } from '../../../common/api';
 import { CaseStatuses } from '../../../common/api';
 import { getStatusInfo } from './lifespan';
+import { createStatusChangeSavedObject } from './test_utils/lifespan';
 
 describe('lifespan', () => {
   describe('getStatusInfo', () => {
@@ -119,7 +120,7 @@ describe('lifespan', () => {
         [
           {
             attributes: { payload: { hello: 1, status: CaseStatuses.closed }, type: 'status' },
-          } as unknown as SavedObject<CaseUserActionResponse>,
+          } as unknown as SavedObject<CaseUserActionInjectedAttributesWithoutActionId>,
         ],
         new Date(0)
       );
@@ -132,7 +133,7 @@ describe('lifespan', () => {
         [
           {
             attributes: { payload: { status: CaseStatuses.closed }, type: 'awesome' },
-          } as unknown as SavedObject<CaseUserActionResponse>,
+          } as unknown as SavedObject<CaseUserActionInjectedAttributesWithoutActionId>,
         ],
         new Date(0)
       );
@@ -148,7 +149,7 @@ describe('lifespan', () => {
               payload: { status: CaseStatuses.closed, created_at: 'blah' },
               type: 'status',
             },
-          } as unknown as SavedObject<CaseUserActionResponse>,
+          } as unknown as SavedObject<CaseUserActionInjectedAttributesWithoutActionId>,
         ],
         new Date(0)
       );
@@ -169,31 +170,3 @@ describe('lifespan', () => {
     });
   });
 });
-
-function createStatusChangeSavedObject(
-  status: CaseStatuses,
-  createdAt: Date
-): SavedObject<CaseUserActionResponse> {
-  return {
-    references: [],
-    id: '',
-    type: '',
-    attributes: {
-      created_at: createdAt.toISOString(),
-      created_by: {
-        username: 'j@j.com',
-        email: null,
-        full_name: null,
-      },
-      owner: 'securitySolution',
-      action: 'update',
-      payload: {
-        status,
-      },
-      type: 'status',
-      action_id: '',
-      case_id: '',
-      comment_id: null,
-    },
-  };
-}
diff --git a/x-pack/plugins/cases/server/client/metrics/lifespan.ts b/x-pack/plugins/cases/server/client/metrics/lifespan.ts
index 83e1b32d1bbc34..1577a59d294909 100644
--- a/x-pack/plugins/cases/server/client/metrics/lifespan.ts
+++ b/x-pack/plugins/cases/server/client/metrics/lifespan.ts
@@ -7,7 +7,7 @@
 
 import type { SavedObject } from '@kbn/core/server';
 import type {
-  CaseUserActionResponse,
+  CaseUserActionInjectedAttributesWithoutActionId,
   SingleCaseMetricsResponse,
   StatusInfo,
   StatusUserAction,
@@ -47,7 +47,7 @@ export class Lifespan extends SingleCaseBaseHandler {
         Operations.getUserActionMetrics
       );
 
-      const statusUserActions = await userActionService.findStatusChanges({
+      const statusUserActions = await userActionService.finder.findStatusChanges({
         caseId: this.caseId,
         filter: authorizationFilter,
       });
@@ -83,7 +83,7 @@ interface StatusCalculations {
 }
 
 export function getStatusInfo(
-  statusUserActions: Array<SavedObject<CaseUserActionResponse>>,
+  statusUserActions: Array<SavedObject<CaseUserActionInjectedAttributesWithoutActionId>>,
   caseOpenTimestamp: Date
 ): StatusInfo {
   const accStatusInfo = statusUserActions.reduce<StatusCalculations>(
@@ -138,7 +138,7 @@ export function getStatusInfo(
 }
 
 function isValidStatusChangeUserAction(
-  attributes: CaseUserActionResponse,
+  attributes: CaseUserActionInjectedAttributesWithoutActionId,
   newStatusChangeTimestamp: Date
 ): attributes is UserActionWithResponse<StatusUserAction> {
   return StatusUserActionRt.is(attributes) && isDateValid(newStatusChangeTimestamp);
diff --git a/x-pack/plugins/cases/server/client/metrics/test_utils/lifespan.ts b/x-pack/plugins/cases/server/client/metrics/test_utils/lifespan.ts
index a5b200f123eb9f..810e157403101a 100644
--- a/x-pack/plugins/cases/server/client/metrics/test_utils/lifespan.ts
+++ b/x-pack/plugins/cases/server/client/metrics/test_utils/lifespan.ts
@@ -6,12 +6,15 @@
  */
 
 import type { SavedObject } from '@kbn/core/server';
-import type { CaseStatuses, CaseUserActionResponse } from '../../../../common/api';
+import type {
+  CaseStatuses,
+  CaseUserActionInjectedAttributesWithoutActionId,
+} from '../../../../common/api';
 
 export function createStatusChangeSavedObject(
   status: CaseStatuses,
   createdAt: Date
-): SavedObject<CaseUserActionResponse> {
+): SavedObject<CaseUserActionInjectedAttributesWithoutActionId> {
   return {
     references: [],
     id: '',
@@ -29,8 +32,6 @@ export function createStatusChangeSavedObject(
         status,
       },
       type: 'status',
-      action_id: '',
-      case_id: '',
       comment_id: null,
     },
   };
diff --git a/x-pack/plugins/cases/server/client/mocks.ts b/x-pack/plugins/cases/server/client/mocks.ts
index 0ca2578d107a25..669ca6882fea57 100644
--- a/x-pack/plugins/cases/server/client/mocks.ts
+++ b/x-pack/plugins/cases/server/client/mocks.ts
@@ -84,6 +84,7 @@ const createUserActionsSubClientMock = (): UserActionsSubClientMock => {
   return {
     getAll: jest.fn(),
     getConnectors: jest.fn(),
+    find: jest.fn(),
   };
 };
 
diff --git a/x-pack/plugins/cases/server/client/user_actions/client.ts b/x-pack/plugins/cases/server/client/user_actions/client.ts
index bb529ae3b2c2f6..00879c3b62b825 100644
--- a/x-pack/plugins/cases/server/client/user_actions/client.ts
+++ b/x-pack/plugins/cases/server/client/user_actions/client.ts
@@ -5,34 +5,44 @@
  * 2.0.
  */
 
-import type { GetCaseConnectorsResponse } from '../../../common/api';
-import type { ICaseUserActionsResponse } from '../typedoc_interfaces';
+import type {
+  GetCaseConnectorsResponse,
+  CaseUserActionsResponse,
+  UserActionFindResponse,
+} from '../../../common/api';
 import type { CasesClientArgs } from '../types';
 import { get } from './get';
 import { getConnectors } from './connectors';
-import type { GetConnectorsRequest, UserActionGet } from './types';
+import type { GetConnectorsRequest, UserActionFind, UserActionGet } from './types';
+import { find } from './find';
+import type { CasesClient } from '../client';
 
 /**
  * API for interacting the actions performed by a user when interacting with the cases entities.
  */
 export interface UserActionsSubClient {
+  find(params: UserActionFind): Promise<UserActionFindResponse>;
   /**
    * Retrieves all user actions for a particular case.
    */
-  getAll(clientArgs: UserActionGet): Promise<ICaseUserActionsResponse>;
+  getAll(params: UserActionGet): Promise<CaseUserActionsResponse>;
   /**
    * Retrieves all the connectors used within a given case
    */
-  getConnectors(clientArgs: GetConnectorsRequest): Promise<GetCaseConnectorsResponse>;
+  getConnectors(params: GetConnectorsRequest): Promise<GetCaseConnectorsResponse>;
 }
 
 /**
  * Creates an API object for interacting with the user action entities
  */
-export const createUserActionsSubClient = (clientArgs: CasesClientArgs): UserActionsSubClient => {
+export const createUserActionsSubClient = (
+  clientArgs: CasesClientArgs,
+  casesClient: CasesClient
+): UserActionsSubClient => {
   const attachmentSubClient: UserActionsSubClient = {
-    getAll: (params: UserActionGet) => get(params, clientArgs),
-    getConnectors: (params: GetConnectorsRequest) => getConnectors(params, clientArgs),
+    find: (params) => find(params, casesClient, clientArgs),
+    getAll: (params) => get(params, clientArgs),
+    getConnectors: (params) => getConnectors(params, clientArgs),
   };
 
   return Object.freeze(attachmentSubClient);
diff --git a/x-pack/plugins/cases/server/client/user_actions/connectors.ts b/x-pack/plugins/cases/server/client/user_actions/connectors.ts
index 18cba75d79948e..3eb02b11c3d757 100644
--- a/x-pack/plugins/cases/server/client/user_actions/connectors.ts
+++ b/x-pack/plugins/cases/server/client/user_actions/connectors.ts
@@ -7,13 +7,13 @@
 
 import { isEqual } from 'lodash';
 
-import type { SavedObject } from '@kbn/core/server';
 import type { PublicMethodsOf } from '@kbn/utility-types';
 import type { ActionResult, ActionsClient } from '@kbn/actions-plugin/server';
+import type { SavedObject } from '@kbn/core-saved-objects-common/src/server_types';
 import type {
-  CaseUserActionResponse,
   GetCaseConnectorsResponse,
   CaseConnector,
+  CaseUserActionInjectedAttributesWithoutActionId,
 } from '../../../common/api';
 import { GetCaseConnectorsResponseRt } from '../../../common/api';
 import { isConnectorUserAction, isCreateCaseUserAction } from '../../../common/utils/user_actions';
@@ -68,7 +68,7 @@ const checkConnectorsAuthorization = async ({
   authorization,
 }: {
   connectors: CaseConnectorActivity[];
-  latestUserAction?: SavedObject<CaseUserActionResponse>;
+  latestUserAction?: SavedObject<CaseUserActionInjectedAttributesWithoutActionId>;
   authorization: PublicMethodsOf<Authorization>;
 }) => {
   const entities: OwnerEntity[] = latestUserAction
@@ -109,7 +109,7 @@ const getConnectorsInfo = async ({
 }: {
   caseId: string;
   connectors: CaseConnectorActivity[];
-  latestUserAction?: SavedObject<CaseUserActionResponse>;
+  latestUserAction?: SavedObject<CaseUserActionInjectedAttributesWithoutActionId>;
   actionsClient: PublicMethodsOf<ActionsClient>;
   userActionService: CaseUserActionService;
 }): Promise<GetCaseConnectorsResponse> => {
@@ -180,7 +180,7 @@ const isDateValid = (date: Date): boolean => {
 };
 
 const getConnectorInfoFromSavedObject = (
-  savedObject: SavedObject<CaseUserActionResponse> | undefined
+  savedObject: SavedObject<CaseUserActionInjectedAttributesWithoutActionId> | undefined
 ): CaseConnector | undefined => {
   if (
     savedObject != null &&
@@ -200,7 +200,7 @@ const createConnectorInfoResult = ({
   actionConnectors: ActionResult[];
   connectors: CaseConnectorActivity[];
   pushInfo: Map<string, EnrichedPushInfo>;
-  latestUserAction?: SavedObject<CaseUserActionResponse>;
+  latestUserAction?: SavedObject<CaseUserActionInjectedAttributesWithoutActionId>;
 }) => {
   const results: GetCaseConnectorsResponse = {};
 
diff --git a/x-pack/plugins/cases/server/client/user_actions/find.ts b/x-pack/plugins/cases/server/client/user_actions/find.ts
new file mode 100644
index 00000000000000..f52c821aa9367b
--- /dev/null
+++ b/x-pack/plugins/cases/server/client/user_actions/find.ts
@@ -0,0 +1,79 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import Boom from '@hapi/boom';
+import { pipe } from 'fp-ts/lib/pipeable';
+import { fold } from 'fp-ts/lib/Either';
+import { identity } from 'fp-ts/lib/function';
+
+import type { UserActionFindResponse } from '../../../common/api';
+import {
+  UserActionFindRequestRt,
+  throwErrors,
+  excess,
+  UserActionFindResponseRt,
+} from '../../../common/api';
+import type { CasesClientArgs } from '../types';
+import type { UserActionFind } from './types';
+import { Operations } from '../../authorization';
+import { formatSavedObjects } from './utils';
+import { createCaseError } from '../../common/error';
+import { asArray } from '../../common/utils';
+import type { CasesClient } from '../client';
+
+export const find = async (
+  { caseId, params }: UserActionFind,
+  casesClient: CasesClient,
+  clientArgs: CasesClientArgs
+): Promise<UserActionFindResponse> => {
+  const {
+    services: { userActionService },
+    logger,
+    authorization,
+  } = clientArgs;
+
+  try {
+    // supertest and query-string encode a single entry in an array as just a string so make sure we have an array
+    const types = asArray(params.types);
+
+    const queryParams = pipe(
+      excess(UserActionFindRequestRt).decode({ ...params, types }),
+      fold(throwErrors(Boom.badRequest), identity)
+    );
+
+    const [authorizationFilterRes] = await Promise.all([
+      authorization.getAuthorizationFilter(Operations.findUserActions),
+      // ensure that we have authorization for reading the case
+      casesClient.cases.resolve({ id: caseId, includeComments: false }),
+    ]);
+
+    const { filter: authorizationFilter, ensureSavedObjectsAreAuthorized } = authorizationFilterRes;
+
+    const userActions = await userActionService.finder.find({
+      caseId,
+      ...queryParams,
+      filter: authorizationFilter,
+    });
+
+    ensureSavedObjectsAreAuthorized(
+      userActions.saved_objects.map((so) => ({ owner: so.attributes.owner, id: so.id }))
+    );
+
+    return UserActionFindResponseRt.encode({
+      userActions: formatSavedObjects(userActions),
+      page: userActions.page,
+      perPage: userActions.per_page,
+      total: userActions.total,
+    });
+  } catch (error) {
+    throw createCaseError({
+      message: `Failed to find user actions for case id: ${caseId}: ${error}`,
+      error,
+      logger,
+    });
+  }
+};
diff --git a/x-pack/plugins/cases/server/client/user_actions/get.ts b/x-pack/plugins/cases/server/client/user_actions/get.ts
index 63711419ad3b99..b7cec9167450c4 100644
--- a/x-pack/plugins/cases/server/client/user_actions/get.ts
+++ b/x-pack/plugins/cases/server/client/user_actions/get.ts
@@ -5,13 +5,13 @@
  * 2.0.
  */
 
-import type { SavedObjectsFindResponse } from '@kbn/core/server';
-import type { CaseUserActionsResponse, CaseUserActionResponse } from '../../../common/api';
+import type { CaseUserActionsResponse } from '../../../common/api';
 import { CaseUserActionsResponseRt } from '../../../common/api';
 import { createCaseError } from '../../common/error';
 import type { CasesClientArgs } from '..';
 import { Operations } from '../../authorization';
 import type { UserActionGet } from './types';
+import { extractAttributes } from './utils';
 
 export const get = async (
   { caseId }: UserActionGet,
@@ -45,9 +45,3 @@ export const get = async (
     });
   }
 };
-
-function extractAttributes(
-  userActions: SavedObjectsFindResponse<CaseUserActionResponse>
-): CaseUserActionsResponse {
-  return userActions.saved_objects.map((so) => so.attributes);
-}
diff --git a/x-pack/plugins/cases/server/client/user_actions/types.ts b/x-pack/plugins/cases/server/client/user_actions/types.ts
index a974c5136047c6..5249bc27d1e587 100644
--- a/x-pack/plugins/cases/server/client/user_actions/types.ts
+++ b/x-pack/plugins/cases/server/client/user_actions/types.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import type { UserActionFindRequest } from '../../../common/api';
+
 /**
  * Parameters for retrieving user actions for a particular case
  */
@@ -16,3 +18,8 @@ export interface UserActionGet {
 }
 
 export type GetConnectorsRequest = UserActionGet;
+
+export interface UserActionFind {
+  params: UserActionFindRequest;
+  caseId: string;
+}
diff --git a/x-pack/plugins/cases/server/client/user_actions/utils.ts b/x-pack/plugins/cases/server/client/user_actions/utils.ts
new file mode 100644
index 00000000000000..a5237e9f45ca0b
--- /dev/null
+++ b/x-pack/plugins/cases/server/client/user_actions/utils.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SavedObjectsFindResponse } from '@kbn/core-saved-objects-api-server';
+import type {
+  CaseUserActionResponse,
+  CaseUserActionInjectedAttributesWithoutActionId,
+  CaseUserActionsResponse,
+  CaseUserActionsResponseWithoutActionId,
+} from '../../../common/api';
+
+export const extractAttributes = (
+  userActions: SavedObjectsFindResponse<CaseUserActionResponse>
+): CaseUserActionsResponse => {
+  return userActions.saved_objects.map((so) => so.attributes);
+};
+
+export const formatSavedObjects = (
+  response: SavedObjectsFindResponse<CaseUserActionInjectedAttributesWithoutActionId>
+): CaseUserActionsResponseWithoutActionId =>
+  response.saved_objects.map((so) => ({ id: so.id, version: so.version ?? '', ...so.attributes }));
diff --git a/x-pack/plugins/cases/server/client/utils.ts b/x-pack/plugins/cases/server/client/utils.ts
index b2a151f6d9957c..cbb373fd32ab93 100644
--- a/x-pack/plugins/cases/server/client/utils.ts
+++ b/x-pack/plugins/cases/server/client/utils.ts
@@ -180,10 +180,17 @@ export const addSeverityFilter = ({
   return filters.length > 1 ? nodeBuilder.and(filters) : filters[0];
 };
 
+export const NodeBuilderOperators = {
+  and: 'and',
+  or: 'or',
+} as const;
+
+type NodeBuilderOperatorsType = keyof typeof NodeBuilderOperators;
+
 interface FilterField {
   filters?: string | string[];
   field: string;
-  operator: 'and' | 'or';
+  operator: NodeBuilderOperatorsType;
   type?: string;
 }
 
@@ -273,14 +280,17 @@ export const combineAuthorizedAndOwnerFilter = (
 
 /**
  * Combines Kuery nodes and accepts an array with a mixture of undefined and KueryNodes. This will filter out the undefined
- * filters and return a KueryNode with the filters and'd together.
+ * filters and return a KueryNode with the filters combined using the specified operator which defaults to and if not defined.
  */
-export function combineFilters(nodes: Array<KueryNode | undefined>): KueryNode | undefined {
+export function combineFilters(
+  nodes: Array<KueryNode | undefined>,
+  operator: NodeBuilderOperatorsType = NodeBuilderOperators.and
+): KueryNode | undefined {
   const filters = nodes.filter((node): node is KueryNode => node !== undefined);
   if (filters.length <= 0) {
     return;
   }
-  return nodeBuilder.and(filters);
+  return nodeBuilder[operator](filters);
 }
 
 /**
diff --git a/x-pack/plugins/cases/server/routes/api/get_external_routes.ts b/x-pack/plugins/cases/server/routes/api/get_external_routes.ts
index d8a2a3d70e1901..9644046db5799b 100644
--- a/x-pack/plugins/cases/server/routes/api/get_external_routes.ts
+++ b/x-pack/plugins/cases/server/routes/api/get_external_routes.ts
@@ -31,6 +31,7 @@ import { postCaseConfigureRoute } from './configure/post_configure';
 import { getAllAlertsAttachedToCaseRoute } from './comments/get_alerts';
 import { getCaseMetricRoute } from './metrics/get_case_metrics';
 import { getCasesMetricRoute } from './metrics/get_cases_metrics';
+import { findUserActionsRoute } from './user_actions/find_user_actions';
 
 export const getExternalRoutes = () =>
   [
@@ -41,6 +42,7 @@ export const getExternalRoutes = () =>
     patchCaseRoute,
     postCaseRoute,
     pushCaseRoute,
+    findUserActionsRoute,
     getUserActionsRoute,
     getStatusRoute,
     getCasesByAlertIdRoute,
diff --git a/x-pack/plugins/cases/server/routes/api/user_actions/find_user_actions.ts b/x-pack/plugins/cases/server/routes/api/user_actions/find_user_actions.ts
new file mode 100644
index 00000000000000..84c9122753a899
--- /dev/null
+++ b/x-pack/plugins/cases/server/routes/api/user_actions/find_user_actions.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+import { CASE_FIND_USER_ACTIONS_URL } from '../../../../common/constants';
+import { createCaseError } from '../../../common/error';
+import { createCasesRoute } from '../create_cases_route';
+import type { UserActionFindRequest } from '../../../../common/api';
+
+export const findUserActionsRoute = createCasesRoute({
+  method: 'get',
+  path: CASE_FIND_USER_ACTIONS_URL,
+  params: {
+    params: schema.object({
+      case_id: schema.string(),
+    }),
+  },
+  handler: async ({ context, request, response }) => {
+    try {
+      const caseContext = await context.cases;
+      const casesClient = await caseContext.getCasesClient();
+      const caseId = request.params.case_id;
+      const options = request.query as UserActionFindRequest;
+
+      return response.ok({
+        body: await casesClient.userActions.find({ caseId, params: options }),
+      });
+    } catch (error) {
+      throw createCaseError({
+        message: `Failed to find user actions in route for case id: ${request.params.case_id}: ${error}`,
+        error,
+      });
+    }
+  },
+});
diff --git a/x-pack/plugins/cases/server/services/mocks.ts b/x-pack/plugins/cases/server/services/mocks.ts
index 11ce2711bbbaef..7b2adbd1094f3a 100644
--- a/x-pack/plugins/cases/server/services/mocks.ts
+++ b/x-pack/plugins/cases/server/services/mocks.ts
@@ -17,12 +17,21 @@ import type {
 import type { LicensingService } from './licensing';
 import type { EmailNotificationService } from './notifications/email_notification_service';
 import type { UserActionPersister } from './user_actions/operations/create';
+import type { UserActionFinder } from './user_actions/operations/find';
+
+interface UserActionServiceOperations {
+  creator: CaseUserActionPersisterServiceMock;
+  finder: CaseUserActionFinderServiceMock;
+}
 
 export type CaseServiceMock = jest.Mocked<CasesService>;
 export type CaseConfigureServiceMock = jest.Mocked<CaseConfigureService>;
 export type ConnectorMappingsServiceMock = jest.Mocked<ConnectorMappingsService>;
-export type CaseUserActionServiceMock = jest.Mocked<CaseUserActionService>;
+export type CaseUserActionServiceMock = jest.Mocked<
+  CaseUserActionService & UserActionServiceOperations
+>;
 export type CaseUserActionPersisterServiceMock = jest.Mocked<UserActionPersister>;
+export type CaseUserActionFinderServiceMock = jest.Mocked<UserActionFinder>;
 export type AlertServiceMock = jest.Mocked<AlertService>;
 export type AttachmentServiceMock = jest.Mocked<AttachmentService>;
 export type LicensingServiceMock = jest.Mocked<LicensingService>;
@@ -87,18 +96,25 @@ const createUserActionPersisterServiceMock = (): CaseUserActionPersisterServiceM
   return service as unknown as CaseUserActionPersisterServiceMock;
 };
 
-type FakeUserActionService = PublicMethodsOf<CaseUserActionService> & {
-  creator: CaseUserActionPersisterServiceMock;
+const createUserActionFinderServiceMock = (): CaseUserActionFinderServiceMock => {
+  const service: PublicMethodsOf<UserActionFinder> = {
+    find: jest.fn(),
+    findStatusChanges: jest.fn(),
+  };
+
+  return service as unknown as CaseUserActionFinderServiceMock;
 };
 
+type FakeUserActionService = PublicMethodsOf<CaseUserActionService> & UserActionServiceOperations;
+
 export const createUserActionServiceMock = (): CaseUserActionServiceMock => {
   const service: FakeUserActionService = {
     creator: createUserActionPersisterServiceMock(),
+    finder: createUserActionFinderServiceMock(),
     getConnectorFieldsBeforeLatestPush: jest.fn(),
     getMostRecentUserAction: jest.fn(),
     getCaseConnectorInformation: jest.fn(),
     getAll: jest.fn(),
-    findStatusChanges: jest.fn(),
     getUniqueConnectors: jest.fn(),
     getUserActionIdsForCases: jest.fn(),
   };
diff --git a/x-pack/plugins/cases/server/services/user_actions/__snapshots__/transform.test.ts.snap b/x-pack/plugins/cases/server/services/user_actions/__snapshots__/transform.test.ts.snap
new file mode 100644
index 00000000000000..fe35cda0f24756
--- /dev/null
+++ b/x-pack/plugins/cases/server/services/user_actions/__snapshots__/transform.test.ts.snap
@@ -0,0 +1,333 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`transform legacyTransformFindResponseToExternalModel external references populates the external references attributes 1`] = `
+Object {
+  "page": 1,
+  "per_page": 1,
+  "saved_objects": Array [
+    Object {
+      "attributes": Object {
+        "action": "create",
+        "action_id": "100",
+        "case_id": "1",
+        "comment_id": "external-reference-test-id",
+        "created_at": "abc",
+        "created_by": Object {
+          "email": "a",
+          "full_name": "abc",
+          "username": "b",
+        },
+        "owner": "securitySolution",
+        "payload": Object {
+          "comment": Object {
+            "externalReferenceAttachmentTypeId": ".test",
+            "externalReferenceId": "my-id",
+            "externalReferenceMetadata": null,
+            "externalReferenceStorage": Object {
+              "soType": "test-so",
+              "type": "savedObject",
+            },
+            "owner": "securitySolution",
+            "type": "externalReference",
+          },
+        },
+        "type": "comment",
+      },
+      "id": "100",
+      "references": Array [
+        Object {
+          "id": "my-id",
+          "name": "externalReferenceId",
+          "type": "test-so",
+        },
+        Object {
+          "id": "1",
+          "name": "associated-cases",
+          "type": "cases",
+        },
+        Object {
+          "id": "external-reference-test-id",
+          "name": "associated-cases-comments",
+          "type": "cases-comments",
+        },
+      ],
+      "score": 0,
+      "type": "cases-user-actions",
+    },
+  ],
+  "total": 1,
+}
+`;
+
+exports[`transform legacyTransformFindResponseToExternalModel persistable state attachments populates the persistable state 1`] = `
+Object {
+  "page": 1,
+  "per_page": 1,
+  "saved_objects": Array [
+    Object {
+      "attributes": Object {
+        "action": "create",
+        "action_id": "100",
+        "case_id": "1",
+        "comment_id": "persistable-state-test-id",
+        "created_at": "abc",
+        "created_by": Object {
+          "email": "a",
+          "full_name": "abc",
+          "username": "b",
+        },
+        "owner": "securitySolution",
+        "payload": Object {
+          "comment": Object {
+            "owner": "securitySolutionFixture",
+            "persistableStateAttachmentState": Object {
+              "foo": "foo",
+              "injectedId": "testRef",
+            },
+            "persistableStateAttachmentTypeId": ".test",
+            "type": "persistableState",
+          },
+        },
+        "type": "comment",
+      },
+      "id": "100",
+      "references": Array [
+        Object {
+          "id": "testRef",
+          "name": "myTestReference",
+          "type": "test-so",
+        },
+        Object {
+          "id": "1",
+          "name": "associated-cases",
+          "type": "cases",
+        },
+        Object {
+          "id": "persistable-state-test-id",
+          "name": "associated-cases-comments",
+          "type": "cases-comments",
+        },
+      ],
+      "score": 0,
+      "type": "cases-user-actions",
+    },
+  ],
+  "total": 1,
+}
+`;
+
+exports[`transform legacyTransformFindResponseToExternalModel preserves the saved object fields and attributes when inject the ids 1`] = `
+Object {
+  "page": 1,
+  "per_page": 1,
+  "saved_objects": Array [
+    Object {
+      "attributes": Object {
+        "action": "create",
+        "action_id": "100",
+        "case_id": "1",
+        "comment_id": null,
+        "created_at": "abc",
+        "created_by": Object {
+          "email": "a",
+          "full_name": "abc",
+          "username": "b",
+        },
+        "owner": "securitySolution",
+        "payload": Object {
+          "connector": Object {
+            "fields": Object {
+              "issueType": "bug",
+              "parent": "2",
+              "priority": "high",
+            },
+            "id": "1",
+            "name": ".jira",
+            "type": ".jira",
+          },
+        },
+        "type": "connector",
+      },
+      "id": "100",
+      "references": Array [
+        Object {
+          "id": "1",
+          "name": "associated-cases",
+          "type": "cases",
+        },
+        Object {
+          "id": "1",
+          "name": "connectorId",
+          "type": "action",
+        },
+      ],
+      "score": 0,
+      "type": "cases-user-actions",
+    },
+  ],
+  "total": 1,
+}
+`;
+
+exports[`transform transformFindResponseToExternalModel external references populates the external references attributes 1`] = `
+Object {
+  "page": 1,
+  "per_page": 1,
+  "saved_objects": Array [
+    Object {
+      "attributes": Object {
+        "action": "create",
+        "comment_id": "external-reference-test-id",
+        "created_at": "abc",
+        "created_by": Object {
+          "email": "a",
+          "full_name": "abc",
+          "username": "b",
+        },
+        "owner": "securitySolution",
+        "payload": Object {
+          "comment": Object {
+            "externalReferenceAttachmentTypeId": ".test",
+            "externalReferenceId": "my-id",
+            "externalReferenceMetadata": null,
+            "externalReferenceStorage": Object {
+              "soType": "test-so",
+              "type": "savedObject",
+            },
+            "owner": "securitySolution",
+            "type": "externalReference",
+          },
+        },
+        "type": "comment",
+      },
+      "id": "100",
+      "references": Array [
+        Object {
+          "id": "my-id",
+          "name": "externalReferenceId",
+          "type": "test-so",
+        },
+        Object {
+          "id": "1",
+          "name": "associated-cases",
+          "type": "cases",
+        },
+        Object {
+          "id": "external-reference-test-id",
+          "name": "associated-cases-comments",
+          "type": "cases-comments",
+        },
+      ],
+      "score": 0,
+      "type": "cases-user-actions",
+    },
+  ],
+  "total": 1,
+}
+`;
+
+exports[`transform transformFindResponseToExternalModel persistable state attachments populates the persistable state 1`] = `
+Object {
+  "page": 1,
+  "per_page": 1,
+  "saved_objects": Array [
+    Object {
+      "attributes": Object {
+        "action": "create",
+        "comment_id": "persistable-state-test-id",
+        "created_at": "abc",
+        "created_by": Object {
+          "email": "a",
+          "full_name": "abc",
+          "username": "b",
+        },
+        "owner": "securitySolution",
+        "payload": Object {
+          "comment": Object {
+            "owner": "securitySolutionFixture",
+            "persistableStateAttachmentState": Object {
+              "foo": "foo",
+              "injectedId": "testRef",
+            },
+            "persistableStateAttachmentTypeId": ".test",
+            "type": "persistableState",
+          },
+        },
+        "type": "comment",
+      },
+      "id": "100",
+      "references": Array [
+        Object {
+          "id": "testRef",
+          "name": "myTestReference",
+          "type": "test-so",
+        },
+        Object {
+          "id": "1",
+          "name": "associated-cases",
+          "type": "cases",
+        },
+        Object {
+          "id": "persistable-state-test-id",
+          "name": "associated-cases-comments",
+          "type": "cases-comments",
+        },
+      ],
+      "score": 0,
+      "type": "cases-user-actions",
+    },
+  ],
+  "total": 1,
+}
+`;
+
+exports[`transform transformFindResponseToExternalModel preserves the saved object fields and attributes when inject the ids 1`] = `
+Object {
+  "page": 1,
+  "per_page": 1,
+  "saved_objects": Array [
+    Object {
+      "attributes": Object {
+        "action": "create",
+        "comment_id": null,
+        "created_at": "abc",
+        "created_by": Object {
+          "email": "a",
+          "full_name": "abc",
+          "username": "b",
+        },
+        "owner": "securitySolution",
+        "payload": Object {
+          "connector": Object {
+            "fields": Object {
+              "issueType": "bug",
+              "parent": "2",
+              "priority": "high",
+            },
+            "id": "1",
+            "name": ".jira",
+            "type": ".jira",
+          },
+        },
+        "type": "connector",
+      },
+      "id": "100",
+      "references": Array [
+        Object {
+          "id": "1",
+          "name": "associated-cases",
+          "type": "cases",
+        },
+        Object {
+          "id": "1",
+          "name": "connectorId",
+          "type": "action",
+        },
+      ],
+      "score": 0,
+      "type": "cases-user-actions",
+    },
+  ],
+  "total": 1,
+}
+`;
diff --git a/x-pack/plugins/cases/server/services/user_actions/index.test.ts b/x-pack/plugins/cases/server/services/user_actions/index.test.ts
index f5fefebfc41b76..7d2389a7d88d0d 100644
--- a/x-pack/plugins/cases/server/services/user_actions/index.test.ts
+++ b/x-pack/plugins/cases/server/services/user_actions/index.test.ts
@@ -5,47 +5,20 @@
  * 2.0.
  */
 
-import { get, omit } from 'lodash';
 import { loggerMock } from '@kbn/logging-mocks';
 import { savedObjectsClientMock } from '@kbn/core/server/mocks';
 import type {
   SavedObject,
-  SavedObjectReference,
   SavedObjectsBulkCreateObject,
   SavedObjectsFindResponse,
-  SavedObjectsFindResult,
   SavedObjectsUpdateResponse,
 } from '@kbn/core/server';
-import { ACTION_SAVED_OBJECT_TYPE } from '@kbn/actions-plugin/server';
 import { auditLoggerMock } from '@kbn/security-plugin/server/audit/mocks';
-import type {
-  CaseAttributes,
-  CaseUserActionAttributes,
-  ConnectorUserAction,
-  UserAction,
-} from '../../../common/api';
+import type { CaseAttributes } from '../../../common/api';
 import { Actions, ActionTypes, CaseSeverity, CaseStatuses } from '../../../common/api';
-import {
-  CASE_COMMENT_SAVED_OBJECT,
-  CASE_SAVED_OBJECT,
-  CASE_USER_ACTION_SAVED_OBJECT,
-  SECURITY_SOLUTION_OWNER,
-} from '../../../common/constants';
-import {
-  CASE_REF_NAME,
-  COMMENT_REF_NAME,
-  CONNECTOR_ID_REFERENCE_NAME,
-  EXTERNAL_REFERENCE_REF_NAME,
-  PUSH_CONNECTOR_ID_REFERENCE_NAME,
-} from '../../common/constants';
+import { SECURITY_SOLUTION_OWNER } from '../../../common/constants';
 
-import {
-  createCaseSavedObjectResponse,
-  createConnectorObject,
-  createExternalService,
-  createJiraConnector,
-  createSOFindResponse,
-} from '../test_utils';
+import { createCaseSavedObjectResponse } from '../test_utils';
 import {
   casePayload,
   externalService,
@@ -57,255 +30,10 @@ import {
   originalCasesWithAssignee,
   updatedTagsCases,
 } from './mocks';
-import { CaseUserActionService, transformFindResponseToExternalModel } from '.';
-import type { PersistableStateAttachmentTypeRegistry } from '../../attachment_framework/persistable_state_registry';
-import {
-  externalReferenceAttachmentSO,
-  createPersistableStateAttachmentTypeRegistryMock,
-  persistableStateAttachment,
-} from '../../attachment_framework/mocks';
+import { CaseUserActionService } from '.';
+import { createPersistableStateAttachmentTypeRegistryMock } from '../../attachment_framework/mocks';
 import { serializerMock } from '@kbn/core-saved-objects-base-server-mocks';
-
-const createConnectorUserAction = (
-  overrides?: Partial<CaseUserActionAttributes>
-): SavedObject<CaseUserActionAttributes> => {
-  const { id, ...restConnector } = createConnectorObject().connector;
-  return {
-    ...createUserActionSO({
-      action: Actions.create,
-      payload: { connector: restConnector },
-      type: 'connector',
-      connectorId: id,
-    }),
-    ...(overrides && { ...overrides }),
-  };
-};
-
-const updateConnectorUserAction = ({
-  overrides,
-}: {
-  overrides?: Partial<CaseUserActionAttributes>;
-} = {}): SavedObject<CaseUserActionAttributes> => {
-  const { id, ...restConnector } = createJiraConnector();
-  return {
-    ...createUserActionSO({
-      action: Actions.update,
-      payload: { connector: restConnector },
-      type: 'connector',
-      connectorId: id,
-    }),
-    ...(overrides && { ...overrides }),
-  };
-};
-
-const pushConnectorUserAction = ({
-  overrides,
-}: {
-  overrides?: Partial<CaseUserActionAttributes>;
-} = {}): SavedObject<CaseUserActionAttributes> => {
-  const { connector_id: connectorId, ...restExternalService } = createExternalService();
-  return {
-    ...createUserActionSO({
-      action: Actions.push_to_service,
-      payload: { externalService: restExternalService },
-      pushedConnectorId: connectorId,
-      type: 'pushed',
-    }),
-    ...(overrides && { ...overrides }),
-  };
-};
-
-const createCaseUserAction = (): SavedObject<CaseUserActionAttributes> => {
-  const { id, ...restConnector } = createJiraConnector();
-  return {
-    ...createUserActionSO({
-      action: Actions.create,
-      payload: {
-        connector: restConnector,
-        title: 'a title',
-        description: 'a desc',
-        settings: { syncAlerts: false },
-        status: CaseStatuses.open,
-        severity: CaseSeverity.LOW,
-        tags: [],
-        owner: SECURITY_SOLUTION_OWNER,
-      },
-      connectorId: id,
-      type: 'create_case',
-    }),
-  };
-};
-
-const createUserActionFindSO = (
-  userAction: SavedObject<CaseUserActionAttributes>
-): SavedObjectsFindResult<CaseUserActionAttributes> => ({
-  ...userAction,
-  score: 0,
-});
-
-const createUserActionSO = ({
-  action,
-  attributesOverrides,
-  commentId,
-  connectorId,
-  pushedConnectorId,
-  payload,
-  type,
-  references = [],
-}: {
-  action: UserAction;
-  type?: string;
-  payload?: Record<string, unknown>;
-  attributesOverrides?: Partial<CaseUserActionAttributes>;
-  commentId?: string;
-  connectorId?: string;
-  pushedConnectorId?: string;
-  references?: SavedObjectReference[];
-}): SavedObject<CaseUserActionAttributes> => {
-  const defaultParams = {
-    action,
-    created_at: 'abc',
-    created_by: {
-      email: 'a',
-      username: 'b',
-      full_name: 'abc',
-    },
-    type: type ?? 'title',
-    payload: payload ?? { title: 'a new title' },
-    owner: 'securitySolution',
-  };
-
-  return {
-    type: CASE_USER_ACTION_SAVED_OBJECT,
-    id: '100',
-    attributes: {
-      ...defaultParams,
-      ...(attributesOverrides && { ...attributesOverrides }),
-    },
-    references: [
-      ...references,
-      {
-        type: CASE_SAVED_OBJECT,
-        name: CASE_REF_NAME,
-        id: '1',
-      },
-      ...(commentId
-        ? [
-            {
-              type: CASE_COMMENT_SAVED_OBJECT,
-              name: COMMENT_REF_NAME,
-              id: commentId,
-            },
-          ]
-        : []),
-      ...(connectorId
-        ? [
-            {
-              type: ACTION_SAVED_OBJECT_TYPE,
-              name: CONNECTOR_ID_REFERENCE_NAME,
-              id: connectorId,
-            },
-          ]
-        : []),
-      ...(pushedConnectorId
-        ? [
-            {
-              type: ACTION_SAVED_OBJECT_TYPE,
-              name: PUSH_CONNECTOR_ID_REFERENCE_NAME,
-              id: pushedConnectorId,
-            },
-          ]
-        : []),
-    ],
-  } as SavedObject<CaseUserActionAttributes>;
-};
-
-const createPersistableStateUserAction = () => {
-  return {
-    ...createUserActionSO({
-      action: Actions.create,
-      commentId: 'persistable-state-test-id',
-      payload: {
-        comment: {
-          ...persistableStateAttachment,
-          persistableStateAttachmentState: { foo: 'foo' },
-        },
-      },
-      type: 'comment',
-      references: [{ id: 'testRef', name: 'myTestReference', type: 'test-so' }],
-    }),
-  };
-};
-
-const createExternalReferenceUserAction = () => {
-  return {
-    ...createUserActionSO({
-      action: Actions.create,
-      commentId: 'external-reference-test-id',
-      payload: {
-        comment: omit(externalReferenceAttachmentSO, 'externalReferenceId'),
-      },
-      type: 'comment',
-      references: [{ id: 'my-id', name: EXTERNAL_REFERENCE_REF_NAME, type: 'test-so' }],
-    }),
-  };
-};
-
-const testConnectorId = (
-  persistableStateAttachmentTypeRegistry: PersistableStateAttachmentTypeRegistry,
-  userAction: SavedObject<CaseUserActionAttributes>,
-  path: string,
-  expectedConnectorId = '1'
-) => {
-  it('does set payload.connector.id to none when it cannot find the reference', () => {
-    const userActionWithEmptyRef = { ...userAction, references: [] };
-    const transformed = transformFindResponseToExternalModel(
-      createSOFindResponse([createUserActionFindSO(userActionWithEmptyRef)]),
-      persistableStateAttachmentTypeRegistry
-    );
-
-    expect(get(transformed.saved_objects[0].attributes.payload, path)).toBe('none');
-  });
-
-  it('does not populate the payload.connector.id when the reference exists but the action is not of type connector', () => {
-    const invalidUserAction = {
-      ...userAction,
-      attributes: { ...userAction.attributes, type: 'not-connector' },
-    };
-    const transformed = transformFindResponseToExternalModel(
-      createSOFindResponse([
-        createUserActionFindSO(invalidUserAction as SavedObject<CaseUserActionAttributes>),
-      ]),
-      persistableStateAttachmentTypeRegistry
-    );
-
-    expect(get(transformed.saved_objects[0].attributes.payload, path)).toBeUndefined();
-  });
-
-  it('does not populate the payload.connector.id when the reference exists but the payload does not contain a connector', () => {
-    const invalidUserAction = {
-      ...userAction,
-      attributes: { ...userAction.attributes, payload: {} },
-    };
-    const transformed = transformFindResponseToExternalModel(
-      createSOFindResponse([
-        createUserActionFindSO(invalidUserAction as SavedObject<CaseUserActionAttributes>),
-      ]),
-      persistableStateAttachmentTypeRegistry
-    ) as SavedObjectsFindResponse<ConnectorUserAction>;
-
-    expect(get(transformed.saved_objects[0].attributes.payload, path)).toBeUndefined();
-  });
-
-  it('populates the payload.connector.id', () => {
-    const transformed = transformFindResponseToExternalModel(
-      createSOFindResponse([createUserActionFindSO(userAction)]),
-      persistableStateAttachmentTypeRegistry
-    ) as SavedObjectsFindResponse<ConnectorUserAction>;
-
-    expect(get(transformed.saved_objects[0].attributes.payload, path)).toEqual(expectedConnectorId);
-  });
-};
+import { createUserActionFindSO, createConnectorUserAction } from './test_utils';
 
 describe('CaseUserActionService', () => {
   const persistableStateAttachmentTypeRegistry = createPersistableStateAttachmentTypeRegistryMock();
@@ -319,322 +47,6 @@ describe('CaseUserActionService', () => {
     jest.useRealTimers();
   });
 
-  describe('transformFindResponseToExternalModel', () => {
-    it('does not populate the ids when the response is an empty array', () => {
-      expect(
-        transformFindResponseToExternalModel(
-          createSOFindResponse([]),
-          persistableStateAttachmentTypeRegistry
-        )
-      ).toMatchInlineSnapshot(`
-        Object {
-          "page": 1,
-          "per_page": 0,
-          "saved_objects": Array [],
-          "total": 0,
-        }
-      `);
-    });
-
-    it('preserves the saved object fields and attributes when inject the ids', () => {
-      const transformed = transformFindResponseToExternalModel(
-        createSOFindResponse([createUserActionFindSO(createConnectorUserAction())]),
-        persistableStateAttachmentTypeRegistry
-      );
-
-      expect(transformed).toMatchInlineSnapshot(`
-        Object {
-          "page": 1,
-          "per_page": 1,
-          "saved_objects": Array [
-            Object {
-              "attributes": Object {
-                "action": "create",
-                "action_id": "100",
-                "case_id": "1",
-                "comment_id": null,
-                "created_at": "abc",
-                "created_by": Object {
-                  "email": "a",
-                  "full_name": "abc",
-                  "username": "b",
-                },
-                "owner": "securitySolution",
-                "payload": Object {
-                  "connector": Object {
-                    "fields": Object {
-                      "issueType": "bug",
-                      "parent": "2",
-                      "priority": "high",
-                    },
-                    "id": "1",
-                    "name": ".jira",
-                    "type": ".jira",
-                  },
-                },
-                "type": "connector",
-              },
-              "id": "100",
-              "references": Array [
-                Object {
-                  "id": "1",
-                  "name": "associated-cases",
-                  "type": "cases",
-                },
-                Object {
-                  "id": "1",
-                  "name": "connectorId",
-                  "type": "action",
-                },
-              ],
-              "score": 0,
-              "type": "cases-user-actions",
-            },
-          ],
-          "total": 1,
-        }
-      `);
-    });
-
-    it('populates the payload.connector.id for multiple user actions', () => {
-      const transformed = transformFindResponseToExternalModel(
-        createSOFindResponse([
-          createUserActionFindSO(createConnectorUserAction()),
-          createUserActionFindSO(createConnectorUserAction()),
-        ]),
-        persistableStateAttachmentTypeRegistry
-      ) as SavedObjectsFindResponse<ConnectorUserAction>;
-
-      expect(transformed.saved_objects[0].attributes.payload.connector.id).toEqual('1');
-      expect(transformed.saved_objects[1].attributes.payload.connector.id).toEqual('1');
-    });
-
-    describe('reference ids', () => {
-      it('sets case_id to an empty string when it cannot find the reference', () => {
-        const userAction = {
-          ...createConnectorUserAction(),
-          references: [],
-        };
-        const transformed = transformFindResponseToExternalModel(
-          createSOFindResponse([createUserActionFindSO(userAction)]),
-          persistableStateAttachmentTypeRegistry
-        );
-
-        expect(transformed.saved_objects[0].attributes.case_id).toEqual('');
-      });
-
-      it('sets comment_id to null when it cannot find the reference', () => {
-        const userAction = {
-          ...createUserActionSO({ action: Actions.create, commentId: '5' }),
-          references: [],
-        };
-        const transformed = transformFindResponseToExternalModel(
-          createSOFindResponse([createUserActionFindSO(userAction)]),
-          persistableStateAttachmentTypeRegistry
-        );
-
-        expect(transformed.saved_objects[0].attributes.comment_id).toBeNull();
-      });
-
-      it('sets case_id correctly when it finds the reference', () => {
-        const userAction = createConnectorUserAction();
-
-        const transformed = transformFindResponseToExternalModel(
-          createSOFindResponse([createUserActionFindSO(userAction)]),
-          persistableStateAttachmentTypeRegistry
-        );
-
-        expect(transformed.saved_objects[0].attributes.case_id).toEqual('1');
-      });
-
-      it('sets comment_id correctly when it finds the reference', () => {
-        const userAction = createUserActionSO({
-          action: Actions.create,
-          commentId: '5',
-        });
-
-        const transformed = transformFindResponseToExternalModel(
-          createSOFindResponse([createUserActionFindSO(userAction)]),
-          persistableStateAttachmentTypeRegistry
-        );
-
-        expect(transformed.saved_objects[0].attributes.comment_id).toEqual('5');
-      });
-
-      it('sets action_id correctly to the saved object id', () => {
-        const userAction = {
-          ...createUserActionSO({ action: Actions.create, commentId: '5' }),
-        };
-
-        const transformed = transformFindResponseToExternalModel(
-          createSOFindResponse([createUserActionFindSO(userAction)]),
-          persistableStateAttachmentTypeRegistry
-        );
-
-        expect(transformed.saved_objects[0].attributes.action_id).toEqual('100');
-      });
-    });
-
-    describe('create connector', () => {
-      const userAction = createConnectorUserAction();
-      testConnectorId(persistableStateAttachmentTypeRegistry, userAction, 'connector.id');
-    });
-
-    describe('update connector', () => {
-      const userAction = updateConnectorUserAction();
-      testConnectorId(persistableStateAttachmentTypeRegistry, userAction, 'connector.id');
-    });
-
-    describe('push connector', () => {
-      const userAction = pushConnectorUserAction();
-      testConnectorId(
-        persistableStateAttachmentTypeRegistry,
-        userAction,
-        'externalService.connector_id',
-        '100'
-      );
-    });
-
-    describe('create case', () => {
-      const userAction = createCaseUserAction();
-      testConnectorId(persistableStateAttachmentTypeRegistry, userAction, 'connector.id');
-    });
-
-    describe('persistable state attachments', () => {
-      it('populates the persistable state', () => {
-        const transformed = transformFindResponseToExternalModel(
-          createSOFindResponse([createUserActionFindSO(createPersistableStateUserAction())]),
-          persistableStateAttachmentTypeRegistry
-        ) as SavedObjectsFindResponse<ConnectorUserAction>;
-
-        expect(transformed).toMatchInlineSnapshot(`
-          Object {
-            "page": 1,
-            "per_page": 1,
-            "saved_objects": Array [
-              Object {
-                "attributes": Object {
-                  "action": "create",
-                  "action_id": "100",
-                  "case_id": "1",
-                  "comment_id": "persistable-state-test-id",
-                  "created_at": "abc",
-                  "created_by": Object {
-                    "email": "a",
-                    "full_name": "abc",
-                    "username": "b",
-                  },
-                  "owner": "securitySolution",
-                  "payload": Object {
-                    "comment": Object {
-                      "owner": "securitySolutionFixture",
-                      "persistableStateAttachmentState": Object {
-                        "foo": "foo",
-                        "injectedId": "testRef",
-                      },
-                      "persistableStateAttachmentTypeId": ".test",
-                      "type": "persistableState",
-                    },
-                  },
-                  "type": "comment",
-                },
-                "id": "100",
-                "references": Array [
-                  Object {
-                    "id": "testRef",
-                    "name": "myTestReference",
-                    "type": "test-so",
-                  },
-                  Object {
-                    "id": "1",
-                    "name": "associated-cases",
-                    "type": "cases",
-                  },
-                  Object {
-                    "id": "persistable-state-test-id",
-                    "name": "associated-cases-comments",
-                    "type": "cases-comments",
-                  },
-                ],
-                "score": 0,
-                "type": "cases-user-actions",
-              },
-            ],
-            "total": 1,
-          }
-        `);
-      });
-    });
-
-    describe('external references', () => {
-      it('populates the external references attributes', () => {
-        const transformed = transformFindResponseToExternalModel(
-          createSOFindResponse([createUserActionFindSO(createExternalReferenceUserAction())]),
-          persistableStateAttachmentTypeRegistry
-        ) as SavedObjectsFindResponse<ConnectorUserAction>;
-
-        expect(transformed).toMatchInlineSnapshot(`
-          Object {
-            "page": 1,
-            "per_page": 1,
-            "saved_objects": Array [
-              Object {
-                "attributes": Object {
-                  "action": "create",
-                  "action_id": "100",
-                  "case_id": "1",
-                  "comment_id": "external-reference-test-id",
-                  "created_at": "abc",
-                  "created_by": Object {
-                    "email": "a",
-                    "full_name": "abc",
-                    "username": "b",
-                  },
-                  "owner": "securitySolution",
-                  "payload": Object {
-                    "comment": Object {
-                      "externalReferenceAttachmentTypeId": ".test",
-                      "externalReferenceId": "my-id",
-                      "externalReferenceMetadata": null,
-                      "externalReferenceStorage": Object {
-                        "soType": "test-so",
-                        "type": "savedObject",
-                      },
-                      "owner": "securitySolution",
-                      "type": "externalReference",
-                    },
-                  },
-                  "type": "comment",
-                },
-                "id": "100",
-                "references": Array [
-                  Object {
-                    "id": "my-id",
-                    "name": "externalReferenceId",
-                    "type": "test-so",
-                  },
-                  Object {
-                    "id": "1",
-                    "name": "associated-cases",
-                    "type": "cases",
-                  },
-                  Object {
-                    "id": "external-reference-test-id",
-                    "name": "associated-cases-comments",
-                    "type": "cases-comments",
-                  },
-                ],
-                "score": 0,
-                "type": "cases-user-actions",
-              },
-            ],
-            "total": 1,
-          }
-        `);
-      });
-    });
-  });
-
   describe('methods', () => {
     let service: CaseUserActionService;
     const unsecuredSavedObjectsClient = savedObjectsClientMock.create();
diff --git a/x-pack/plugins/cases/server/services/user_actions/index.ts b/x-pack/plugins/cases/server/services/user_actions/index.ts
index 31060ebb86d28d..0612c1374a4ec3 100644
--- a/x-pack/plugins/cases/server/services/user_actions/index.ts
+++ b/x-pack/plugins/cases/server/services/user_actions/index.ts
@@ -14,39 +14,23 @@ import type {
 
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { KueryNode } from '@kbn/es-query';
-import { isCommentRequestTypePersistableState } from '../../../common/utils/attachments';
-import {
-  isConnectorUserAction,
-  isPushedUserAction,
-  isCreateCaseUserAction,
-  isCommentUserAction,
-} from '../../../common/utils/user_actions';
 import type {
-  CaseUserActionAttributes,
   CaseUserActionAttributesWithoutConnectorId,
+  CaseUserActionInjectedAttributesWithoutActionId,
   CaseUserActionResponse,
 } from '../../../common/api';
-import { Actions, ActionTypes, NONE_CONNECTOR_ID } from '../../../common/api';
+import { ActionTypes } from '../../../common/api';
 import {
   CASE_SAVED_OBJECT,
   CASE_USER_ACTION_SAVED_OBJECT,
   MAX_DOCS_PER_PAGE,
-  CASE_COMMENT_SAVED_OBJECT,
 } from '../../../common/constants';
-import {
-  CASE_REF_NAME,
-  COMMENT_REF_NAME,
-  CONNECTOR_ID_REFERENCE_NAME,
-  EXTERNAL_REFERENCE_REF_NAME,
-  PUSH_CONNECTOR_ID_REFERENCE_NAME,
-} from '../../common/constants';
-import { findConnectorIdReference } from '../transform';
 import { buildFilter, combineFilters } from '../../client/utils';
 import type { CaseConnectorActivity, CaseConnectorFields, PushInfo, ServiceContext } from './types';
-import { defaultSortField, isCommentRequestTypeExternalReferenceSO } from '../../common/utils';
-import type { PersistableStateAttachmentTypeRegistry } from '../../attachment_framework/persistable_state_registry';
-import { injectPersistableReferencesToSO } from '../../attachment_framework/so_references';
+import { defaultSortField } from '../../common/utils';
 import { UserActionPersister } from './operations/create';
+import { UserActionFinder } from './operations/find';
+import { transformToExternalModel, legacyTransformFindResponseToExternalModel } from './transform';
 
 export interface UserActionItem {
   attributes: CaseUserActionAttributesWithoutConnectorId;
@@ -97,15 +81,21 @@ interface ConnectorFieldsBeforePushAggsResult {
 
 export class CaseUserActionService {
   private readonly _creator: UserActionPersister;
+  private readonly _finder: UserActionFinder;
 
   constructor(private readonly context: ServiceContext) {
     this._creator = new UserActionPersister(context);
+    this._finder = new UserActionFinder(context);
   }
 
   public get creator() {
     return this._creator;
   }
 
+  public get finder() {
+    return this._finder;
+  }
+
   public async getConnectorFieldsBeforeLatestPush(
     caseId: string,
     pushes: PushInfo[]
@@ -271,7 +261,7 @@ export class CaseUserActionService {
 
   public async getMostRecentUserAction(
     caseId: string
-  ): Promise<SavedObject<CaseUserActionResponse> | undefined> {
+  ): Promise<SavedObject<CaseUserActionInjectedAttributesWithoutActionId> | undefined> {
     try {
       this.context.log.debug(
         `Attempting to retrieve the most recent user action for case id: ${caseId}`
@@ -378,7 +368,7 @@ export class CaseUserActionService {
         rawFieldsDoc = createCase.mostRecent.hits.hits[0];
       }
 
-      let fieldsDoc: SavedObject<CaseUserActionResponse> | undefined;
+      let fieldsDoc: SavedObject<CaseUserActionInjectedAttributesWithoutActionId> | undefined;
       if (rawFieldsDoc != null) {
         const doc =
           this.context.savedObjectsSerializer.rawToSavedObject<CaseUserActionAttributesWithoutConnectorId>(
@@ -392,7 +382,7 @@ export class CaseUserActionService {
       }
 
       const pushInfo = connectorInfo.reverse.connectorActivity.buckets.pushInfo;
-      let pushDoc: SavedObject<CaseUserActionResponse> | undefined;
+      let pushDoc: SavedObject<CaseUserActionInjectedAttributesWithoutActionId> | undefined;
 
       if (pushInfo.mostRecent.hits.hits.length > 0) {
         const rawPushDoc = pushInfo.mostRecent.hits.hits[0];
@@ -520,7 +510,7 @@ export class CaseUserActionService {
           }
         );
 
-      return transformFindResponseToExternalModel(
+      return legacyTransformFindResponseToExternalModel(
         userActions,
         this.context.persistableStateAttachmentTypeRegistry
       );
@@ -562,60 +552,6 @@ export class CaseUserActionService {
     }
   }
 
-  public async findStatusChanges({
-    caseId,
-    filter,
-  }: {
-    caseId: string;
-    filter?: KueryNode;
-  }): Promise<Array<SavedObject<CaseUserActionResponse>>> {
-    try {
-      this.context.log.debug('Attempting to find status changes');
-
-      const updateActionFilter = buildFilter({
-        filters: Actions.update,
-        field: 'action',
-        operator: 'or',
-        type: CASE_USER_ACTION_SAVED_OBJECT,
-      });
-
-      const statusChangeFilter = buildFilter({
-        filters: ActionTypes.status,
-        field: 'type',
-        operator: 'or',
-        type: CASE_USER_ACTION_SAVED_OBJECT,
-      });
-
-      const combinedFilters = combineFilters([updateActionFilter, statusChangeFilter, filter]);
-
-      const finder =
-        this.context.unsecuredSavedObjectsClient.createPointInTimeFinder<CaseUserActionAttributesWithoutConnectorId>(
-          {
-            type: CASE_USER_ACTION_SAVED_OBJECT,
-            hasReference: { type: CASE_SAVED_OBJECT, id: caseId },
-            sortField: defaultSortField,
-            sortOrder: 'asc',
-            filter: combinedFilters,
-            perPage: MAX_DOCS_PER_PAGE,
-          }
-        );
-
-      let userActions: Array<SavedObject<CaseUserActionResponse>> = [];
-      for await (const findResults of finder.find()) {
-        userActions = userActions.concat(
-          findResults.saved_objects.map((so) =>
-            transformToExternalModel(so, this.context.persistableStateAttachmentTypeRegistry)
-          )
-        );
-      }
-
-      return userActions;
-    } catch (error) {
-      this.context.log.error(`Error finding status changes: ${error}`);
-      throw error;
-    }
-  }
-
   public async getUniqueConnectors({
     caseId,
     filter,
@@ -691,126 +627,3 @@ export class CaseUserActionService {
     };
   }
 }
-
-export function transformFindResponseToExternalModel(
-  userActions: SavedObjectsFindResponse<CaseUserActionAttributesWithoutConnectorId>,
-  persistableStateAttachmentTypeRegistry: PersistableStateAttachmentTypeRegistry
-): SavedObjectsFindResponse<CaseUserActionResponse> {
-  return {
-    ...userActions,
-    saved_objects: userActions.saved_objects.map((so) => ({
-      ...so,
-      ...transformToExternalModel(so, persistableStateAttachmentTypeRegistry),
-    })),
-  };
-}
-
-function transformToExternalModel(
-  userAction: SavedObject<CaseUserActionAttributesWithoutConnectorId>,
-  persistableStateAttachmentTypeRegistry: PersistableStateAttachmentTypeRegistry
-): SavedObject<CaseUserActionResponse> {
-  const { references } = userAction;
-
-  const caseId = findReferenceId(CASE_REF_NAME, CASE_SAVED_OBJECT, references) ?? '';
-  const commentId =
-    findReferenceId(COMMENT_REF_NAME, CASE_COMMENT_SAVED_OBJECT, references) ?? null;
-  const payload = addReferenceIdToPayload(userAction, persistableStateAttachmentTypeRegistry);
-
-  return {
-    ...userAction,
-    attributes: {
-      ...userAction.attributes,
-      action_id: userAction.id,
-      case_id: caseId,
-      comment_id: commentId,
-      payload,
-    } as CaseUserActionResponse,
-  };
-}
-
-const addReferenceIdToPayload = (
-  userAction: SavedObject<CaseUserActionAttributes>,
-  persistableStateAttachmentTypeRegistry: PersistableStateAttachmentTypeRegistry
-): CaseUserActionAttributes['payload'] => {
-  const connectorId = getConnectorIdFromReferences(userAction);
-  const userActionAttributes = userAction.attributes;
-
-  if (isConnectorUserAction(userActionAttributes) || isCreateCaseUserAction(userActionAttributes)) {
-    return {
-      ...userActionAttributes.payload,
-      connector: {
-        ...userActionAttributes.payload.connector,
-        id: connectorId ?? NONE_CONNECTOR_ID,
-      },
-    };
-  } else if (isPushedUserAction(userActionAttributes)) {
-    return {
-      ...userAction.attributes.payload,
-      externalService: {
-        ...userActionAttributes.payload.externalService,
-        connector_id: connectorId ?? NONE_CONNECTOR_ID,
-      },
-    };
-  } else if (isCommentUserAction(userActionAttributes)) {
-    if (isCommentRequestTypeExternalReferenceSO(userActionAttributes.payload.comment)) {
-      const externalReferenceId = findReferenceId(
-        EXTERNAL_REFERENCE_REF_NAME,
-        userActionAttributes.payload.comment.externalReferenceStorage.soType,
-        userAction.references
-      );
-
-      return {
-        ...userAction.attributes.payload,
-        comment: {
-          ...userActionAttributes.payload.comment,
-          externalReferenceId: externalReferenceId ?? '',
-        },
-      };
-    }
-
-    if (isCommentRequestTypePersistableState(userActionAttributes.payload.comment)) {
-      const injectedAttributes = injectPersistableReferencesToSO(
-        userActionAttributes.payload.comment,
-        userAction.references,
-        {
-          persistableStateAttachmentTypeRegistry,
-        }
-      );
-
-      return {
-        ...userAction.attributes.payload,
-        comment: {
-          ...userActionAttributes.payload.comment,
-          ...injectedAttributes,
-        },
-      };
-    }
-  }
-
-  return userAction.attributes.payload;
-};
-
-function getConnectorIdFromReferences(
-  userAction: SavedObject<CaseUserActionAttributes>
-): string | null {
-  const { references } = userAction;
-
-  if (
-    isConnectorUserAction(userAction.attributes) ||
-    isCreateCaseUserAction(userAction.attributes)
-  ) {
-    return findConnectorIdReference(CONNECTOR_ID_REFERENCE_NAME, references)?.id ?? null;
-  } else if (isPushedUserAction(userAction.attributes)) {
-    return findConnectorIdReference(PUSH_CONNECTOR_ID_REFERENCE_NAME, references)?.id ?? null;
-  }
-
-  return null;
-}
-
-function findReferenceId(
-  name: string,
-  type: string,
-  references: SavedObjectReference[]
-): string | undefined {
-  return references.find((ref) => ref.name === name && ref.type === type)?.id;
-}
diff --git a/x-pack/plugins/cases/server/services/user_actions/operations/find.ts b/x-pack/plugins/cases/server/services/user_actions/operations/find.ts
new file mode 100644
index 00000000000000..69cd8bd4b6fb62
--- /dev/null
+++ b/x-pack/plugins/cases/server/services/user_actions/operations/find.ts
@@ -0,0 +1,228 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { KueryNode } from '@kbn/es-query';
+import { fromKueryExpression } from '@kbn/es-query';
+import type { SavedObjectsFindResponse } from '@kbn/core-saved-objects-api-server';
+import type { SavedObject } from '@kbn/core-saved-objects-common';
+import { DEFAULT_PAGE, DEFAULT_PER_PAGE } from '../../../routes/api';
+import { defaultSortField } from '../../../common/utils';
+import type {
+  CaseUserActionAttributesWithoutConnectorId,
+  UserActionFindRequest,
+  ActionTypeValues,
+  FindTypeField,
+  CaseUserActionInjectedAttributesWithoutActionId,
+} from '../../../../common/api';
+import { Actions, ActionTypes, CommentType } from '../../../../common/api';
+import {
+  CASE_SAVED_OBJECT,
+  CASE_USER_ACTION_SAVED_OBJECT,
+  MAX_DOCS_PER_PAGE,
+} from '../../../../common/constants';
+
+import type { ServiceContext } from '../types';
+import { transformFindResponseToExternalModel, transformToExternalModel } from '../transform';
+import { buildFilter, combineFilters, NodeBuilderOperators } from '../../../client/utils';
+
+interface FindOptions extends UserActionFindRequest {
+  caseId: string;
+  filter?: KueryNode;
+}
+
+export class UserActionFinder {
+  constructor(private readonly context: ServiceContext) {}
+
+  public async find({
+    caseId,
+    sortOrder,
+    types,
+    page,
+    perPage,
+    filter,
+  }: FindOptions): Promise<
+    SavedObjectsFindResponse<CaseUserActionInjectedAttributesWithoutActionId>
+  > {
+    try {
+      this.context.log.debug(`Attempting to find user actions for case id: ${caseId}`);
+
+      const finalFilter = combineFilters([filter, UserActionFinder.buildFilter(types)]);
+
+      const userActions =
+        await this.context.unsecuredSavedObjectsClient.find<CaseUserActionAttributesWithoutConnectorId>(
+          {
+            type: CASE_USER_ACTION_SAVED_OBJECT,
+            hasReference: { type: CASE_SAVED_OBJECT, id: caseId },
+            page: page ?? DEFAULT_PAGE,
+            perPage: perPage ?? DEFAULT_PER_PAGE,
+            sortField: 'created_at',
+            sortOrder: sortOrder ?? 'asc',
+            filter: finalFilter,
+          }
+        );
+
+      return transformFindResponseToExternalModel(
+        userActions,
+        this.context.persistableStateAttachmentTypeRegistry
+      );
+    } catch (error) {
+      this.context.log.error(`Error finding user actions for case id: ${caseId}: ${error}`);
+      throw error;
+    }
+  }
+
+  private static buildFilter(types: FindOptions['types'] = []) {
+    const filters = types.map((type) => UserActionFinder.buildFilterType(type));
+    return combineFilters(filters, NodeBuilderOperators.or);
+  }
+
+  private static buildFilterType(type: FindTypeField): KueryNode | undefined {
+    switch (type) {
+      case 'action':
+        return UserActionFinder.buildActionFilter();
+      case 'user':
+        return UserActionFinder.buildCommentTypeFilter();
+      case 'alert':
+        return UserActionFinder.buildAlertCommentTypeFilter();
+      case 'attachment':
+        return UserActionFinder.buildAttachmentsFilter();
+      default:
+        return UserActionFinder.buildGenericTypeFilter(type);
+    }
+  }
+
+  private static buildActionFilter(): KueryNode | undefined {
+    const filterForUserActionsExcludingComment = fromKueryExpression(
+      `not ${CASE_USER_ACTION_SAVED_OBJECT}.attributes.payload.comment.type: ${CommentType.user}`
+    );
+
+    return filterForUserActionsExcludingComment;
+  }
+
+  private static buildCommentTypeFilter(): KueryNode | undefined {
+    return combineFilters(
+      [
+        buildFilter({
+          filters: [ActionTypes.comment],
+          field: 'type',
+          operator: 'or',
+          type: CASE_USER_ACTION_SAVED_OBJECT,
+        }),
+        buildFilter({
+          filters: [CommentType.user],
+          field: 'payload.comment.type',
+          operator: 'or',
+          type: CASE_USER_ACTION_SAVED_OBJECT,
+        }),
+      ],
+      NodeBuilderOperators.and
+    );
+  }
+
+  private static buildAlertCommentTypeFilter(): KueryNode | undefined {
+    return combineFilters(
+      [
+        buildFilter({
+          filters: [ActionTypes.comment],
+          field: 'type',
+          operator: 'or',
+          type: CASE_USER_ACTION_SAVED_OBJECT,
+        }),
+        buildFilter({
+          filters: [CommentType.alert],
+          field: 'payload.comment.type',
+          operator: 'or',
+          type: CASE_USER_ACTION_SAVED_OBJECT,
+        }),
+      ],
+      NodeBuilderOperators.and
+    );
+  }
+
+  private static buildAttachmentsFilter(): KueryNode | undefined {
+    return combineFilters(
+      [
+        buildFilter({
+          filters: [ActionTypes.comment],
+          field: 'type',
+          operator: 'or',
+          type: CASE_USER_ACTION_SAVED_OBJECT,
+        }),
+        buildFilter({
+          filters: [CommentType.persistableState, CommentType.externalReference],
+          field: 'payload.comment.type',
+          operator: 'or',
+          type: CASE_USER_ACTION_SAVED_OBJECT,
+        }),
+      ],
+      NodeBuilderOperators.and
+    );
+  }
+
+  private static buildGenericTypeFilter(type: ActionTypeValues): KueryNode | undefined {
+    return buildFilter({
+      filters: [type],
+      field: 'type',
+      operator: 'or',
+      type: CASE_USER_ACTION_SAVED_OBJECT,
+    });
+  }
+
+  public async findStatusChanges({
+    caseId,
+    filter,
+  }: {
+    caseId: string;
+    filter?: KueryNode;
+  }): Promise<Array<SavedObject<CaseUserActionInjectedAttributesWithoutActionId>>> {
+    try {
+      this.context.log.debug('Attempting to find status changes');
+
+      const updateActionFilter = buildFilter({
+        filters: Actions.update,
+        field: 'action',
+        operator: 'or',
+        type: CASE_USER_ACTION_SAVED_OBJECT,
+      });
+
+      const statusChangeFilter = buildFilter({
+        filters: ActionTypes.status,
+        field: 'type',
+        operator: 'or',
+        type: CASE_USER_ACTION_SAVED_OBJECT,
+      });
+
+      const combinedFilters = combineFilters([updateActionFilter, statusChangeFilter, filter]);
+
+      const finder =
+        this.context.unsecuredSavedObjectsClient.createPointInTimeFinder<CaseUserActionAttributesWithoutConnectorId>(
+          {
+            type: CASE_USER_ACTION_SAVED_OBJECT,
+            hasReference: { type: CASE_SAVED_OBJECT, id: caseId },
+            sortField: defaultSortField,
+            sortOrder: 'asc',
+            filter: combinedFilters,
+            perPage: MAX_DOCS_PER_PAGE,
+          }
+        );
+
+      let userActions: Array<SavedObject<CaseUserActionInjectedAttributesWithoutActionId>> = [];
+      for await (const findResults of finder.find()) {
+        userActions = userActions.concat(
+          findResults.saved_objects.map((so) =>
+            transformToExternalModel(so, this.context.persistableStateAttachmentTypeRegistry)
+          )
+        );
+      }
+
+      return userActions;
+    } catch (error) {
+      this.context.log.error(`Error finding status changes: ${error}`);
+      throw error;
+    }
+  }
+}
diff --git a/x-pack/plugins/cases/server/services/user_actions/test_utils.ts b/x-pack/plugins/cases/server/services/user_actions/test_utils.ts
new file mode 100644
index 00000000000000..335905cb116ce8
--- /dev/null
+++ b/x-pack/plugins/cases/server/services/user_actions/test_utils.ts
@@ -0,0 +1,286 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ACTION_SAVED_OBJECT_TYPE } from '@kbn/actions-plugin/server';
+import type {
+  SavedObjectsFindResponse,
+  SavedObjectsFindResult,
+} from '@kbn/core-saved-objects-api-server';
+import type { SavedObject, SavedObjectReference } from '@kbn/core-saved-objects-common';
+import { omit, get } from 'lodash';
+import {
+  CASE_COMMENT_SAVED_OBJECT,
+  CASE_SAVED_OBJECT,
+  CASE_USER_ACTION_SAVED_OBJECT,
+  SECURITY_SOLUTION_OWNER,
+} from '../../../common/constants';
+import type {
+  CaseUserActionAttributes,
+  ConnectorUserAction,
+  UserAction,
+} from '../../../common/api';
+import { CaseSeverity, CaseStatuses, Actions } from '../../../common/api';
+import {
+  CASE_REF_NAME,
+  COMMENT_REF_NAME,
+  CONNECTOR_ID_REFERENCE_NAME,
+  EXTERNAL_REFERENCE_REF_NAME,
+  PUSH_CONNECTOR_ID_REFERENCE_NAME,
+} from '../../common/constants';
+import {
+  createConnectorObject,
+  createExternalService,
+  createJiraConnector,
+  createSOFindResponse,
+} from '../test_utils';
+import {
+  externalReferenceAttachmentSO,
+  persistableStateAttachment,
+} from '../../attachment_framework/mocks';
+import type { PersistableStateAttachmentTypeRegistry } from '../../attachment_framework/persistable_state_registry';
+import { transformFindResponseToExternalModel } from './transform';
+
+export const createUserActionFindSO = (
+  userAction: SavedObject<CaseUserActionAttributes>
+): SavedObjectsFindResult<CaseUserActionAttributes> => ({
+  ...userAction,
+  score: 0,
+});
+
+export const createConnectorUserAction = (
+  overrides?: Partial<CaseUserActionAttributes>
+): SavedObject<CaseUserActionAttributes> => {
+  const { id, ...restConnector } = createConnectorObject().connector;
+  return {
+    ...createUserActionSO({
+      action: Actions.create,
+      payload: { connector: restConnector },
+      type: 'connector',
+      connectorId: id,
+    }),
+    ...(overrides && { ...overrides }),
+  };
+};
+
+export const createUserActionSO = ({
+  action,
+  attributesOverrides,
+  commentId,
+  connectorId,
+  pushedConnectorId,
+  payload,
+  type,
+  references = [],
+}: {
+  action: UserAction;
+  type?: string;
+  payload?: Record<string, unknown>;
+  attributesOverrides?: Partial<CaseUserActionAttributes>;
+  commentId?: string;
+  connectorId?: string;
+  pushedConnectorId?: string;
+  references?: SavedObjectReference[];
+}): SavedObject<CaseUserActionAttributes> => {
+  const defaultParams = {
+    action,
+    created_at: 'abc',
+    created_by: {
+      email: 'a',
+      username: 'b',
+      full_name: 'abc',
+    },
+    type: type ?? 'title',
+    payload: payload ?? { title: 'a new title' },
+    owner: 'securitySolution',
+  };
+
+  return {
+    type: CASE_USER_ACTION_SAVED_OBJECT,
+    id: '100',
+    attributes: {
+      ...defaultParams,
+      ...(attributesOverrides && { ...attributesOverrides }),
+    },
+    references: [
+      ...references,
+      {
+        type: CASE_SAVED_OBJECT,
+        name: CASE_REF_NAME,
+        id: '1',
+      },
+      ...(commentId
+        ? [
+            {
+              type: CASE_COMMENT_SAVED_OBJECT,
+              name: COMMENT_REF_NAME,
+              id: commentId,
+            },
+          ]
+        : []),
+      ...(connectorId
+        ? [
+            {
+              type: ACTION_SAVED_OBJECT_TYPE,
+              name: CONNECTOR_ID_REFERENCE_NAME,
+              id: connectorId,
+            },
+          ]
+        : []),
+      ...(pushedConnectorId
+        ? [
+            {
+              type: ACTION_SAVED_OBJECT_TYPE,
+              name: PUSH_CONNECTOR_ID_REFERENCE_NAME,
+              id: pushedConnectorId,
+            },
+          ]
+        : []),
+    ],
+  } as SavedObject<CaseUserActionAttributes>;
+};
+
+export const updateConnectorUserAction = ({
+  overrides,
+}: {
+  overrides?: Partial<CaseUserActionAttributes>;
+} = {}): SavedObject<CaseUserActionAttributes> => {
+  const { id, ...restConnector } = createJiraConnector();
+  return {
+    ...createUserActionSO({
+      action: Actions.update,
+      payload: { connector: restConnector },
+      type: 'connector',
+      connectorId: id,
+    }),
+    ...(overrides && { ...overrides }),
+  };
+};
+
+export const pushConnectorUserAction = ({
+  overrides,
+}: {
+  overrides?: Partial<CaseUserActionAttributes>;
+} = {}): SavedObject<CaseUserActionAttributes> => {
+  const { connector_id: connectorId, ...restExternalService } = createExternalService();
+  return {
+    ...createUserActionSO({
+      action: Actions.push_to_service,
+      payload: { externalService: restExternalService },
+      pushedConnectorId: connectorId,
+      type: 'pushed',
+    }),
+    ...(overrides && { ...overrides }),
+  };
+};
+
+export const createCaseUserAction = (): SavedObject<CaseUserActionAttributes> => {
+  const { id, ...restConnector } = createJiraConnector();
+  return {
+    ...createUserActionSO({
+      action: Actions.create,
+      payload: {
+        connector: restConnector,
+        title: 'a title',
+        description: 'a desc',
+        settings: { syncAlerts: false },
+        status: CaseStatuses.open,
+        severity: CaseSeverity.LOW,
+        tags: [],
+        owner: SECURITY_SOLUTION_OWNER,
+      },
+      connectorId: id,
+      type: 'create_case',
+    }),
+  };
+};
+
+export const createPersistableStateUserAction = () => {
+  return {
+    ...createUserActionSO({
+      action: Actions.create,
+      commentId: 'persistable-state-test-id',
+      payload: {
+        comment: {
+          ...persistableStateAttachment,
+          persistableStateAttachmentState: { foo: 'foo' },
+        },
+      },
+      type: 'comment',
+      references: [{ id: 'testRef', name: 'myTestReference', type: 'test-so' }],
+    }),
+  };
+};
+
+export const createExternalReferenceUserAction = () => {
+  return {
+    ...createUserActionSO({
+      action: Actions.create,
+      commentId: 'external-reference-test-id',
+      payload: {
+        comment: omit(externalReferenceAttachmentSO, 'externalReferenceId'),
+      },
+      type: 'comment',
+      references: [{ id: 'my-id', name: EXTERNAL_REFERENCE_REF_NAME, type: 'test-so' }],
+    }),
+  };
+};
+
+export const testConnectorId = (
+  persistableStateAttachmentTypeRegistry: PersistableStateAttachmentTypeRegistry,
+  userAction: SavedObject<CaseUserActionAttributes>,
+  path: string,
+  expectedConnectorId = '1'
+) => {
+  it('does set payload.connector.id to none when it cannot find the reference', () => {
+    const userActionWithEmptyRef = { ...userAction, references: [] };
+    const transformed = transformFindResponseToExternalModel(
+      createSOFindResponse([createUserActionFindSO(userActionWithEmptyRef)]),
+      persistableStateAttachmentTypeRegistry
+    );
+
+    expect(get(transformed.saved_objects[0].attributes.payload, path)).toBe('none');
+  });
+
+  it('does not populate the payload.connector.id when the reference exists but the action is not of type connector', () => {
+    const invalidUserAction = {
+      ...userAction,
+      attributes: { ...userAction.attributes, type: 'not-connector' },
+    };
+    const transformed = transformFindResponseToExternalModel(
+      createSOFindResponse([
+        createUserActionFindSO(invalidUserAction as SavedObject<CaseUserActionAttributes>),
+      ]),
+      persistableStateAttachmentTypeRegistry
+    );
+
+    expect(get(transformed.saved_objects[0].attributes.payload, path)).toBeUndefined();
+  });
+
+  it('does not populate the payload.connector.id when the reference exists but the payload does not contain a connector', () => {
+    const invalidUserAction = {
+      ...userAction,
+      attributes: { ...userAction.attributes, payload: {} },
+    };
+    const transformed = transformFindResponseToExternalModel(
+      createSOFindResponse([
+        createUserActionFindSO(invalidUserAction as SavedObject<CaseUserActionAttributes>),
+      ]),
+      persistableStateAttachmentTypeRegistry
+    ) as SavedObjectsFindResponse<ConnectorUserAction>;
+
+    expect(get(transformed.saved_objects[0].attributes.payload, path)).toBeUndefined();
+  });
+
+  it('populates the payload.connector.id', () => {
+    const transformed = transformFindResponseToExternalModel(
+      createSOFindResponse([createUserActionFindSO(userAction)]),
+      persistableStateAttachmentTypeRegistry
+    ) as SavedObjectsFindResponse<ConnectorUserAction>;
+
+    expect(get(transformed.saved_objects[0].attributes.payload, path)).toEqual(expectedConnectorId);
+  });
+};
diff --git a/x-pack/plugins/cases/server/services/user_actions/transform.test.ts b/x-pack/plugins/cases/server/services/user_actions/transform.test.ts
new file mode 100644
index 00000000000000..effe650182befa
--- /dev/null
+++ b/x-pack/plugins/cases/server/services/user_actions/transform.test.ts
@@ -0,0 +1,229 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  legacyTransformFindResponseToExternalModel,
+  transformFindResponseToExternalModel,
+} from './transform';
+import { createSOFindResponse } from '../test_utils';
+import {
+  createUserActionFindSO,
+  createConnectorUserAction,
+  createUserActionSO,
+  updateConnectorUserAction,
+  pushConnectorUserAction,
+  createCaseUserAction,
+  createPersistableStateUserAction,
+  createExternalReferenceUserAction,
+  testConnectorId,
+} from './test_utils';
+import { createPersistableStateAttachmentTypeRegistryMock } from '../../attachment_framework/mocks';
+import type { SavedObjectsFindResponse } from '@kbn/core-saved-objects-api-server';
+import type { ConnectorUserAction } from '../../../common/api';
+import { Actions } from '../../../common/api';
+
+describe('transform', () => {
+  const persistableStateAttachmentTypeRegistry = createPersistableStateAttachmentTypeRegistryMock();
+
+  describe('action_id', () => {
+    it('legacyTransformFindResponseToExternalModel sets action_id correctly to the saved object id', () => {
+      const userAction = {
+        ...createUserActionSO({ action: Actions.create, commentId: '5' }),
+      };
+
+      const transformed = legacyTransformFindResponseToExternalModel(
+        createSOFindResponse([createUserActionFindSO(userAction)]),
+        persistableStateAttachmentTypeRegistry
+      );
+
+      expect(transformed.saved_objects[0].attributes.action_id).toEqual('100');
+    });
+
+    it('transformFindResponseToExternalModel does not set action_id', () => {
+      const userAction = {
+        ...createUserActionSO({ action: Actions.create, commentId: '5' }),
+      };
+
+      const transformed = transformFindResponseToExternalModel(
+        createSOFindResponse([createUserActionFindSO(userAction)]),
+        persistableStateAttachmentTypeRegistry
+      );
+
+      expect(transformed.saved_objects[0].attributes).not.toHaveProperty('action_id');
+    });
+  });
+
+  describe('case_id', () => {
+    describe('legacyTransformFindResponseToExternalModel', () => {
+      it('sets case_id correctly when it finds the reference', () => {
+        const userAction = createConnectorUserAction();
+
+        const transformed = legacyTransformFindResponseToExternalModel(
+          createSOFindResponse([createUserActionFindSO(userAction)]),
+          persistableStateAttachmentTypeRegistry
+        );
+
+        expect(transformed.saved_objects[0].attributes.case_id).toEqual('1');
+      });
+
+      it('sets case_id to an empty string when it cannot find the reference', () => {
+        const userAction = {
+          ...createConnectorUserAction(),
+          references: [],
+        };
+        const transformed = legacyTransformFindResponseToExternalModel(
+          createSOFindResponse([createUserActionFindSO(userAction)]),
+          persistableStateAttachmentTypeRegistry
+        );
+
+        expect(transformed.saved_objects[0].attributes.case_id).toEqual('');
+      });
+    });
+
+    describe('transformFindResponseToExternalModel', () => {
+      it('does not set the case_id when the reference exists', () => {
+        const userAction = createConnectorUserAction();
+
+        const transformed = transformFindResponseToExternalModel(
+          createSOFindResponse([createUserActionFindSO(userAction)]),
+          persistableStateAttachmentTypeRegistry
+        );
+
+        expect(transformed.saved_objects[0].attributes).not.toHaveProperty('case_id');
+      });
+
+      it('does not set the case_id when the reference does not exist', () => {
+        const userAction = {
+          ...createConnectorUserAction(),
+          references: [],
+        };
+
+        const transformed = transformFindResponseToExternalModel(
+          createSOFindResponse([createUserActionFindSO(userAction)]),
+          persistableStateAttachmentTypeRegistry
+        );
+
+        expect(transformed.saved_objects[0].attributes).not.toHaveProperty('case_id');
+      });
+    });
+  });
+
+  describe.each([
+    [transformFindResponseToExternalModel.name, transformFindResponseToExternalModel],
+    [legacyTransformFindResponseToExternalModel.name, legacyTransformFindResponseToExternalModel],
+  ])('%s', (functionName, transformer) => {
+    it('does not populate the ids when the response is an empty array', () => {
+      expect(transformer(createSOFindResponse([]), persistableStateAttachmentTypeRegistry))
+        .toMatchInlineSnapshot(`
+        Object {
+          "page": 1,
+          "per_page": 0,
+          "saved_objects": Array [],
+          "total": 0,
+        }
+      `);
+    });
+
+    it('preserves the saved object fields and attributes when inject the ids', () => {
+      const transformed = transformer(
+        createSOFindResponse([createUserActionFindSO(createConnectorUserAction())]),
+        persistableStateAttachmentTypeRegistry
+      );
+
+      expect(transformed).toMatchSnapshot();
+    });
+
+    it('populates the payload.connector.id for multiple user actions', () => {
+      const transformed = transformer(
+        createSOFindResponse([
+          createUserActionFindSO(createConnectorUserAction()),
+          createUserActionFindSO(createConnectorUserAction()),
+        ]),
+        persistableStateAttachmentTypeRegistry
+      ) as SavedObjectsFindResponse<ConnectorUserAction>;
+
+      expect(transformed.saved_objects[0].attributes.payload.connector.id).toEqual('1');
+      expect(transformed.saved_objects[1].attributes.payload.connector.id).toEqual('1');
+    });
+
+    describe('reference ids', () => {
+      it('sets comment_id to null when it cannot find the reference', () => {
+        const userAction = {
+          ...createUserActionSO({ action: Actions.create, commentId: '5' }),
+          references: [],
+        };
+        const transformed = transformer(
+          createSOFindResponse([createUserActionFindSO(userAction)]),
+          persistableStateAttachmentTypeRegistry
+        );
+
+        expect(transformed.saved_objects[0].attributes.comment_id).toBeNull();
+      });
+
+      it('sets comment_id correctly when it finds the reference', () => {
+        const userAction = createUserActionSO({
+          action: Actions.create,
+          commentId: '5',
+        });
+
+        const transformed = transformer(
+          createSOFindResponse([createUserActionFindSO(userAction)]),
+          persistableStateAttachmentTypeRegistry
+        );
+
+        expect(transformed.saved_objects[0].attributes.comment_id).toEqual('5');
+      });
+    });
+
+    describe('create connector', () => {
+      const userAction = createConnectorUserAction();
+      testConnectorId(persistableStateAttachmentTypeRegistry, userAction, 'connector.id');
+    });
+
+    describe('update connector', () => {
+      const userAction = updateConnectorUserAction();
+      testConnectorId(persistableStateAttachmentTypeRegistry, userAction, 'connector.id');
+    });
+
+    describe('push connector', () => {
+      const userAction = pushConnectorUserAction();
+      testConnectorId(
+        persistableStateAttachmentTypeRegistry,
+        userAction,
+        'externalService.connector_id',
+        '100'
+      );
+    });
+
+    describe('create case', () => {
+      const userAction = createCaseUserAction();
+      testConnectorId(persistableStateAttachmentTypeRegistry, userAction, 'connector.id');
+    });
+
+    describe('persistable state attachments', () => {
+      it('populates the persistable state', () => {
+        const transformed = transformer(
+          createSOFindResponse([createUserActionFindSO(createPersistableStateUserAction())]),
+          persistableStateAttachmentTypeRegistry
+        ) as SavedObjectsFindResponse<ConnectorUserAction>;
+
+        expect(transformed).toMatchSnapshot();
+      });
+    });
+
+    describe('external references', () => {
+      it('populates the external references attributes', () => {
+        const transformed = transformer(
+          createSOFindResponse([createUserActionFindSO(createExternalReferenceUserAction())]),
+          persistableStateAttachmentTypeRegistry
+        ) as SavedObjectsFindResponse<ConnectorUserAction>;
+
+        expect(transformed).toMatchSnapshot();
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/cases/server/services/user_actions/transform.ts b/x-pack/plugins/cases/server/services/user_actions/transform.ts
new file mode 100644
index 00000000000000..558a490afbe8b9
--- /dev/null
+++ b/x-pack/plugins/cases/server/services/user_actions/transform.ts
@@ -0,0 +1,200 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SavedObject, SavedObjectReference, SavedObjectsFindResponse } from '@kbn/core/server';
+
+import { isCommentRequestTypePersistableState } from '../../../common/utils/attachments';
+import {
+  isConnectorUserAction,
+  isPushedUserAction,
+  isCreateCaseUserAction,
+  isCommentUserAction,
+} from '../../../common/utils/user_actions';
+import type {
+  CaseUserActionAttributes,
+  CaseUserActionAttributesWithoutConnectorId,
+  CaseUserActionInjectedAttributesWithoutActionId,
+  CaseUserActionResponse,
+} from '../../../common/api';
+import { NONE_CONNECTOR_ID } from '../../../common/api';
+import { CASE_SAVED_OBJECT, CASE_COMMENT_SAVED_OBJECT } from '../../../common/constants';
+import {
+  CASE_REF_NAME,
+  COMMENT_REF_NAME,
+  CONNECTOR_ID_REFERENCE_NAME,
+  EXTERNAL_REFERENCE_REF_NAME,
+  PUSH_CONNECTOR_ID_REFERENCE_NAME,
+} from '../../common/constants';
+import { findConnectorIdReference } from '../transform';
+import { isCommentRequestTypeExternalReferenceSO } from '../../common/utils';
+import type { PersistableStateAttachmentTypeRegistry } from '../../attachment_framework/persistable_state_registry';
+import { injectPersistableReferencesToSO } from '../../attachment_framework/so_references';
+
+export function transformFindResponseToExternalModel(
+  userActions: SavedObjectsFindResponse<CaseUserActionAttributesWithoutConnectorId>,
+  persistableStateAttachmentTypeRegistry: PersistableStateAttachmentTypeRegistry
+): SavedObjectsFindResponse<CaseUserActionInjectedAttributesWithoutActionId> {
+  return {
+    ...userActions,
+    saved_objects: userActions.saved_objects.map((so) => ({
+      ...so,
+      ...transformToExternalModel(so, persistableStateAttachmentTypeRegistry),
+    })),
+  };
+}
+
+export function transformToExternalModel(
+  userAction: SavedObject<CaseUserActionAttributesWithoutConnectorId>,
+  persistableStateAttachmentTypeRegistry: PersistableStateAttachmentTypeRegistry
+): SavedObject<CaseUserActionInjectedAttributesWithoutActionId> {
+  const { references } = userAction;
+
+  const commentId =
+    findReferenceId(COMMENT_REF_NAME, CASE_COMMENT_SAVED_OBJECT, references) ?? null;
+  const payload = addReferenceIdToPayload(userAction, persistableStateAttachmentTypeRegistry);
+
+  return {
+    ...userAction,
+    attributes: {
+      ...userAction.attributes,
+      comment_id: commentId,
+      payload,
+    } as CaseUserActionInjectedAttributesWithoutActionId,
+  };
+}
+
+/**
+ * This function should only be used in the getAll user actions and it is deprecated. It should be removed when the
+ * getAll route is removed.
+ *
+ * @deprecated remove when the getAllRoute is removed
+ */
+export function legacyTransformFindResponseToExternalModel(
+  userActions: SavedObjectsFindResponse<CaseUserActionAttributesWithoutConnectorId>,
+  persistableStateAttachmentTypeRegistry: PersistableStateAttachmentTypeRegistry
+): SavedObjectsFindResponse<CaseUserActionResponse> {
+  return {
+    ...userActions,
+    saved_objects: userActions.saved_objects.map((so) => ({
+      ...so,
+      ...legacyTransformToExternalModel(so, persistableStateAttachmentTypeRegistry),
+    })),
+  };
+}
+
+/**
+ * @deprecated remove when the getAll route is removed
+ */
+function legacyTransformToExternalModel(
+  userAction: SavedObject<CaseUserActionAttributesWithoutConnectorId>,
+  persistableStateAttachmentTypeRegistry: PersistableStateAttachmentTypeRegistry
+): SavedObject<CaseUserActionResponse> {
+  const { references } = userAction;
+
+  const caseId = findReferenceId(CASE_REF_NAME, CASE_SAVED_OBJECT, references) ?? '';
+  const commentId =
+    findReferenceId(COMMENT_REF_NAME, CASE_COMMENT_SAVED_OBJECT, references) ?? null;
+  const payload = addReferenceIdToPayload(userAction, persistableStateAttachmentTypeRegistry);
+
+  return {
+    ...userAction,
+    attributes: {
+      ...userAction.attributes,
+      action_id: userAction.id,
+      case_id: caseId,
+      comment_id: commentId,
+      payload,
+    } as CaseUserActionResponse,
+  };
+}
+
+const addReferenceIdToPayload = (
+  userAction: SavedObject<CaseUserActionAttributes>,
+  persistableStateAttachmentTypeRegistry: PersistableStateAttachmentTypeRegistry
+): CaseUserActionAttributes['payload'] => {
+  const connectorId = getConnectorIdFromReferences(userAction);
+  const userActionAttributes = userAction.attributes;
+
+  if (isConnectorUserAction(userActionAttributes) || isCreateCaseUserAction(userActionAttributes)) {
+    return {
+      ...userActionAttributes.payload,
+      connector: {
+        ...userActionAttributes.payload.connector,
+        id: connectorId ?? NONE_CONNECTOR_ID,
+      },
+    };
+  } else if (isPushedUserAction(userActionAttributes)) {
+    return {
+      ...userAction.attributes.payload,
+      externalService: {
+        ...userActionAttributes.payload.externalService,
+        connector_id: connectorId ?? NONE_CONNECTOR_ID,
+      },
+    };
+  } else if (isCommentUserAction(userActionAttributes)) {
+    if (isCommentRequestTypeExternalReferenceSO(userActionAttributes.payload.comment)) {
+      const externalReferenceId = findReferenceId(
+        EXTERNAL_REFERENCE_REF_NAME,
+        userActionAttributes.payload.comment.externalReferenceStorage.soType,
+        userAction.references
+      );
+
+      return {
+        ...userAction.attributes.payload,
+        comment: {
+          ...userActionAttributes.payload.comment,
+          externalReferenceId: externalReferenceId ?? '',
+        },
+      };
+    }
+
+    if (isCommentRequestTypePersistableState(userActionAttributes.payload.comment)) {
+      const injectedAttributes = injectPersistableReferencesToSO(
+        userActionAttributes.payload.comment,
+        userAction.references,
+        {
+          persistableStateAttachmentTypeRegistry,
+        }
+      );
+
+      return {
+        ...userAction.attributes.payload,
+        comment: {
+          ...userActionAttributes.payload.comment,
+          ...injectedAttributes,
+        },
+      };
+    }
+  }
+
+  return userAction.attributes.payload;
+};
+
+function getConnectorIdFromReferences(
+  userAction: SavedObject<CaseUserActionAttributes>
+): string | null {
+  const { references } = userAction;
+
+  if (
+    isConnectorUserAction(userAction.attributes) ||
+    isCreateCaseUserAction(userAction.attributes)
+  ) {
+    return findConnectorIdReference(CONNECTOR_ID_REFERENCE_NAME, references)?.id ?? null;
+  } else if (isPushedUserAction(userAction.attributes)) {
+    return findConnectorIdReference(PUSH_CONNECTOR_ID_REFERENCE_NAME, references)?.id ?? null;
+  }
+
+  return null;
+}
+
+function findReferenceId(
+  name: string,
+  type: string,
+  references: SavedObjectReference[]
+): string | undefined {
+  return references.find((ref) => ref.name === name && ref.type === type)?.id;
+}
diff --git a/x-pack/plugins/cases/server/services/user_actions/types.ts b/x-pack/plugins/cases/server/services/user_actions/types.ts
index 377a7217cdd025..dc37ec06d9f564 100644
--- a/x-pack/plugins/cases/server/services/user_actions/types.ts
+++ b/x-pack/plugins/cases/server/services/user_actions/types.ts
@@ -19,7 +19,7 @@ import type {
   CaseSettings,
   CaseSeverity,
   CaseStatuses,
-  CaseUserActionResponse,
+  CaseUserActionInjectedAttributesWithoutActionId,
   CommentUserAction,
   ConnectorUserAction,
   PushedUserAction,
@@ -145,11 +145,14 @@ export interface ServiceContext {
 
 export interface CaseConnectorActivity {
   connectorId: string;
-  fields: SavedObject<CaseUserActionResponse>;
-  push?: SavedObject<CaseUserActionResponse>;
+  fields: SavedObject<CaseUserActionInjectedAttributesWithoutActionId>;
+  push?: SavedObject<CaseUserActionInjectedAttributesWithoutActionId>;
 }
 
-export type CaseConnectorFields = Map<string, SavedObject<CaseUserActionResponse>>;
+export type CaseConnectorFields = Map<
+  string,
+  SavedObject<CaseUserActionInjectedAttributesWithoutActionId>
+>;
 
 export interface PushInfo {
   date: Date;
diff --git a/x-pack/plugins/cases/tsconfig.json b/x-pack/plugins/cases/tsconfig.json
index bb4cc5f9e59c78..af2f1a29a64d1f 100644
--- a/x-pack/plugins/cases/tsconfig.json
+++ b/x-pack/plugins/cases/tsconfig.json
@@ -52,6 +52,7 @@
     "@kbn/safer-lodash-set",
     "@kbn/logging-mocks",
     "@kbn/ecs",
+    "@kbn/core-saved-objects-api-server",
     "@kbn/core-saved-objects-base-server-mocks",
   ],
   "exclude": [
diff --git a/x-pack/test/cases_api_integration/common/lib/user_actions.ts b/x-pack/test/cases_api_integration/common/lib/user_actions.ts
new file mode 100644
index 00000000000000..8c3723aab731fb
--- /dev/null
+++ b/x-pack/test/cases_api_integration/common/lib/user_actions.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  UserActionFindResponse,
+  getCaseFindUserActionsUrl,
+  UserActionFindRequest,
+  CaseUserActionsResponse,
+  getCaseUserActionUrl,
+  CaseUserActionResponse,
+} from '@kbn/cases-plugin/common/api';
+import type SuperTest from 'supertest';
+import { User } from './authentication/types';
+
+import { superUser } from './authentication/users';
+import { getSpaceUrlPrefix, removeServerGeneratedPropertiesFromObject } from './utils';
+
+export const removeServerGeneratedPropertiesFromUserAction = (
+  attributes: CaseUserActionResponse
+) => {
+  const keysToRemove: Array<keyof CaseUserActionResponse> = ['action_id', 'created_at'];
+  return removeServerGeneratedPropertiesFromObject<
+    CaseUserActionResponse,
+    typeof keysToRemove[number]
+  >(attributes, keysToRemove);
+};
+
+export const getCaseUserActions = async ({
+  supertest,
+  caseID,
+  expectedHttpCode = 200,
+  auth = { user: superUser, space: null },
+}: {
+  supertest: SuperTest.SuperTest<SuperTest.Test>;
+  caseID: string;
+  expectedHttpCode?: number;
+  auth?: { user: User; space: string | null };
+}): Promise<CaseUserActionsResponse> => {
+  const { body: userActions } = await supertest
+    .get(`${getSpaceUrlPrefix(auth.space)}${getCaseUserActionUrl(caseID)}`)
+    .auth(auth.user.username, auth.user.password)
+    .expect(expectedHttpCode);
+  return userActions;
+};
+
+export const findCaseUserActions = async ({
+  supertest,
+  caseID,
+  options = {},
+  expectedHttpCode = 200,
+  auth = { user: superUser, space: null },
+}: {
+  supertest: SuperTest.SuperTest<SuperTest.Test>;
+  caseID: string;
+  options?: UserActionFindRequest;
+  expectedHttpCode?: number;
+  auth?: { user: User; space: string | null };
+}): Promise<UserActionFindResponse> => {
+  const { body: userActions } = await supertest
+    .get(`${getSpaceUrlPrefix(auth.space)}${getCaseFindUserActionsUrl(caseID)}`)
+    .query(options)
+    .auth(auth.user.username, auth.user.password)
+    .expect(expectedHttpCode);
+
+  return userActions;
+};
diff --git a/x-pack/test/cases_api_integration/common/lib/utils.ts b/x-pack/test/cases_api_integration/common/lib/utils.ts
index 58dc5674315467..4067fc12f75152 100644
--- a/x-pack/test/cases_api_integration/common/lib/utils.ts
+++ b/x-pack/test/cases_api_integration/common/lib/utils.ts
@@ -33,7 +33,6 @@ import {
   CasesResponse,
   CasesFindResponse,
   CommentRequest,
-  CaseUserActionResponse,
   CommentResponse,
   CasesPatchRequest,
   AllCommentsResponse,
@@ -41,7 +40,6 @@ import {
   CasesConfigurePatch,
   CasesStatusResponse,
   CasesConfigurationsResponse,
-  CaseUserActionsResponse,
   AlertResponse,
   ConnectorMappings,
   CasesByAlertId,
@@ -52,7 +50,6 @@ import {
   CasesMetricsResponse,
   CasesBulkGetResponse,
 } from '@kbn/cases-plugin/common/api';
-import { getCaseUserActionUrl } from '@kbn/cases-plugin/common/api/helpers';
 import { SignalHit } from '@kbn/security-solution-plugin/server/lib/detection_engine/signals/types';
 import { ActionResult } from '@kbn/actions-plugin/server/types';
 import { ESCasesConfigureAttributes } from '@kbn/cases-plugin/server/services/configure/types';
@@ -231,7 +228,7 @@ interface CommonSavedObjectAttributes {
 
 const savedObjectCommonAttributes = ['created_at', 'updated_at', 'version', 'id'];
 
-const removeServerGeneratedPropertiesFromObject = <T extends object, K extends keyof T>(
+export const removeServerGeneratedPropertiesFromObject = <T extends object, K extends keyof T>(
   object: T,
   keys: K[]
 ): Omit<T, K> => {
@@ -249,16 +246,6 @@ export const removeServerGeneratedPropertiesFromSavedObject = <
   ]);
 };
 
-export const removeServerGeneratedPropertiesFromUserAction = (
-  attributes: CaseUserActionResponse
-) => {
-  const keysToRemove: Array<keyof CaseUserActionResponse> = ['action_id', 'created_at'];
-  return removeServerGeneratedPropertiesFromObject<
-    CaseUserActionResponse,
-    typeof keysToRemove[number]
-  >(attributes, keysToRemove);
-};
-
 export const removeServerGeneratedPropertiesFromCase = (
   theCase: CaseResponse
 ): Partial<CaseResponse> => {
@@ -602,24 +589,6 @@ export const updateCase = async ({
   return cases;
 };
 
-export const getCaseUserActions = async ({
-  supertest,
-  caseID,
-  expectedHttpCode = 200,
-  auth = { user: superUser, space: null },
-}: {
-  supertest: SuperTest.SuperTest<SuperTest.Test>;
-  caseID: string;
-  expectedHttpCode?: number;
-  auth?: { user: User; space: string | null };
-}): Promise<CaseUserActionsResponse> => {
-  const { body: userActions } = await supertest
-    .get(`${getSpaceUrlPrefix(auth.space)}${getCaseUserActionUrl(caseID)}`)
-    .auth(auth.user.username, auth.user.password)
-    .expect(expectedHttpCode);
-  return userActions;
-};
-
 export const deleteComment = async ({
   supertest,
   caseId,
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/attachments_framework/external_references.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/attachments_framework/external_references.ts
index 48f050cd960162..5a36f2a30d39a2 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/attachments_framework/external_references.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/attachments_framework/external_references.ts
@@ -25,13 +25,13 @@ import {
   deleteAllCaseItems,
   createCase,
   createComment,
-  getCaseUserActions,
   removeServerGeneratedPropertiesFromSavedObject,
   bulkCreateAttachments,
   updateComment,
   getSOFromKibanaIndex,
   getReferenceFromEsResponse,
 } from '../../../../common/lib/utils';
+import { getCaseUserActions } from '../../../../common/lib/user_actions';
 
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/attachments_framework/persistable_state.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/attachments_framework/persistable_state.ts
index e1c5ff72160515..b13258cb1704f6 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/attachments_framework/persistable_state.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/attachments_framework/persistable_state.ts
@@ -24,7 +24,6 @@ import {
   deleteAllCaseItems,
   createCase,
   createComment,
-  getCaseUserActions,
   removeServerGeneratedPropertiesFromSavedObject,
   getComment,
   getSOFromKibanaIndex,
@@ -32,6 +31,7 @@ import {
   bulkCreateAttachments,
   updateComment,
 } from '../../../../common/lib/utils';
+import { getCaseUserActions } from '../../../../common/lib/user_actions';
 
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts
index fd6e5ab18d5e20..87a3321a4f70e4 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/delete_cases.ts
@@ -19,8 +19,8 @@ import {
   getComment,
   getCase,
   superUserSpace1Auth,
-  getCaseUserActions,
 } from '../../../../common/lib/utils';
+import { getCaseUserActions } from '../../../../common/lib/user_actions';
 import {
   secOnly,
   secOnlyRead,
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/import_export.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/import_export.ts
index fb12f7c00e6b81..20e7a5a9309a30 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/import_export.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/import_export.ts
@@ -36,8 +36,8 @@ import {
   createCase,
   createComment,
   findCases,
-  getCaseUserActions,
 } from '../../../../common/lib/utils';
+import { getCaseUserActions } from '../../../../common/lib/user_actions';
 import { getPostCaseRequest, postCommentUserReq } from '../../../../common/lib/mock';
 import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts
index 403d74e2290d0f..4c74c802a663cf 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/patch_cases.ts
@@ -30,14 +30,16 @@ import {
   createCase,
   createComment,
   updateCase,
-  getCaseUserActions,
   removeServerGeneratedPropertiesFromCase,
-  removeServerGeneratedPropertiesFromUserAction,
   findCases,
   superUserSpace1Auth,
   delay,
   calculateDuration,
 } from '../../../../common/lib/utils';
+import {
+  getCaseUserActions,
+  removeServerGeneratedPropertiesFromUserAction,
+} from '../../../../common/lib/user_actions';
 import {
   createSignalsIndex,
   deleteSignalsIndex,
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/post_case.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/post_case.ts
index 47a1e197ac2132..481942f6953687 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/post_case.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/cases/post_case.ts
@@ -19,9 +19,11 @@ import {
   deleteCasesByESQuery,
   createCase,
   removeServerGeneratedPropertiesFromCase,
-  removeServerGeneratedPropertiesFromUserAction,
-  getCaseUserActions,
 } from '../../../../common/lib/utils';
+import {
+  getCaseUserActions,
+  removeServerGeneratedPropertiesFromUserAction,
+} from '../../../../common/lib/user_actions';
 import {
   secOnly,
   secOnlyRead,
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/post_comment.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
index 681f0262465426..c969a3791d6fc4 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/comments/post_comment.ts
@@ -31,12 +31,14 @@ import {
   deleteComments,
   createCase,
   createComment,
-  getCaseUserActions,
-  removeServerGeneratedPropertiesFromUserAction,
   removeServerGeneratedPropertiesFromSavedObject,
   superUserSpace1Auth,
   updateCase,
 } from '../../../../common/lib/utils';
+import {
+  getCaseUserActions,
+  removeServerGeneratedPropertiesFromUserAction,
+} from '../../../../common/lib/user_actions';
 import {
   createSignalsIndex,
   deleteSignalsIndex,
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/index.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/index.ts
index be45913156e497..61bee280378eca 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/index.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/index.ts
@@ -30,6 +30,7 @@ export default ({ loadTestFile }: FtrProviderContext): void => {
     loadTestFile(require.resolve('./cases/status/get_status'));
     loadTestFile(require.resolve('./cases/tags/get_tags'));
     loadTestFile(require.resolve('./user_actions/get_all_user_actions'));
+    loadTestFile(require.resolve('./user_actions/find_user_actions'));
     loadTestFile(require.resolve('./configure/get_configure'));
     loadTestFile(require.resolve('./configure/patch_configure'));
     loadTestFile(require.resolve('./configure/post_configure'));
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/bulk_create_attachments.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/bulk_create_attachments.ts
index f3c1b190260bce..bdecb88b1758f2 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/bulk_create_attachments.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/bulk_create_attachments.ts
@@ -28,14 +28,16 @@ import {
 import {
   deleteAllCaseItems,
   createCase,
-  getCaseUserActions,
-  removeServerGeneratedPropertiesFromUserAction,
   removeServerGeneratedPropertiesFromSavedObject,
   superUserSpace1Auth,
   createCaseAndBulkCreateAttachments,
   bulkCreateAttachments,
   updateCase,
 } from '../../../../common/lib/utils';
+import {
+  getCaseUserActions,
+  removeServerGeneratedPropertiesFromUserAction,
+} from '../../../../common/lib/user_actions';
 import {
   createSignalsIndex,
   deleteSignalsIndex,
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/find_user_actions.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/find_user_actions.ts
new file mode 100644
index 00000000000000..b117025a19303b
--- /dev/null
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/find_user_actions.ts
@@ -0,0 +1,920 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+import {
+  ActionTypes,
+  CaseResponse,
+  CaseSeverity,
+  CaseStatuses,
+  CommentUserAction,
+  ConnectorTypes,
+  FindTypes,
+} from '@kbn/cases-plugin/common/api';
+import {
+  globalRead,
+  noKibanaPrivileges,
+  obsOnly,
+  obsOnlyRead,
+  secOnly,
+  secOnlyRead,
+  superUser,
+} from '../../../../common/lib/authentication/users';
+import { findCaseUserActions, getCaseUserActions } from '../../../../common/lib/user_actions';
+import {
+  getPostCaseRequest,
+  persistableStateAttachment,
+  postCommentActionsReq,
+  postCommentAlertReq,
+  postCommentUserReq,
+  postExternalReferenceESReq,
+} from '../../../../common/lib/mock';
+import {
+  deleteAllCaseItems,
+  createCase,
+  updateCase,
+  createComment,
+  bulkCreateAttachments,
+} from '../../../../common/lib/utils';
+
+import { FtrProviderContext } from '../../../../common/ftr_provider_context';
+
+// eslint-disable-next-line import/no-default-export
+export default ({ getService }: FtrProviderContext): void => {
+  const supertest = getService('supertest');
+  const es = getService('es');
+
+  describe('find_user_actions', () => {
+    afterEach(async () => {
+      await deleteAllCaseItems(es);
+    });
+
+    it('returns the id and version fields but not action_id', async () => {
+      const theCase = await createCase(supertest, getPostCaseRequest());
+
+      const allUserActions = await getCaseUserActions({ supertest, caseID: theCase.id });
+
+      const response = await findCaseUserActions({
+        caseID: theCase.id,
+        supertest,
+      });
+
+      expect(response.userActions.length).to.be(1);
+      expect(response.userActions[0].id).not.to.be(undefined);
+      expect(response.userActions[0].id).to.eql(allUserActions[0].action_id);
+      expect(response.userActions[0].version).not.to.be(undefined);
+      expect(response.userActions[0]).not.to.have.property('action_id');
+      expect(response.userActions[0]).not.to.have.property('case_id');
+    });
+
+    describe('default parameters', () => {
+      it('performs a search using the default parameters when no query params are sent', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await createComment({
+          supertest,
+          caseId: theCase.id,
+          params: postCommentUserReq,
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+        });
+
+        expect(response.userActions.length).to.be(2);
+
+        const createCaseUserAction = response.userActions[0];
+        expect(createCaseUserAction.type).to.eql('create_case');
+        expect(createCaseUserAction.action).to.eql('create');
+
+        const commentUserAction = response.userActions[1];
+        expect(commentUserAction.type).to.eql('comment');
+        expect(commentUserAction.action).to.eql('create');
+
+        expect(response.page).to.be(1);
+        expect(response.perPage).to.be(20);
+        expect(response.total).to.be(2);
+      });
+    });
+
+    describe('sorting', () => {
+      it('sorts the results in descending order by the created_at field', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await createComment({
+          supertest,
+          caseId: theCase.id,
+          params: postCommentUserReq,
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'desc',
+            types: [ActionTypes.comment, ActionTypes.create_case],
+          },
+        });
+
+        expect(response.userActions.length).to.be(2);
+
+        const commentUserAction = response.userActions[0];
+        expect(commentUserAction.type).to.eql('comment');
+        expect(commentUserAction.action).to.eql('create');
+      });
+    });
+
+    describe('pagination', () => {
+      let theCase: CaseResponse;
+
+      beforeEach(async () => {
+        theCase = await createCase(supertest, getPostCaseRequest());
+
+        await bulkCreateAttachments({
+          supertest,
+          caseId: theCase.id,
+          params: [postCommentUserReq, postCommentUserReq],
+        });
+      });
+
+      it('retrieves only 1 user action when perPage is 1', async () => {
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.comment, ActionTypes.create_case],
+            perPage: 1,
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const commentUserAction = response.userActions[0];
+        expect(commentUserAction.type).to.eql('create_case');
+        expect(commentUserAction.action).to.eql('create');
+      });
+
+      it('retrieves 2 user action when perPage is 2 and there are 3 user actions', async () => {
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.comment, ActionTypes.create_case],
+            perPage: 2,
+          },
+        });
+
+        expect(response.userActions.length).to.be(2);
+        expect(response.total).to.be(3);
+
+        const createCaseUserAction = response.userActions[0];
+        expect(createCaseUserAction.type).to.eql('create_case');
+        expect(createCaseUserAction.action).to.eql('create');
+
+        const commentUserAction = response.userActions[1];
+        expect(commentUserAction.type).to.eql('comment');
+        expect(commentUserAction.action).to.eql('create');
+      });
+
+      it('retrieves the second page of results', async () => {
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.comment, ActionTypes.create_case],
+            page: 2,
+            perPage: 1,
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+        expect(response.total).to.be(3);
+        expect(response.userActions[0].type).to.eql('comment');
+        expect(response.userActions[0].action).to.eql('create');
+      });
+
+      it('retrieves the third page of results', async () => {
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.comment, ActionTypes.create_case],
+            page: 3,
+            perPage: 1,
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+        expect(response.total).to.be(3);
+        expect(response.userActions[0].type).to.eql('comment');
+        expect(response.userActions[0].action).to.eql('create');
+      });
+
+      it('retrieves all the results with a perPage larger than the total', async () => {
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.comment, ActionTypes.create_case],
+            page: 1,
+            perPage: 10,
+          },
+        });
+
+        expect(response.userActions.length).to.be(3);
+        expect(response.total).to.be(3);
+        expect(response.userActions[0].type).to.eql('create_case');
+        expect(response.userActions[0].action).to.eql('create');
+      });
+    });
+
+    describe('filters using the type query parameter', () => {
+      it('returns a 400 when filtering for an invalid type', async () => {
+        await findCaseUserActions({
+          caseID: '123',
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            // @ts-expect-error using an invalid filter type
+            types: ['invalid-type'],
+          },
+          expectedHttpCode: 400,
+        });
+      });
+
+      it('returns an empty array when the user action type does not exist', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.comment],
+          },
+        });
+
+        expect(response.userActions.length).to.be(0);
+      });
+
+      it('retrieves only the comment user actions', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await createComment({
+          supertest,
+          caseId: theCase.id,
+          params: postCommentUserReq,
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.comment],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const commentUserAction = response.userActions[0];
+        expect(commentUserAction.type).to.eql('comment');
+        expect(commentUserAction.action).to.eql('create');
+        expect(commentUserAction.payload).to.eql({
+          comment: postCommentUserReq,
+        });
+      });
+
+      it('retrieves only the connector user actions', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await updateCase({
+          params: {
+            cases: [
+              {
+                id: theCase.id,
+                version: theCase.version,
+                connector: {
+                  id: 'my-jira',
+                  name: 'jira',
+                  type: ConnectorTypes.jira,
+                  fields: {
+                    issueType: 'task',
+                    parent: null,
+                    priority: null,
+                  },
+                },
+              },
+            ],
+          },
+          supertest,
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.connector],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const updateConnectorUserAction = response.userActions[0];
+        expect(updateConnectorUserAction.type).to.eql('connector');
+        expect(updateConnectorUserAction.action).to.eql('update');
+        expect(updateConnectorUserAction.payload).to.eql({
+          connector: {
+            id: 'my-jira',
+            name: 'jira',
+            type: ConnectorTypes.jira,
+            fields: {
+              issueType: 'task',
+              parent: null,
+              priority: null,
+            },
+          },
+        });
+      });
+
+      it('retrieves only the description user actions', async () => {
+        const newDesc = 'Such a great description';
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await updateCase({
+          supertest,
+          params: {
+            cases: [
+              {
+                id: theCase.id,
+                version: theCase.version,
+                description: newDesc,
+              },
+            ],
+          },
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.description],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const descriptionUserAction = response.userActions[0];
+
+        expect(descriptionUserAction.type).to.eql('description');
+        expect(descriptionUserAction.action).to.eql('update');
+        expect(descriptionUserAction.payload).to.eql({ description: newDesc });
+      });
+
+      it('retrieves only the tags user actions', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await updateCase({
+          supertest,
+          params: {
+            cases: [
+              {
+                id: theCase.id,
+                version: theCase.version,
+                tags: ['cool', 'neat'],
+              },
+            ],
+          },
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.tags],
+          },
+        });
+
+        expect(response.userActions.length).to.be(2);
+
+        const addTagsUserAction = response.userActions[0];
+        const deleteTagsUserAction = response.userActions[1];
+
+        expect(addTagsUserAction.type).to.eql('tags');
+        expect(addTagsUserAction.action).to.eql('add');
+        expect(addTagsUserAction.payload).to.eql({ tags: ['cool', 'neat'] });
+        expect(deleteTagsUserAction.type).to.eql('tags');
+        expect(deleteTagsUserAction.action).to.eql('delete');
+        expect(deleteTagsUserAction.payload).to.eql({ tags: ['defacement'] });
+      });
+
+      it('retrieves only the title user actions', async () => {
+        const newTitle = 'Such a great title';
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await updateCase({
+          supertest,
+          params: {
+            cases: [
+              {
+                id: theCase.id,
+                version: theCase.version,
+                title: newTitle,
+              },
+            ],
+          },
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.title],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const descriptionUserAction = response.userActions[0];
+
+        expect(descriptionUserAction.type).to.eql('title');
+        expect(descriptionUserAction.action).to.eql('update');
+        expect(descriptionUserAction.payload).to.eql({ title: newTitle });
+      });
+
+      it('retrieves only the status user actions', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await updateCase({
+          supertest,
+          params: {
+            cases: [
+              {
+                id: theCase.id,
+                version: theCase.version,
+                status: CaseStatuses.closed,
+              },
+            ],
+          },
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.status],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const statusUserAction = response.userActions[0];
+
+        expect(statusUserAction.type).to.eql('status');
+        expect(statusUserAction.action).to.eql('update');
+        expect(statusUserAction.payload).to.eql({ status: 'closed' });
+      });
+
+      it('retrieves only the settings user actions', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await updateCase({
+          supertest,
+          params: {
+            cases: [
+              {
+                id: theCase.id,
+                version: theCase.version,
+                settings: { syncAlerts: false },
+              },
+            ],
+          },
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.settings],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const settingsUserAction = response.userActions[0];
+
+        expect(settingsUserAction.type).to.eql('settings');
+        expect(settingsUserAction.action).to.eql('update');
+        expect(settingsUserAction.payload).to.eql({ settings: { syncAlerts: false } });
+      });
+
+      it('retrieves only the severity user actions', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await updateCase({
+          supertest,
+          params: {
+            cases: [
+              {
+                id: theCase.id,
+                version: theCase.version,
+                severity: CaseSeverity.HIGH,
+              },
+            ],
+          },
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.severity],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const severityUserAction = response.userActions[0];
+
+        expect(severityUserAction.type).to.eql('severity');
+        expect(severityUserAction.action).to.eql('update');
+        expect(severityUserAction.payload).to.eql({ severity: CaseSeverity.HIGH });
+      });
+
+      it('retrieves only the create_case user actions', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.create_case],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const createCaseUserAction = response.userActions[0];
+
+        expect(createCaseUserAction.type).to.eql('create_case');
+        expect(createCaseUserAction.action).to.eql('create');
+      });
+
+      it('retrieves any non user comment user actions using the action filter', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        const updatedCase = await bulkCreateAttachments({
+          supertest,
+          caseId: theCase.id,
+          params: [
+            postCommentUserReq,
+            postExternalReferenceESReq,
+            persistableStateAttachment,
+            postCommentActionsReq,
+          ],
+        });
+
+        await updateCase({
+          supertest,
+          params: {
+            cases: [
+              {
+                id: updatedCase.id,
+                version: updatedCase.version,
+                severity: CaseSeverity.HIGH,
+              },
+            ],
+          },
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [FindTypes.action],
+          },
+        });
+
+        expect(response.userActions.length).to.be(5);
+
+        const createCaseUserAction = response.userActions[0];
+
+        expect(createCaseUserAction.type).to.eql('create_case');
+        expect(createCaseUserAction.action).to.eql('create');
+
+        const externalRef = response.userActions[1] as CommentUserAction;
+
+        expect(externalRef.type).to.eql('comment');
+        expect(externalRef.payload.comment.type).to.eql('externalReference');
+        expect(externalRef.action).to.eql('create');
+
+        const persistableState = response.userActions[2] as CommentUserAction;
+
+        expect(persistableState.type).to.eql('comment');
+        expect(persistableState.payload.comment.type).to.eql('persistableState');
+        expect(persistableState.action).to.eql('create');
+
+        const actions = response.userActions[3] as CommentUserAction;
+
+        expect(actions.type).to.eql('comment');
+        expect(actions.payload.comment.type).to.eql('actions');
+        expect(actions.action).to.eql('create');
+
+        expect(response.userActions[4].type).to.eql('severity');
+        expect(response.userActions[4].action).to.eql('update');
+      });
+
+      it('retrieves only alert user actions', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await bulkCreateAttachments({
+          supertest,
+          caseId: theCase.id,
+          params: [postCommentUserReq, postCommentAlertReq],
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [FindTypes.alert],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const alertUserAction = response.userActions[0] as CommentUserAction;
+
+        expect(alertUserAction.type).to.eql('comment');
+        expect(alertUserAction.action).to.eql('create');
+        expect(alertUserAction.payload.comment.type).to.eql('alert');
+      });
+
+      it('retrieves only user comment user actions', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await bulkCreateAttachments({
+          supertest,
+          caseId: theCase.id,
+          params: [postCommentUserReq, postCommentActionsReq, postCommentAlertReq],
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [FindTypes.user],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const userCommentUserAction = response.userActions[0] as CommentUserAction;
+
+        expect(userCommentUserAction.type).to.eql('comment');
+        expect(userCommentUserAction.action).to.eql('create');
+        expect(userCommentUserAction.payload.comment.type).to.eql('user');
+      });
+
+      it('retrieves attachment user actions', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await bulkCreateAttachments({
+          supertest,
+          caseId: theCase.id,
+          params: [
+            // This one should not show up in the filter for attachments
+            postCommentUserReq,
+            postExternalReferenceESReq,
+            persistableStateAttachment,
+            // This one should not show up in the filter for attachments
+            postCommentActionsReq,
+            // This one should not show up in the filter for attachments
+            postCommentAlertReq,
+          ],
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [FindTypes.attachment],
+          },
+        });
+
+        expect(response.userActions.length).to.be(2);
+
+        const externalRefUserAction = response.userActions[0] as CommentUserAction;
+
+        expect(externalRefUserAction.type).to.eql('comment');
+        expect(externalRefUserAction.action).to.eql('create');
+        expect(externalRefUserAction.payload.comment.type).to.eql('externalReference');
+
+        const peristableStateUserAction = response.userActions[1] as CommentUserAction;
+
+        expect(peristableStateUserAction.type).to.eql('comment');
+        expect(peristableStateUserAction.action).to.eql('create');
+        expect(peristableStateUserAction.payload.comment.type).to.eql('persistableState');
+      });
+
+      describe('filtering on multiple types', () => {
+        it('retrieves the create_case and comment user actions', async () => {
+          const theCase = await createCase(supertest, getPostCaseRequest());
+
+          await createComment({
+            supertest,
+            caseId: theCase.id,
+            params: postCommentUserReq,
+          });
+
+          const response = await findCaseUserActions({
+            caseID: theCase.id,
+            supertest,
+            options: {
+              sortOrder: 'asc',
+              types: [ActionTypes.create_case, ActionTypes.comment],
+            },
+          });
+
+          expect(response.userActions.length).to.be(2);
+
+          const createCaseUserAction = response.userActions[0];
+          expect(createCaseUserAction.type).to.eql('create_case');
+          expect(createCaseUserAction.action).to.eql('create');
+
+          const commentUserAction = response.userActions[1];
+          expect(commentUserAction.type).to.eql('comment');
+          expect(commentUserAction.action).to.eql('create');
+        });
+
+        it('retrieves the create_case user action when there are not valid comment user actions', async () => {
+          const theCase = await createCase(supertest, getPostCaseRequest());
+
+          const response = await findCaseUserActions({
+            caseID: theCase.id,
+            supertest,
+            options: {
+              sortOrder: 'asc',
+              types: [ActionTypes.create_case, ActionTypes.comment],
+            },
+          });
+
+          expect(response.userActions.length).to.be(1);
+
+          const createCaseUserAction = response.userActions[0];
+          expect(createCaseUserAction.type).to.eql('create_case');
+          expect(createCaseUserAction.action).to.eql('create');
+        });
+      });
+
+      describe('rbac', () => {
+        const supertestWithoutAuth = getService('supertestWithoutAuth');
+
+        let secCase: CaseResponse;
+        let obsCase: CaseResponse;
+        let secCaseSpace2: CaseResponse;
+
+        beforeEach(async () => {
+          [secCase, obsCase, secCaseSpace2] = await Promise.all([
+            createCase(
+              supertestWithoutAuth,
+              getPostCaseRequest({ owner: 'securitySolutionFixture' }),
+              200,
+              {
+                user: secOnly,
+                space: 'space1',
+              }
+            ),
+            createCase(
+              supertestWithoutAuth,
+              getPostCaseRequest({ owner: 'observabilityFixture' }),
+              200,
+              {
+                user: obsOnly,
+                space: 'space1',
+              }
+            ),
+            createCase(
+              supertestWithoutAuth,
+              getPostCaseRequest({ owner: 'securitySolutionFixture' }),
+              200,
+              {
+                user: superUser,
+                space: 'space2',
+              }
+            ),
+          ]);
+        });
+
+        it('should return with the correct status code when executing with various users', async () => {
+          for (const scenario of [
+            {
+              user: globalRead,
+              id: secCase.id,
+              space: 'space1',
+            },
+            {
+              user: globalRead,
+              id: obsCase.id,
+              space: 'space1',
+            },
+            {
+              user: superUser,
+              id: secCase.id,
+              space: 'space1',
+            },
+            {
+              user: superUser,
+              id: obsCase.id,
+              space: 'space1',
+            },
+            {
+              user: secOnlyRead,
+              id: secCase.id,
+              space: 'space1',
+            },
+            {
+              user: obsOnlyRead,
+              id: obsCase.id,
+              space: 'space1',
+            },
+          ]) {
+            const res = await findCaseUserActions({
+              caseID: scenario.id,
+              supertest: supertestWithoutAuth,
+              options: {
+                sortOrder: 'asc',
+                types: [ActionTypes.create_case],
+              },
+              auth: { user: scenario.user, space: scenario.space },
+            });
+
+            expect(res.userActions.length).to.be(1);
+          }
+        });
+
+        it('should fail to find user actions for a case that the user is not authorized for', async () => {
+          for (const scenario of [
+            {
+              user: secOnlyRead,
+              id: obsCase.id,
+              space: 'space1',
+              expectedCode: 403,
+            },
+            {
+              user: obsOnlyRead,
+              id: secCase.id,
+              space: 'space1',
+              expectedCode: 403,
+            },
+            {
+              user: noKibanaPrivileges,
+              id: secCase.id,
+              space: 'space1',
+              expectedCode: 403,
+            },
+            {
+              user: secOnlyRead,
+              id: secCaseSpace2.id,
+              space: 'space2',
+              expectedCode: 403,
+            },
+          ]) {
+            await findCaseUserActions({
+              caseID: scenario.id,
+              supertest: supertestWithoutAuth,
+              expectedHttpCode: scenario.expectedCode,
+              options: {
+                sortOrder: 'asc',
+                types: [ActionTypes.create_case],
+              },
+              auth: { user: scenario.user, space: scenario.space },
+            });
+          }
+        });
+      });
+    });
+  });
+};
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/get_all_user_actions.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/get_all_user_actions.ts
index c03831b57fd1ed..d5bcc0152cddf7 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/get_all_user_actions.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/get_all_user_actions.ts
@@ -22,7 +22,6 @@ import {
   deleteAllCaseItems,
   createCase,
   updateCase,
-  getCaseUserActions,
   superUserSpace1Auth,
   deleteCases,
   createComment,
@@ -30,6 +29,7 @@ import {
   deleteComment,
   extractWarningValueFromWarningHeader,
 } from '../../../../common/lib/utils';
+import { getCaseUserActions } from '../../../../common/lib/user_actions';
 import {
   globalRead,
   noKibanaPrivileges,
@@ -51,6 +51,23 @@ export default ({ getService }: FtrProviderContext): void => {
       await deleteAllCaseItems(es);
     });
 
+    it('populates the action_id', async () => {
+      const theCase = await createCase(supertest, postCaseReq);
+      const userActions = await getCaseUserActions({ supertest, caseID: theCase.id });
+
+      expect(userActions.length).to.be(1);
+      expect(userActions[0].action_id).not.to.be(undefined);
+      expect(userActions[0]).not.to.have.property('id');
+    });
+
+    it('populates the case_id', async () => {
+      const theCase = await createCase(supertest, postCaseReq);
+      const userActions = await getCaseUserActions({ supertest, caseID: theCase.id });
+
+      expect(userActions.length).to.be(1);
+      expect(userActions[0].case_id).not.to.be(undefined);
+    });
+
     it('creates a create case user action when a case is created', async () => {
       const theCase = await createCase(supertest, postCaseReq);
       const userActions = await getCaseUserActions({ supertest, caseID: theCase.id });
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/migrations.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/migrations.ts
index 5f345e61b2b391..e351948eb21a2e 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/migrations.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/user_actions/migrations.ts
@@ -9,7 +9,8 @@ import expect from '@kbn/expect';
 import { CASES_URL, SECURITY_SOLUTION_OWNER } from '@kbn/cases-plugin/common/constants';
 import { ActionTypes, CaseUserActionsResponse, CommentType } from '@kbn/cases-plugin/common/api';
 import { FtrProviderContext } from '../../../../../common/ftr_provider_context';
-import { deleteAllCaseItems, getCaseUserActions } from '../../../../common/lib/utils';
+import { deleteAllCaseItems } from '../../../../common/lib/utils';
+import { getCaseUserActions } from '../../../../common/lib/user_actions';
 
 // eslint-disable-next-line import/no-default-export
 export default function createGetTests({ getService }: FtrProviderContext) {
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/cases/user_actions/find_user_actions.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/cases/user_actions/find_user_actions.ts
new file mode 100644
index 00000000000000..83103aebc9d39f
--- /dev/null
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/cases/user_actions/find_user_actions.ts
@@ -0,0 +1,120 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import http from 'http';
+import expect from '@kbn/expect';
+import { ActionTypes } from '@kbn/cases-plugin/common/api';
+import { getPostCaseRequest } from '../../../../../common/lib/mock';
+import {
+  deleteAllCaseItems,
+  createCase,
+  updateCase,
+  pushCase,
+} from '../../../../../common/lib/utils';
+import {
+  createCaseWithConnector,
+  getServiceNowSimulationServer,
+} from '../../../../../common/lib/connectors';
+import { findCaseUserActions } from '../../../../../common/lib/user_actions';
+
+import { ObjectRemover as ActionsRemover } from '../../../../../../alerting_api_integration/common/lib';
+import { FtrProviderContext } from '../../../../../common/ftr_provider_context';
+
+// eslint-disable-next-line import/no-default-export
+export default ({ getService }: FtrProviderContext): void => {
+  const supertest = getService('supertest');
+  const es = getService('es');
+  const actionsRemover = new ActionsRemover(supertest);
+
+  describe('find_user_actions', () => {
+    let serviceNowSimulatorURL: string = '';
+    let serviceNowServer: http.Server;
+
+    before(async () => {
+      const { url, server } = await getServiceNowSimulationServer();
+      serviceNowSimulatorURL = url;
+      serviceNowServer = server;
+    });
+
+    afterEach(async () => {
+      await deleteAllCaseItems(es);
+      await actionsRemover.removeAll();
+    });
+
+    after(async () => {
+      serviceNowServer.close();
+    });
+
+    describe('filters using the type query parameter', () => {
+      it('retrieves only the assignees user actions', async () => {
+        const theCase = await createCase(supertest, getPostCaseRequest());
+
+        await updateCase({
+          params: {
+            cases: [
+              {
+                id: theCase.id,
+                version: theCase.version,
+                assignees: [
+                  {
+                    uid: '123',
+                  },
+                ],
+              },
+            ],
+          },
+          supertest,
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.assignees],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const addAssigneesUserAction = response.userActions[0];
+        expect(addAssigneesUserAction.type).to.eql('assignees');
+        expect(addAssigneesUserAction.action).to.eql('add');
+        expect(addAssigneesUserAction.payload).to.eql({ assignees: [{ uid: '123' }] });
+      });
+
+      it('retrieves only the pushed user actions', async () => {
+        const { postedCase, connector } = await createCaseWithConnector({
+          supertest,
+          serviceNowSimulatorURL,
+          actionsRemover,
+        });
+
+        const theCase = await pushCase({
+          supertest,
+          caseId: postedCase.id,
+          connectorId: connector.id,
+        });
+
+        const response = await findCaseUserActions({
+          caseID: theCase.id,
+          supertest,
+          options: {
+            sortOrder: 'asc',
+            types: [ActionTypes.pushed],
+          },
+        });
+
+        expect(response.userActions.length).to.be(1);
+
+        const pushedUserAction = response.userActions[0];
+        expect(pushedUserAction.type).to.eql('pushed');
+        expect(pushedUserAction.action).to.eql('push_to_service');
+      });
+    });
+  });
+};
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/cases/user_actions/get_all_user_actions.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/cases/user_actions/get_all_user_actions.ts
index 81a6253076d2eb..4b7bb93f541df7 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/cases/user_actions/get_all_user_actions.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/cases/user_actions/get_all_user_actions.ts
@@ -17,11 +17,11 @@ import {
   deleteCasesUserActions,
   deleteComments,
   deleteConfiguration,
-  getCaseUserActions,
   pushCase,
   updateCase,
   updateConfiguration,
 } from '../../../../../common/lib/utils';
+import { getCaseUserActions } from '../../../../../common/lib/user_actions';
 import {
   createCaseWithConnector,
   getServiceNowSimulationServer,
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/index.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/index.ts
index beb0c8e64045c5..4a3a2f876f843e 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/index.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/index.ts
@@ -29,6 +29,7 @@ export default ({ loadTestFile, getService }: FtrProviderContext): void => {
     // Trial
     loadTestFile(require.resolve('./cases/push_case'));
     loadTestFile(require.resolve('./cases/user_actions/get_all_user_actions'));
+    loadTestFile(require.resolve('./cases/user_actions/find_user_actions'));
     loadTestFile(require.resolve('./cases/assignees'));
     loadTestFile(require.resolve('./cases/find_cases'));
     loadTestFile(require.resolve('./configure'));
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/internal/get_connectors.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/internal/get_connectors.ts
index bb4d9e8b99b8c5..c200cc366d5af8 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/internal/get_connectors.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/internal/get_connectors.ts
@@ -26,10 +26,10 @@ import {
   createCase,
   createComment,
   deleteAllCaseItems,
-  getCaseUserActions,
   pushCase,
   updateCase,
 } from '../../../../common/lib/utils';
+import { getCaseUserActions } from '../../../../common/lib/user_actions';
 import { getPostCaseRequest, postCommentUserReq } from '../../../../common/lib/mock';
 import {
   createCaseWithConnector,
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/user_profiles/get_current.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/user_profiles/get_current.ts
index 9e070c3f4ffc95..5b97eeb6ed9d0f 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/user_profiles/get_current.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/trial/user_profiles/get_current.ts
@@ -21,8 +21,8 @@ import {
   updateComment,
   getConfigurationRequest,
   updateConfiguration,
-  getCaseUserActions,
 } from '../../../../common/lib/utils';
+import { getCaseUserActions } from '../../../../common/lib/user_actions';
 import { getPostCaseRequest, postCommentUserReq } from '../../../../common/lib/mock';
 
 // eslint-disable-next-line import/no-default-export
diff --git a/x-pack/test/cases_api_integration/spaces_only/tests/common/user_actions/get_all_user_actions.ts b/x-pack/test/cases_api_integration/spaces_only/tests/common/user_actions/get_all_user_actions.ts
index 4b97d30ecf1f54..6e7b73fe1b588b 100644
--- a/x-pack/test/cases_api_integration/spaces_only/tests/common/user_actions/get_all_user_actions.ts
+++ b/x-pack/test/cases_api_integration/spaces_only/tests/common/user_actions/get_all_user_actions.ts
@@ -9,12 +9,8 @@ import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../../common/ftr_provider_context';
 
 import { getPostCaseRequest } from '../../../../common/lib/mock';
-import {
-  deleteAllCaseItems,
-  createCase,
-  getCaseUserActions,
-  getAuthWithSuperUser,
-} from '../../../../common/lib/utils';
+import { deleteAllCaseItems, createCase, getAuthWithSuperUser } from '../../../../common/lib/utils';
+import { getCaseUserActions } from '../../../../common/lib/user_actions';
 
 // eslint-disable-next-line import/no-default-export
 export default ({ getService }: FtrProviderContext): void => {

From 000ba787784a0d3a0b840b9384a08eea3614336b Mon Sep 17 00:00:00 2001
From: Alexi Doak <109488926+doakalexi@users.noreply.github.com>
Date: Mon, 23 Jan 2023 13:27:39 -0500
Subject: [PATCH 16/54] [ResponseOps][flapping] change action behavior when
 flapping (#147810)

Resolves https://github.com/elastic/kibana/issues/143445

## Summary

This pr changes the behavior of alerting actions respecting flapping.
To recover a flapping alert the alert must be reported as recovered for
4 (this will be configurable eventually) consecutive runs before the
framework makes the alert as recovered.

Link to a spreadsheet that helps vizualize the changes:
https://docs.google.com/spreadsheets/d/1amoUDFx-Sdxirnabd_E4OSnyur57sLhY6Ce79oDYgJA/edit#gid=0

Also Resolves https://github.com/elastic/kibana/issues/147205 to recover
those alerts


### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### To verify
- Create an alert and let it run until it gets into a flapping state
(changes from active/recovered at least 4 times)
- Once flapping, verify the following cases:
- Verify that a recovered alert will be returned as an active
notification 3 times before finally recovering
- Verify that an alert that does not recover 3 times before an active
alert is reported never reports as a recovered alert

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Ying Mao <ying.mao@elastic.co>
---
 .../plugins/alerting/common/alert_instance.ts |   1 +
 .../alerting/server/alert/alert.test.ts       |  44 +++++-
 x-pack/plugins/alerting/server/alert/alert.ts |  15 ++
 .../legacy_alerts_client.test.ts              |  28 +++-
 .../alerts_client/legacy_alerts_client.ts     |  39 +++--
 .../alerting/server/lib/flapping_utils.ts     |   2 +-
 .../lib/get_alerts_for_notification.test.ts   | 146 ++++++++++++++++++
 .../server/lib/get_alerts_for_notification.ts |  69 +++++++++
 x-pack/plugins/alerting/server/lib/index.ts   |   2 +
 .../server/lib/trim_recovered_alerts.test.ts  |  78 ++++++++++
 .../server/lib/trim_recovered_alerts.ts       |  76 +++++++++
 .../alerting/server/task_runner/fixtures.ts   |   1 +
 .../server/task_runner/task_runner.test.ts    |   3 +
 .../metric_threshold_executor.test.ts         |   2 +
 .../utils/create_lifecycle_executor.test.ts   |  28 +++-
 .../server/utils/create_lifecycle_executor.ts |  26 +++-
 .../utils/get_alerts_for_notification.test.ts |  85 ++++++++++
 .../utils/get_alerts_for_notification.ts      |  36 +++++
 .../get_updated_flapping_history.test.ts      |   4 +
 .../spaces_only/tests/alerting/event_log.ts   |  29 +++-
 .../tests/alerting/event_log_alerts.ts        |   4 +-
 21 files changed, 688 insertions(+), 30 deletions(-)
 create mode 100644 x-pack/plugins/alerting/server/lib/get_alerts_for_notification.test.ts
 create mode 100644 x-pack/plugins/alerting/server/lib/get_alerts_for_notification.ts
 create mode 100644 x-pack/plugins/alerting/server/lib/trim_recovered_alerts.test.ts
 create mode 100644 x-pack/plugins/alerting/server/lib/trim_recovered_alerts.ts
 create mode 100644 x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.test.ts
 create mode 100644 x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.ts

diff --git a/x-pack/plugins/alerting/common/alert_instance.ts b/x-pack/plugins/alerting/common/alert_instance.ts
index a72479f42b5235..7aad3a05de6f24 100644
--- a/x-pack/plugins/alerting/common/alert_instance.ts
+++ b/x-pack/plugins/alerting/common/alert_instance.ts
@@ -36,6 +36,7 @@ const metaSchema = t.partial({
   flappingHistory: t.array(t.boolean),
   // flapping flag that indicates whether the alert is flapping
   flapping: t.boolean,
+  pendingRecoveredCount: t.number,
 });
 export type AlertInstanceMeta = t.TypeOf<typeof metaSchema>;
 
diff --git a/x-pack/plugins/alerting/server/alert/alert.test.ts b/x-pack/plugins/alerting/server/alert/alert.test.ts
index b668918e1a8262..479c5a4a554123 100644
--- a/x-pack/plugins/alerting/server/alert/alert.test.ts
+++ b/x-pack/plugins/alerting/server/alert/alert.test.ts
@@ -414,11 +414,12 @@ describe('toJSON', () => {
           },
           flappingHistory: [false, true],
           flapping: false,
+          pendingRecoveredCount: 2,
         },
       }
     );
     expect(JSON.stringify(alertInstance)).toEqual(
-      '{"state":{"foo":true},"meta":{"lastScheduledActions":{"date":"1970-01-01T00:00:00.000Z","group":"default"},"flappingHistory":[false,true],"flapping":false}}'
+      '{"state":{"foo":true},"meta":{"lastScheduledActions":{"date":"1970-01-01T00:00:00.000Z","group":"default"},"flappingHistory":[false,true],"flapping":false,"pendingRecoveredCount":2}}'
     );
   });
 });
@@ -433,6 +434,7 @@ describe('toRaw', () => {
           group: 'default',
         },
         flappingHistory: [false, true, true],
+        pendingRecoveredCount: 2,
       },
     };
     const alertInstance = new Alert<AlertInstanceState, AlertInstanceContext, DefaultActionGroupId>(
@@ -529,3 +531,43 @@ describe('getFlapping', () => {
     expect(alert.getFlapping()).toEqual(true);
   });
 });
+
+describe('incrementPendingRecoveredCount', () => {
+  test('correctly increments pendingRecoveredCount', () => {
+    const alert = new Alert<AlertInstanceState, AlertInstanceContext, DefaultActionGroupId>('1', {
+      meta: { pendingRecoveredCount: 3 },
+    });
+    alert.incrementPendingRecoveredCount();
+    expect(alert.getPendingRecoveredCount()).toEqual(4);
+  });
+
+  test('correctly increments pendingRecoveredCount when it is not already defined', () => {
+    const alert = new Alert<AlertInstanceState, AlertInstanceContext, DefaultActionGroupId>('1');
+    alert.incrementPendingRecoveredCount();
+    expect(alert.getPendingRecoveredCount()).toEqual(1);
+  });
+});
+
+describe('getPendingRecoveredCount', () => {
+  test('returns pendingRecoveredCount', () => {
+    const alert = new Alert<AlertInstanceState, AlertInstanceContext, DefaultActionGroupId>('1', {
+      meta: { pendingRecoveredCount: 3 },
+    });
+    expect(alert.getPendingRecoveredCount()).toEqual(3);
+  });
+
+  test('defines and returns pendingRecoveredCount when it is not already defined', () => {
+    const alert = new Alert<AlertInstanceState, AlertInstanceContext, DefaultActionGroupId>('1');
+    expect(alert.getPendingRecoveredCount()).toEqual(0);
+  });
+});
+
+describe('resetPendingRecoveredCount', () => {
+  test('resets pendingRecoveredCount to 0', () => {
+    const alert = new Alert<AlertInstanceState, AlertInstanceContext, DefaultActionGroupId>('1', {
+      meta: { pendingRecoveredCount: 3 },
+    });
+    alert.resetPendingRecoveredCount();
+    expect(alert.getPendingRecoveredCount()).toEqual(0);
+  });
+});
diff --git a/x-pack/plugins/alerting/server/alert/alert.ts b/x-pack/plugins/alerting/server/alert/alert.ts
index 7974f1906f65c6..361d3d0c522582 100644
--- a/x-pack/plugins/alerting/server/alert/alert.ts
+++ b/x-pack/plugins/alerting/server/alert/alert.ts
@@ -225,4 +225,19 @@ export class Alert<
   getFlapping() {
     return this.meta.flapping || false;
   }
+
+  incrementPendingRecoveredCount() {
+    if (!this.meta.pendingRecoveredCount) {
+      this.meta.pendingRecoveredCount = 0;
+    }
+    this.meta.pendingRecoveredCount++;
+  }
+
+  getPendingRecoveredCount() {
+    return this.meta.pendingRecoveredCount || 0;
+  }
+
+  resetPendingRecoveredCount() {
+    this.meta.pendingRecoveredCount = 0;
+  }
 }
diff --git a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts
index e7e62ec848ea33..dddfe857cfd44b 100644
--- a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.test.ts
@@ -12,7 +12,7 @@ import { createAlertFactory, getPublicAlertFactory } from '../alert/create_alert
 import { Alert } from '../alert/alert';
 import { alertingEventLoggerMock } from '../lib/alerting_event_logger/alerting_event_logger.mock';
 import { ruleRunMetricsStoreMock } from '../lib/rule_run_metrics_store.mock';
-import { processAlerts, setFlapping } from '../lib';
+import { getAlertsForNotification, processAlerts, setFlapping } from '../lib';
 import { logAlerts } from '../task_runner/log_alerts';
 
 const scheduleActions = jest.fn();
@@ -61,6 +61,12 @@ jest.mock('../lib', () => {
   };
 });
 
+jest.mock('../lib/get_alerts_for_notification', () => {
+  return {
+    getAlertsForNotification: jest.fn(),
+  };
+});
+
 jest.mock('../task_runner/log_alerts', () => ({ logAlerts: jest.fn() }));
 
 let logger: ReturnType<typeof loggingSystemMock['createLogger']>;
@@ -195,6 +201,15 @@ describe('Legacy Alerts Client', () => {
       currentRecoveredAlerts: {},
       recoveredAlerts: {},
     });
+    (getAlertsForNotification as jest.Mock).mockReturnValue({
+      newAlerts: {},
+      activeAlerts: {
+        '1': new Alert<AlertInstanceContext, AlertInstanceContext>('1', testAlert1),
+        '2': new Alert<AlertInstanceContext, AlertInstanceContext>('2', testAlert2),
+      },
+      currentRecoveredAlerts: {},
+      recoveredAlerts: {},
+    });
     const alertsClient = new LegacyAlertsClient({
       logger,
       maxAlerts: 1000,
@@ -240,6 +255,17 @@ describe('Legacy Alerts Client', () => {
       {}
     );
 
+    expect(getAlertsForNotification).toHaveBeenCalledWith(
+      'default',
+      {},
+      {
+        '1': new Alert<AlertInstanceContext, AlertInstanceContext>('1', testAlert1),
+        '2': new Alert<AlertInstanceContext, AlertInstanceContext>('2', testAlert2),
+      },
+      {},
+      {}
+    );
+
     expect(logAlerts).toHaveBeenCalledWith({
       logger,
       alertingEventLogger,
diff --git a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts
index c4fa1b8565ca3c..4c32c1cbcc9284 100644
--- a/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts
+++ b/x-pack/plugins/alerting/server/alerts_client/legacy_alerts_client.ts
@@ -5,16 +5,22 @@
  * 2.0.
  */
 import { Logger } from '@kbn/core/server';
-import { cloneDeep } from 'lodash';
+import { cloneDeep, merge } from 'lodash';
 import { Alert } from '../alert/alert';
 import {
   AlertFactory,
   createAlertFactory,
   getPublicAlertFactory,
 } from '../alert/create_alert_factory';
-import { determineAlertsToReturn, processAlerts, setFlapping } from '../lib';
+import {
+  determineAlertsToReturn,
+  processAlerts,
+  setFlapping,
+  getAlertsForNotification,
+} from '../lib';
 import { AlertingEventLogger } from '../lib/alerting_event_logger/alerting_event_logger';
 import { RuleRunMetricsStore } from '../lib/rule_run_metrics_store';
+import { trimRecoveredAlerts } from '../lib/trim_recovered_alerts';
 import { UntypedNormalizedRuleType } from '../rule_type_registry';
 import { logAlerts } from '../task_runner/log_alerts';
 import {
@@ -134,17 +140,32 @@ export class LegacyAlertsClient<
       processedAlertsRecovered
     );
 
-    this.processedAlerts.new = processedAlertsNew;
-    this.processedAlerts.active = processedAlertsActive;
-    this.processedAlerts.recovered = processedAlertsRecovered;
-    this.processedAlerts.recoveredCurrent = processedAlertsRecoveredCurrent;
+    const { trimmedAlertsRecovered, earlyRecoveredAlerts } = trimRecoveredAlerts(
+      this.options.logger,
+      processedAlertsRecovered,
+      this.options.maxAlerts
+    );
+
+    const alerts = getAlertsForNotification<State, Context, ActionGroupIds, RecoveryActionGroupId>(
+      this.options.ruleType.defaultActionGroupId,
+      processedAlertsNew,
+      processedAlertsActive,
+      trimmedAlertsRecovered,
+      processedAlertsRecoveredCurrent
+    );
+    alerts.currentRecoveredAlerts = merge(alerts.currentRecoveredAlerts, earlyRecoveredAlerts);
+
+    this.processedAlerts.new = alerts.newAlerts;
+    this.processedAlerts.active = alerts.activeAlerts;
+    this.processedAlerts.recovered = alerts.recoveredAlerts;
+    this.processedAlerts.recoveredCurrent = alerts.currentRecoveredAlerts;
 
     logAlerts({
       logger: this.options.logger,
       alertingEventLogger: eventLogger,
-      newAlerts: processedAlertsNew,
-      activeAlerts: processedAlertsActive,
-      recoveredAlerts: processedAlertsRecoveredCurrent,
+      newAlerts: alerts.newAlerts,
+      activeAlerts: alerts.activeAlerts,
+      recoveredAlerts: alerts.currentRecoveredAlerts,
       ruleLogPrefix: ruleLabel,
       ruleRunMetricsStore,
       canSetRecoveryContext: this.options.ruleType.doesSetRecoveryContext ?? false,
diff --git a/x-pack/plugins/alerting/server/lib/flapping_utils.ts b/x-pack/plugins/alerting/server/lib/flapping_utils.ts
index 8427e028808442..30e7059b2bc8fb 100644
--- a/x-pack/plugins/alerting/server/lib/flapping_utils.ts
+++ b/x-pack/plugins/alerting/server/lib/flapping_utils.ts
@@ -6,7 +6,7 @@
  */
 
 const MAX_CAPACITY = 20;
-const MAX_FLAP_COUNT = 4;
+export const MAX_FLAP_COUNT = 4;
 
 export function updateFlappingHistory(flappingHistory: boolean[], state: boolean) {
   const updatedFlappingHistory = flappingHistory.concat(state).slice(MAX_CAPACITY * -1);
diff --git a/x-pack/plugins/alerting/server/lib/get_alerts_for_notification.test.ts b/x-pack/plugins/alerting/server/lib/get_alerts_for_notification.test.ts
new file mode 100644
index 00000000000000..ecf792518ce8b7
--- /dev/null
+++ b/x-pack/plugins/alerting/server/lib/get_alerts_for_notification.test.ts
@@ -0,0 +1,146 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getAlertsForNotification } from '.';
+import { Alert } from '../alert';
+
+describe('getAlertsForNotification', () => {
+  test('should set pendingRecoveredCount to zero for all active alerts', () => {
+    const alert1 = new Alert('1', { meta: { flapping: true, pendingRecoveredCount: 3 } });
+    const alert2 = new Alert('2', { meta: { flapping: false } });
+
+    const { newAlerts, activeAlerts } = getAlertsForNotification(
+      'default',
+      {
+        '1': alert1,
+      },
+      {
+        '1': alert1,
+        '2': alert2,
+      },
+      {},
+      {}
+    );
+    expect(newAlerts).toMatchInlineSnapshot(`
+      Object {
+        "1": Object {
+          "meta": Object {
+            "flapping": true,
+            "flappingHistory": Array [],
+            "pendingRecoveredCount": 0,
+          },
+          "state": Object {},
+        },
+      }
+    `);
+    expect(activeAlerts).toMatchInlineSnapshot(`
+      Object {
+        "1": Object {
+          "meta": Object {
+            "flapping": true,
+            "flappingHistory": Array [],
+            "pendingRecoveredCount": 0,
+          },
+          "state": Object {},
+        },
+        "2": Object {
+          "meta": Object {
+            "flapping": false,
+            "flappingHistory": Array [],
+            "pendingRecoveredCount": 0,
+          },
+          "state": Object {},
+        },
+      }
+    `);
+  });
+
+  test('should return flapping pending recovered alerts as active alerts', () => {
+    const alert1 = new Alert('1', { meta: { flapping: true, pendingRecoveredCount: 3 } });
+    const alert2 = new Alert('2', { meta: { flapping: false } });
+    const alert3 = new Alert('3', { meta: { flapping: true } });
+
+    const { newAlerts, activeAlerts, recoveredAlerts, currentRecoveredAlerts } =
+      getAlertsForNotification(
+        'default',
+        {},
+        {},
+        {
+          '1': alert1,
+          '2': alert2,
+          '3': alert3,
+        },
+        {
+          '1': alert1,
+          '2': alert2,
+          '3': alert3,
+        }
+      );
+
+    expect(newAlerts).toMatchInlineSnapshot(`Object {}`);
+    expect(activeAlerts).toMatchInlineSnapshot(`
+      Object {
+        "3": Object {
+          "meta": Object {
+            "flapping": true,
+            "flappingHistory": Array [],
+            "pendingRecoveredCount": 1,
+          },
+          "state": Object {},
+        },
+      }
+    `);
+    expect(Object.values(activeAlerts).map((a) => a.getScheduledActionOptions()))
+      .toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "actionGroup": "default",
+          "context": Object {},
+          "state": Object {},
+        },
+      ]
+    `);
+    expect(recoveredAlerts).toMatchInlineSnapshot(`
+      Object {
+        "1": Object {
+          "meta": Object {
+            "flapping": true,
+            "flappingHistory": Array [],
+            "pendingRecoveredCount": 0,
+          },
+          "state": Object {},
+        },
+        "2": Object {
+          "meta": Object {
+            "flapping": false,
+            "flappingHistory": Array [],
+          },
+          "state": Object {},
+        },
+      }
+    `);
+    expect(currentRecoveredAlerts).toMatchInlineSnapshot(`
+      Object {
+        "1": Object {
+          "meta": Object {
+            "flapping": true,
+            "flappingHistory": Array [],
+            "pendingRecoveredCount": 0,
+          },
+          "state": Object {},
+        },
+        "2": Object {
+          "meta": Object {
+            "flapping": false,
+            "flappingHistory": Array [],
+          },
+          "state": Object {},
+        },
+      }
+    `);
+  });
+});
diff --git a/x-pack/plugins/alerting/server/lib/get_alerts_for_notification.ts b/x-pack/plugins/alerting/server/lib/get_alerts_for_notification.ts
new file mode 100644
index 00000000000000..bbfb65ad77b7dc
--- /dev/null
+++ b/x-pack/plugins/alerting/server/lib/get_alerts_for_notification.ts
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { keys } from 'lodash';
+import { Alert } from '../alert';
+import { AlertInstanceState, AlertInstanceContext } from '../types';
+import { MAX_FLAP_COUNT } from './flapping_utils';
+
+export function getAlertsForNotification<
+  State extends AlertInstanceState,
+  Context extends AlertInstanceContext,
+  ActionGroupIds extends string,
+  RecoveryActionGroupId extends string
+>(
+  actionGroupId: string,
+  newAlerts: Record<string, Alert<State, Context, ActionGroupIds>> = {},
+  activeAlerts: Record<string, Alert<State, Context, ActionGroupIds>> = {},
+  recoveredAlerts: Record<string, Alert<State, Context, RecoveryActionGroupId>> = {},
+  currentRecoveredAlerts: Record<string, Alert<State, Context, RecoveryActionGroupId>> = {}
+) {
+  for (const id of keys(activeAlerts)) {
+    const alert = activeAlerts[id];
+    alert.resetPendingRecoveredCount();
+  }
+
+  for (const id of keys(currentRecoveredAlerts)) {
+    const alert = recoveredAlerts[id];
+    const flapping = alert.getFlapping();
+    if (flapping) {
+      alert.incrementPendingRecoveredCount();
+
+      if (alert.getPendingRecoveredCount() < MAX_FLAP_COUNT) {
+        // keep the context and previous actionGroupId if available
+        const context = alert.getContext();
+        const lastActionGroupId = alert.getLastScheduledActions()?.group;
+
+        const newAlert = new Alert<State, Context, ActionGroupIds>(id, alert.toRaw());
+        // unset the end time in the alert state
+        const state = newAlert.getState();
+        delete state.end;
+        newAlert.replaceState(state);
+
+        // schedule actions for the new active alert
+        newAlert.scheduleActions(
+          (lastActionGroupId ? lastActionGroupId : actionGroupId) as ActionGroupIds,
+          context
+        );
+        activeAlerts[id] = newAlert;
+
+        // remove from recovered alerts
+        delete recoveredAlerts[id];
+        delete currentRecoveredAlerts[id];
+      } else {
+        alert.resetPendingRecoveredCount();
+      }
+    }
+  }
+
+  return {
+    newAlerts,
+    activeAlerts,
+    recoveredAlerts,
+    currentRecoveredAlerts,
+  };
+}
diff --git a/x-pack/plugins/alerting/server/lib/index.ts b/x-pack/plugins/alerting/server/lib/index.ts
index 8b1416df007fa5..8f8dccadaaa773 100644
--- a/x-pack/plugins/alerting/server/lib/index.ts
+++ b/x-pack/plugins/alerting/server/lib/index.ts
@@ -41,3 +41,5 @@ export * from './snooze';
 export { setFlapping } from './set_flapping';
 export { determineAlertsToReturn } from './determine_alerts_to_return';
 export { updateFlappingHistory, isFlapping } from './flapping_utils';
+export { getAlertsForNotification } from './get_alerts_for_notification';
+export { trimRecoveredAlerts } from './trim_recovered_alerts';
diff --git a/x-pack/plugins/alerting/server/lib/trim_recovered_alerts.test.ts b/x-pack/plugins/alerting/server/lib/trim_recovered_alerts.test.ts
new file mode 100644
index 00000000000000..3c42a5664477c9
--- /dev/null
+++ b/x-pack/plugins/alerting/server/lib/trim_recovered_alerts.test.ts
@@ -0,0 +1,78 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { loggingSystemMock } from '@kbn/core-logging-server-mocks';
+import { Alert } from '../alert';
+import { getEarlyRecoveredAlerts, trimRecoveredAlerts } from './trim_recovered_alerts';
+
+describe('trimRecoveredAlerts', () => {
+  const logger = loggingSystemMock.createLogger();
+
+  const alert1 = new Alert('1', { meta: { flappingHistory: [true, true, true, true] } });
+  const alert2 = new Alert('2', { meta: { flappingHistory: new Array(20).fill(false) } });
+  const alert3 = new Alert('3', { meta: { flappingHistory: [true, true] } });
+  const alert4 = {
+    key: '4',
+    flappingHistory: [true, true, true, true],
+  };
+  const alert5 = {
+    key: '5',
+    flappingHistory: new Array(20).fill(false),
+  };
+  const alert6 = {
+    key: '6',
+    flappingHistory: [true, true],
+  };
+
+  test('should remove longest recovered alerts', () => {
+    const recoveredAlerts = {
+      '1': alert1,
+      '2': alert2,
+      '3': alert3,
+    };
+
+    const trimmedAlerts = trimRecoveredAlerts(logger, recoveredAlerts, 2);
+    expect(trimmedAlerts).toEqual({
+      trimmedAlertsRecovered: { 1: alert1, 3: alert3 },
+      earlyRecoveredAlerts: {
+        2: new Alert('2', {
+          meta: { flappingHistory: new Array(20).fill(false), flapping: false },
+        }),
+      },
+    });
+  });
+
+  test('should not remove alerts if the num of recovered alerts is not at the limit', () => {
+    const recoveredAlerts = {
+      '1': alert1,
+      '2': alert2,
+      '3': alert3,
+    };
+
+    const trimmedAlerts = trimRecoveredAlerts(logger, recoveredAlerts, 3);
+    expect(trimmedAlerts).toEqual({
+      trimmedAlertsRecovered: recoveredAlerts,
+      earlyRecoveredAlerts: {},
+    });
+  });
+
+  test('getEarlyRecoveredAlerts should return longest recovered alerts', () => {
+    const recoveredAlerts = [alert4, alert5, alert6];
+    const trimmedAlerts = getEarlyRecoveredAlerts(logger, recoveredAlerts, 2);
+    expect(trimmedAlerts).toEqual([alert5]);
+
+    expect(logger.warn).toBeCalledWith(
+      'Recovered alerts have exceeded the max alert limit of 2 : dropping 1 alert.'
+    );
+  });
+
+  test('getEarlyRecoveredAlerts should not return alerts if the num of recovered alerts is not at the limit', () => {
+    const recoveredAlerts = [alert4, alert5];
+    const trimmedAlerts = getEarlyRecoveredAlerts(logger, recoveredAlerts, 2);
+    expect(trimmedAlerts).toEqual([]);
+  });
+});
diff --git a/x-pack/plugins/alerting/server/lib/trim_recovered_alerts.ts b/x-pack/plugins/alerting/server/lib/trim_recovered_alerts.ts
new file mode 100644
index 00000000000000..779bf0023a3c36
--- /dev/null
+++ b/x-pack/plugins/alerting/server/lib/trim_recovered_alerts.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Logger } from '@kbn/logging';
+import { map } from 'lodash';
+import { Alert } from '../alert';
+import { AlertInstanceState, AlertInstanceContext } from '../types';
+
+interface TrimmedRecoveredAlertsResult<
+  State extends AlertInstanceState,
+  Context extends AlertInstanceContext,
+  RecoveryActionGroupIds extends string
+> {
+  trimmedAlertsRecovered: Record<string, Alert<State, Context, RecoveryActionGroupIds>>;
+  earlyRecoveredAlerts: Record<string, Alert<State, Context, RecoveryActionGroupIds>>;
+}
+
+export interface TrimRecoveredOpts {
+  key: string;
+  flappingHistory: boolean[];
+}
+
+export function trimRecoveredAlerts<
+  State extends AlertInstanceState,
+  Context extends AlertInstanceContext,
+  RecoveryActionGroupIds extends string
+>(
+  logger: Logger,
+  recoveredAlerts: Record<string, Alert<State, Context, RecoveryActionGroupIds>> = {},
+  maxAlerts: number
+): TrimmedRecoveredAlertsResult<State, Context, RecoveryActionGroupIds> {
+  const alerts = map(recoveredAlerts, (value, key) => {
+    return {
+      key,
+      flappingHistory: value.getFlappingHistory() || [],
+    };
+  });
+  const earlyRecoveredAlertOpts = getEarlyRecoveredAlerts(logger, alerts, maxAlerts);
+  const earlyRecoveredAlerts: Record<string, Alert<State, Context, RecoveryActionGroupIds>> = {};
+  earlyRecoveredAlertOpts.forEach((opt) => {
+    const alert = recoveredAlerts[opt.key];
+    alert.setFlapping(false);
+    earlyRecoveredAlerts[opt.key] = recoveredAlerts[opt.key];
+
+    delete recoveredAlerts[opt.key];
+  });
+  return {
+    trimmedAlertsRecovered: recoveredAlerts,
+    earlyRecoveredAlerts,
+  };
+}
+
+export function getEarlyRecoveredAlerts(
+  logger: Logger,
+  recoveredAlerts: TrimRecoveredOpts[],
+  maxAlerts: number
+) {
+  let earlyRecoveredAlerts: TrimRecoveredOpts[] = [];
+  if (recoveredAlerts.length > maxAlerts) {
+    recoveredAlerts.sort((a, b) => {
+      return a.flappingHistory.length - b.flappingHistory.length;
+    });
+
+    earlyRecoveredAlerts = recoveredAlerts.slice(maxAlerts);
+    logger.warn(
+      `Recovered alerts have exceeded the max alert limit of ${maxAlerts} : dropping ${
+        earlyRecoveredAlerts.length
+      } ${earlyRecoveredAlerts.length > 1 ? 'alerts' : 'alert'}.`
+    );
+  }
+  return earlyRecoveredAlerts;
+}
diff --git a/x-pack/plugins/alerting/server/task_runner/fixtures.ts b/x-pack/plugins/alerting/server/task_runner/fixtures.ts
index a92b4f6850e4ad..7784247ca75f38 100644
--- a/x-pack/plugins/alerting/server/task_runner/fixtures.ts
+++ b/x-pack/plugins/alerting/server/task_runner/fixtures.ts
@@ -347,6 +347,7 @@ export const generateAlertInstance = (
       },
       flappingHistory,
       flapping: false,
+      pendingRecoveredCount: 0,
     },
     state: {
       bar: false,
diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
index c0dcd9c74135b0..e27bb167d45e84 100644
--- a/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/task_runner.test.ts
@@ -2619,6 +2619,7 @@ describe('Task Runner', () => {
               },
               flappingHistory: [true],
               flapping: false,
+              pendingRecoveredCount: 0,
             },
             state: {
               duration: '0',
@@ -2784,6 +2785,7 @@ describe('Task Runner', () => {
               },
               flappingHistory: [true],
               flapping: false,
+              pendingRecoveredCount: 0,
             },
             state: {
               duration: '0',
@@ -2798,6 +2800,7 @@ describe('Task Runner', () => {
               },
               flappingHistory: [true],
               flapping: false,
+              pendingRecoveredCount: 0,
             },
             state: {
               duration: '0',
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
index 9a6daf86be0400..409dede158515e 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
@@ -81,6 +81,7 @@ const mockOptions = {
         started: '2020-01-01T12:00:00.000Z',
         flappingHistory: [],
         flapping: false,
+        pendingRecoveredCount: 0,
       },
       TEST_ALERT_1: {
         alertId: 'TEST_ALERT_1',
@@ -88,6 +89,7 @@ const mockOptions = {
         started: '2020-01-02T12:00:00.000Z',
         flappingHistory: [],
         flapping: false,
+        pendingRecoveredCount: 0,
       },
     },
     trackedAlertsRecovered: {},
diff --git a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.test.ts b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.test.ts
index 8e847b4c376fc0..2902533c145f14 100644
--- a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.test.ts
+++ b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.test.ts
@@ -197,6 +197,7 @@ describe('createLifecycleExecutor', () => {
               started: '2020-01-01T12:00:00.000Z',
               flappingHistory: [],
               flapping: false,
+              pendingRecoveredCount: 0,
             },
             TEST_ALERT_1: {
               alertId: 'TEST_ALERT_1',
@@ -204,6 +205,7 @@ describe('createLifecycleExecutor', () => {
               started: '2020-01-02T12:00:00.000Z',
               flappingHistory: [],
               flapping: false,
+              pendingRecoveredCount: 0,
             },
           },
           trackedAlertsRecovered: {},
@@ -318,6 +320,7 @@ describe('createLifecycleExecutor', () => {
               started: '2020-01-01T12:00:00.000Z',
               flappingHistory: [],
               flapping: false,
+              pendingRecoveredCount: 0,
             },
             TEST_ALERT_1: {
               alertId: 'TEST_ALERT_1',
@@ -325,6 +328,7 @@ describe('createLifecycleExecutor', () => {
               started: '2020-01-02T12:00:00.000Z',
               flappingHistory: [],
               flapping: false,
+              pendingRecoveredCount: 0,
             },
           },
           trackedAlertsRecovered: {},
@@ -550,6 +554,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-01T12:00:00.000Z',
                 flappingHistory: [],
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
               TEST_ALERT_1: {
                 alertId: 'TEST_ALERT_1',
@@ -557,6 +562,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-02T12:00:00.000Z',
                 flappingHistory: [],
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
             },
             trackedAlertsRecovered: {},
@@ -660,6 +666,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-01T12:00:00.000Z',
                 flappingHistory: [],
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
               TEST_ALERT_1: {
                 alertId: 'TEST_ALERT_1',
@@ -667,6 +674,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-02T12:00:00.000Z',
                 flappingHistory: [],
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
             },
             trackedAlerts: {},
@@ -765,6 +773,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-01T12:00:00.000Z',
                 flappingHistory: [],
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
               TEST_ALERT_1: {
                 alertId: 'TEST_ALERT_1',
@@ -772,6 +781,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-02T12:00:00.000Z',
                 flappingHistory: [],
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
             },
             trackedAlertsRecovered: {},
@@ -871,6 +881,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-02T12:00:00.000Z',
                 flappingHistory: [],
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
             },
             trackedAlertsRecovered: {
@@ -880,6 +891,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-01T12:00:00.000Z',
                 flappingHistory: [],
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
             },
           },
@@ -1016,6 +1028,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-01T12:00:00.000Z',
                 flappingHistory: flapping,
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
               TEST_ALERT_1: {
                 alertId: 'TEST_ALERT_1',
@@ -1023,6 +1036,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-02T12:00:00.000Z',
                 flappingHistory: [false, false],
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
               TEST_ALERT_2: {
                 alertId: 'TEST_ALERT_2',
@@ -1030,6 +1044,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-01T12:00:00.000Z',
                 flappingHistory: flapping,
                 flapping: true,
+                pendingRecoveredCount: 0,
               },
               TEST_ALERT_3: {
                 alertId: 'TEST_ALERT_3',
@@ -1037,6 +1052,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-02T12:00:00.000Z',
                 flappingHistory: [false, false],
                 flapping: true,
+                pendingRecoveredCount: 0,
               },
             },
             trackedAlertsRecovered: {},
@@ -1179,6 +1195,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-01T12:00:00.000Z',
                 flappingHistory: [true, true, true, true],
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
               TEST_ALERT_1: {
                 alertId: 'TEST_ALERT_1',
@@ -1186,6 +1203,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-02T12:00:00.000Z',
                 flappingHistory: notFlapping,
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
               TEST_ALERT_2: {
                 alertId: 'TEST_ALERT_2',
@@ -1193,6 +1211,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-02T12:00:00.000Z',
                 flappingHistory: [true, true],
                 flapping: true,
+                pendingRecoveredCount: 0,
               },
               TEST_ALERT_3: {
                 alertId: 'TEST_ALERT_3',
@@ -1200,6 +1219,7 @@ describe('createLifecycleExecutor', () => {
                 started: '2020-01-02T12:00:00.000Z',
                 flappingHistory: notFlapping,
                 flapping: false,
+                pendingRecoveredCount: 0,
               },
             },
             trackedAlertsRecovered: {},
@@ -1215,8 +1235,8 @@ describe('createLifecycleExecutor', () => {
             { index: { _id: 'TEST_ALERT_0_UUID' } },
             expect.objectContaining({
               [ALERT_INSTANCE_ID]: 'TEST_ALERT_0',
-              [ALERT_STATUS]: ALERT_STATUS_RECOVERED,
-              [EVENT_ACTION]: 'close',
+              [ALERT_STATUS]: ALERT_STATUS_ACTIVE,
+              [EVENT_ACTION]: 'active',
               [EVENT_KIND]: 'signal',
               [ALERT_FLAPPING]: true,
             }),
@@ -1231,8 +1251,8 @@ describe('createLifecycleExecutor', () => {
             { index: { _id: 'TEST_ALERT_2_UUID' } },
             expect.objectContaining({
               [ALERT_INSTANCE_ID]: 'TEST_ALERT_2',
-              [ALERT_STATUS]: ALERT_STATUS_RECOVERED,
-              [EVENT_ACTION]: 'close',
+              [ALERT_STATUS]: ALERT_STATUS_ACTIVE,
+              [EVENT_ACTION]: 'active',
               [EVENT_KIND]: 'signal',
               [ALERT_FLAPPING]: true,
             }),
diff --git a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts
index 6dcafd8b2bb2c5..7e16fcdd8cdf32 100644
--- a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts
+++ b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts
@@ -47,6 +47,7 @@ import { fetchExistingAlerts } from './fetch_existing_alerts';
 import { getCommonAlertFields } from './get_common_alert_fields';
 import { getUpdatedFlappingHistory } from './get_updated_flapping_history';
 import { fetchAlertByAlertUUID } from './fetch_alert_by_uuid';
+import { getAlertsForNotification } from './get_alerts_for_notification';
 
 type ImplicitTechnicalFieldName = CommonAlertFieldNameLatest | CommonAlertIdFieldNameLatest;
 
@@ -104,6 +105,7 @@ const trackedAlertStateRt = rt.type({
   flappingHistory: rt.array(rt.boolean),
   // flapping flag that indicates whether the alert is flapping
   flapping: rt.boolean,
+  pendingRecoveredCount: rt.number,
 });
 
 export type TrackedLifecycleAlertState = rt.TypeOf<typeof trackedAlertStateRt>;
@@ -276,6 +278,7 @@ export const createLifecycleExecutor =
           alertUuid,
           started,
           flapping: isCurrentlyFlapping,
+          pendingRecoveredCount,
         } = !isNew
           ? state.trackedAlerts[alertId]
           : {
@@ -284,6 +287,7 @@ export const createLifecycleExecutor =
               flapping: state.trackedAlertsRecovered[alertId]
                 ? state.trackedAlertsRecovered[alertId].flapping
                 : false,
+              pendingRecoveredCount: 0,
             };
 
         const flapping = isFlapping(flappingHistory, isCurrentlyFlapping);
@@ -317,13 +321,17 @@ export const createLifecycleExecutor =
           event,
           flappingHistory,
           flapping,
+          pendingRecoveredCount,
         };
       });
 
     const trackedEventsToIndex = makeEventsDataMapFor(trackedAlertIds);
     const newEventsToIndex = makeEventsDataMapFor(newAlertIds);
     const trackedRecoveredEventsToIndex = makeEventsDataMapFor(trackedAlertRecoveredIds);
-    const allEventsToIndex = [...trackedEventsToIndex, ...newEventsToIndex];
+    const allEventsToIndex = [
+      ...getAlertsForNotification(trackedEventsToIndex),
+      ...newEventsToIndex,
+    ];
 
     // Only write alerts if:
     // - writing is enabled
@@ -354,11 +362,14 @@ export const createLifecycleExecutor =
     const nextTrackedAlerts = Object.fromEntries(
       allEventsToIndex
         .filter(({ event }) => event[ALERT_STATUS] !== ALERT_STATUS_RECOVERED)
-        .map(({ event, flappingHistory, flapping }) => {
+        .map(({ event, flappingHistory, flapping, pendingRecoveredCount }) => {
           const alertId = event[ALERT_INSTANCE_ID]!;
           const alertUuid = event[ALERT_UUID]!;
           const started = new Date(event[ALERT_START]!).toISOString();
-          return [alertId, { alertId, alertUuid, started, flappingHistory, flapping }];
+          return [
+            alertId,
+            { alertId, alertUuid, started, flappingHistory, flapping, pendingRecoveredCount },
+          ];
         })
     );
 
@@ -370,13 +381,16 @@ export const createLifecycleExecutor =
             // this is a space saving effort that will stop tracking a recovered alert if it wasn't flapping and doesn't have state changes
             // in the last max capcity number of executions
             event[ALERT_STATUS] === ALERT_STATUS_RECOVERED &&
-            (flapping || flappingHistory.filter((f) => f).length > 0)
+            (flapping || flappingHistory.filter((f: boolean) => f).length > 0)
         )
-        .map(({ event, flappingHistory, flapping }) => {
+        .map(({ event, flappingHistory, flapping, pendingRecoveredCount }) => {
           const alertId = event[ALERT_INSTANCE_ID]!;
           const alertUuid = event[ALERT_UUID]!;
           const started = new Date(event[ALERT_START]!).toISOString();
-          return [alertId, { alertId, alertUuid, started, flappingHistory, flapping }];
+          return [
+            alertId,
+            { alertId, alertUuid, started, flappingHistory, flapping, pendingRecoveredCount },
+          ];
         })
     );
 
diff --git a/x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.test.ts b/x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.test.ts
new file mode 100644
index 00000000000000..08a6c90eda0226
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.test.ts
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ALERT_STATUS_ACTIVE, ALERT_STATUS_RECOVERED } from '@kbn/rule-data-utils';
+import { getAlertsForNotification } from './get_alerts_for_notification';
+
+describe('getAlertsForNotification', () => {
+  const alert1 = {
+    event: {
+      'kibana.alert.status': ALERT_STATUS_RECOVERED,
+    },
+    flapping: true,
+    pendingRecoveredCount: 3,
+  };
+  const alert2 = {
+    event: {
+      'kibana.alert.status': ALERT_STATUS_RECOVERED,
+    },
+    flapping: false,
+  };
+  const alert3 = {
+    event: {
+      'kibana.alert.status': ALERT_STATUS_RECOVERED,
+    },
+    flapping: true,
+  };
+  const alert4 = {
+    event: {
+      'kibana.alert.status': ALERT_STATUS_ACTIVE,
+    },
+    pendingRecoveredCount: 4,
+    flappingHistory: [true, true],
+  };
+
+  test('should set pendingRecoveredCount to zero for all active alerts', () => {
+    const trackedEvents = [alert4];
+    expect(getAlertsForNotification(trackedEvents)).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "event": Object {
+            "kibana.alert.status": "active",
+          },
+          "flappingHistory": Array [
+            true,
+            true,
+          ],
+          "pendingRecoveredCount": 0,
+        },
+      ]
+    `);
+  });
+
+  test('should not remove alerts if the num of recovered alerts is not at the limit', () => {
+    const trackedEvents = [alert1, alert2, alert3];
+    expect(getAlertsForNotification(trackedEvents)).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "event": Object {
+            "kibana.alert.status": "recovered",
+          },
+          "flapping": true,
+          "pendingRecoveredCount": 0,
+        },
+        Object {
+          "event": Object {
+            "kibana.alert.status": "recovered",
+          },
+          "flapping": false,
+        },
+        Object {
+          "event": Object {
+            "event.action": "active",
+            "kibana.alert.status": "active",
+          },
+          "flapping": true,
+          "pendingRecoveredCount": 1,
+        },
+      ]
+    `);
+  });
+});
diff --git a/x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.ts b/x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.ts
new file mode 100644
index 00000000000000..75d07642c5e53d
--- /dev/null
+++ b/x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { MAX_FLAP_COUNT } from '@kbn/alerting-plugin/server/lib/flapping_utils';
+import {
+  ALERT_END,
+  ALERT_STATUS,
+  ALERT_STATUS_ACTIVE,
+  ALERT_STATUS_RECOVERED,
+  EVENT_ACTION,
+} from '@kbn/rule-data-utils';
+
+export function getAlertsForNotification(trackedEventsToIndex: any[]) {
+  return trackedEventsToIndex.map((trackedEvent) => {
+    if (trackedEvent.event[ALERT_STATUS] === ALERT_STATUS_ACTIVE) {
+      trackedEvent.pendingRecoveredCount = 0;
+    } else if (trackedEvent.event[ALERT_STATUS] === ALERT_STATUS_RECOVERED) {
+      if (trackedEvent.flapping) {
+        const count = trackedEvent.pendingRecoveredCount || 0;
+        trackedEvent.pendingRecoveredCount = count + 1;
+        if (trackedEvent.pendingRecoveredCount < MAX_FLAP_COUNT) {
+          trackedEvent.event[ALERT_STATUS] = ALERT_STATUS_ACTIVE;
+          trackedEvent.event[EVENT_ACTION] = 'active';
+          delete trackedEvent.event[ALERT_END];
+        } else {
+          trackedEvent.pendingRecoveredCount = 0;
+        }
+      }
+    }
+    return trackedEvent;
+  });
+}
diff --git a/x-pack/plugins/rule_registry/server/utils/get_updated_flapping_history.test.ts b/x-pack/plugins/rule_registry/server/utils/get_updated_flapping_history.test.ts
index af5eb3e3698fee..2194d37360f148 100644
--- a/x-pack/plugins/rule_registry/server/utils/get_updated_flapping_history.test.ts
+++ b/x-pack/plugins/rule_registry/server/utils/get_updated_flapping_history.test.ts
@@ -35,6 +35,7 @@ describe('getUpdatedFlappingHistory', () => {
           started: '2020-01-01T12:00:00.000Z',
           flappingHistory: [],
           flapping: false,
+          pendingRecoveredCount: 0,
         },
       },
       trackedAlertsRecovered: {},
@@ -57,6 +58,7 @@ describe('getUpdatedFlappingHistory', () => {
           started: '2020-01-01T12:00:00.000Z',
           flappingHistory: [],
           flapping: false,
+          pendingRecoveredCount: 0,
         },
       },
       trackedAlerts: {},
@@ -81,6 +83,7 @@ describe('getUpdatedFlappingHistory', () => {
           started: '2020-01-01T12:00:00.000Z',
           flappingHistory: [],
           flapping: false,
+          pendingRecoveredCount: 0,
         },
       },
       trackedAlertsRecovered: {},
@@ -106,6 +109,7 @@ describe('getUpdatedFlappingHistory', () => {
           started: '2020-01-01T12:00:00.000Z',
           flappingHistory: [],
           flapping: false,
+          pendingRecoveredCount: 0,
         },
       },
     };
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
index 6f1c816feeffdc..73968703bf9bbe 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts
@@ -581,9 +581,9 @@ export default function eventLogTests({ getService }: FtrProviderContext) {
                 // make sure the counts of the # of events per type are as expected
                 ['execute-start', { gte: 25 }],
                 ['execute', { gte: 25 }],
-                ['execute-action', { equal: 23 }],
-                ['new-instance', { equal: 3 }],
-                ['active-instance', { gte: 23 }],
+                ['execute-action', { equal: 25 }],
+                ['new-instance', { equal: 2 }],
+                ['active-instance', { gte: 25 }],
                 ['recovered-instance', { equal: 2 }],
               ]),
             });
@@ -596,7 +596,9 @@ export default function eventLogTests({ getService }: FtrProviderContext) {
                 event?.event?.action === 'recovered-instance'
             )
             .map((event) => event?.kibana?.alert?.flapping);
-          const result = [false, false, false].concat(new Array(21).fill(true)).concat([false]);
+          const result = [false, false, false]
+            .concat(new Array(20).fill(true))
+            .concat([false, false, false, false]);
           expect(flapping).to.eql(result);
         });
 
@@ -655,9 +657,9 @@ export default function eventLogTests({ getService }: FtrProviderContext) {
                 // make sure the counts of the # of events per type are as expected
                 ['execute-start', { gte: 20 }],
                 ['execute', { gte: 20 }],
-                ['execute-action', { equal: 3 }],
+                ['execute-action', { equal: 9 }],
                 ['new-instance', { equal: 3 }],
-                ['active-instance', { gte: 3 }],
+                ['active-instance', { gte: 9 }],
                 ['recovered-instance', { equal: 3 }],
               ]),
             });
@@ -670,7 +672,20 @@ export default function eventLogTests({ getService }: FtrProviderContext) {
                 event?.event?.action === 'recovered-instance'
             )
             .map((event) => event?.kibana?.alert?.flapping);
-          expect(flapping).to.eql([false, false, false, true, false, false]);
+          expect(flapping).to.eql([
+            false,
+            false,
+            false,
+            true,
+            true,
+            true,
+            true,
+            true,
+            true,
+            true,
+            true,
+            true,
+          ]);
         });
       });
     }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log_alerts.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log_alerts.ts
index 86754ee31d14fd..e5d69507e8c6b1 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log_alerts.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log_alerts.ts
@@ -132,7 +132,9 @@ export default function eventLogAlertTests({ getService }: FtrProviderContext) {
             break;
         }
       }
-      expect(flapping).to.eql(new Array(instanceEvents.length - 1).fill(false).concat(true));
+      expect(flapping).to.eql(
+        new Array(instanceEvents.length - 4).fill(false).concat([true, true, true, true])
+      );
     });
   });
 }

From caeba1ef410c08a49f6cd7945a30bee29e7688ca Mon Sep 17 00:00:00 2001
From: "Quynh Nguyen (Quinn)" <43350163+qn895@users.noreply.github.com>
Date: Mon, 23 Jan 2023 13:10:32 -0600
Subject: [PATCH 17/54] [ML] Add geo fields support for Unified field list, add
 statistics flyover to Anomaly detection job creation wizards (#147322)

## Summary

This PR adds Unified field list statistics flyover to Anomaly detection
job creation wizards. The option is available for aggregation fields,
partition fields, rare fields, influencer fields, etc.


https://user-images.githubusercontent.com/43350163/206930114-2080e441-7138-494b-9845-01fad147cc3f.mov



### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to
identify risks that should be tested prior to the change/feature
release.

When forming the risk matrix, consider some of the following examples
and how they may potentially impact the change:

| Risk | Probability | Severity | Mitigation/Notes |

|---------------------------|-------------|----------|-------------------------|
| Multiple Spaces&mdash;unexpected behavior in non-default Kibana Space.
| Low | High | Integration tests will verify that all features are still
supported in non-default Kibana Space and when user switches between
spaces. |
| Multiple nodes&mdash;Elasticsearch polling might have race conditions
when multiple Kibana nodes are polling for the same tasks. | High | Low
| Tasks are idempotent, so executing them multiple times will not result
in logical error, but will degrade performance. To test for this case we
add plenty of unit tests around this logic and document manual testing
procedure. |
| Code should gracefully handle cases when feature X or plugin Y are
disabled. | Medium | High | Unit tests will verify that any feature flag
or plugin combination still results in our service operational. |
| [See more potential risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) |


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Co-authored-by: James Gowdy <jgowdy@elastic.co>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../utils/field_examples_calculator.test.ts   | 38 ++++++++--
 .../common/utils/field_examples_calculator.ts | 34 +++++++--
 .../common/utils/field_stats_utils.ts         | 46 +++++++++---
 .../field_stats/field_stats.test.tsx          |  4 +-
 .../components/field_stats/field_stats.tsx    | 17 +++--
 .../form_based/field_item.test.tsx            |  6 +-
 .../ml/common/util/get_field_icon_types.ts    | 30 ++++++++
 x-pack/plugins/ml/kibana.json                 |  1 +
 .../field_stats_content.tsx                   | 73 +++++++++++++++++++
 .../field_stats_flyout/field_stats_flyout.tsx | 68 +++++++++++++++++
 .../field_stats_flyout_provider.tsx           | 38 ++++++++++
 .../components/field_stats_flyout/index.ts    | 14 ++++
 .../use_field_stats_flytout_context.ts        | 28 +++++++
 .../components/field_stats_info_button.tsx    | 70 ++++++++++++++++++
 .../new_job/common/job_creator/job_creator.ts |  7 ++
 .../common/job_creator/util/general.ts        |  2 +
 .../advanced_detector_modal.tsx               | 20 ++++-
 .../components/agg_select/agg_select.tsx      | 59 ++++++++++-----
 .../categorization_field_select.tsx           | 12 ++-
 .../categorization_per_partition_input.tsx    | 10 ++-
 .../components/geo_field/geo_field_select.tsx |  7 +-
 .../influencers/influencers_select.tsx        |  6 +-
 .../rare_field/rare_field_select.tsx          |  5 ++
 .../split_field_select/split_field_select.tsx |  4 +
 .../summary_count_field_select.tsx            |  6 +-
 .../pick_fields_step/pick_fields.tsx          |  9 ++-
 .../new_job/pages/new_job/wizard_steps.tsx    | 32 +++++---
 .../new_job/utils/use_field_stats_trigger.tsx | 57 +++++++++++++++
 x-pack/plugins/ml/tsconfig.json               |  2 +
 .../apps/lens/group1/fields_list.ts           |  8 +-
 30 files changed, 635 insertions(+), 78 deletions(-)
 create mode 100644 x-pack/plugins/ml/common/util/get_field_icon_types.ts
 create mode 100644 x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_content.tsx
 create mode 100644 x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_flyout.tsx
 create mode 100644 x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_flyout_provider.tsx
 create mode 100644 x-pack/plugins/ml/public/application/components/field_stats_flyout/index.ts
 create mode 100644 x-pack/plugins/ml/public/application/components/field_stats_flyout/use_field_stats_flytout_context.ts
 create mode 100644 x-pack/plugins/ml/public/application/jobs/new_job/common/components/field_stats_info_button.tsx
 create mode 100644 x-pack/plugins/ml/public/application/jobs/new_job/utils/use_field_stats_trigger.tsx

diff --git a/src/plugins/unified_field_list/common/utils/field_examples_calculator.test.ts b/src/plugins/unified_field_list/common/utils/field_examples_calculator.test.ts
index 60957ce7da278d..0e0e3c886066f9 100644
--- a/src/plugins/unified_field_list/common/utils/field_examples_calculator.test.ts
+++ b/src/plugins/unified_field_list/common/utils/field_examples_calculator.test.ts
@@ -11,11 +11,17 @@ import type { DataView } from '@kbn/data-views-plugin/public';
 import { stubLogstashDataView as dataView } from '@kbn/data-views-plugin/common/data_view.stub';
 import { getFieldExampleBuckets, groupValues, getFieldValues } from './field_examples_calculator';
 
-const hitsAsValues: Array<Record<string, string | number | string[]>> = [
+const hitsAsValues: Array<Record<string, string | number | string[] | object>> = [
   {
     extension: 'html',
     bytes: 360.20000000000005,
     '@tags': ['success', 'info'],
+    point: [
+      {
+        type: 'Point',
+        coordinates: [100, 20],
+      },
+    ],
   },
   {
     extension: 'gif',
@@ -25,10 +31,22 @@ const hitsAsValues: Array<Record<string, string | number | string[]>> = [
   {
     extension: 'png',
     bytes: 841.6,
+    point: [
+      {
+        type: 'Point',
+        coordinates: [100, 20],
+      },
+    ],
   },
   {
     extension: 'html',
     bytes: 1626.4,
+    point: [
+      {
+        type: 'Point',
+        coordinates: [100, 20],
+      },
+    ],
   },
   {
     extension: 'php',
@@ -106,7 +124,7 @@ const hits = hitsAsValues.map((value) => ({
   _id: '1945',
   _score: 1,
   fields: Object.keys(value).reduce(
-    (result: Record<string, Array<string | number>>, fieldName: string) => {
+    (result: Record<string, Array<string | number | object>>, fieldName: string) => {
       const fieldValue = value[fieldName];
       result[fieldName] = Array.isArray(fieldValue) ? fieldValue : [fieldValue];
       return result;
@@ -211,13 +229,23 @@ describe('fieldExamplesCalculator', function () {
       expect(map(result.buckets, 'key')).toEqual(['html', 'php', 'gif']);
     });
 
-    it('fails to analyze geo and attachment types', function () {
+    it('analyzes geo types', function () {
       params.field = dataView.fields.getByName('point');
-      expect(() => getFieldExampleBuckets(params)).toThrowError();
+      expect(getFieldExampleBuckets(params)).toEqual({
+        buckets: [{ count: 3, key: { coordinates: [100, 20], type: 'Point' } }],
+        sampledDocuments: 20,
+        sampledValues: 3,
+      });
 
       params.field = dataView.fields.getByName('area');
-      expect(() => getFieldExampleBuckets(params)).toThrowError();
+      expect(getFieldExampleBuckets(params)).toEqual({
+        buckets: [],
+        sampledDocuments: 20,
+        sampledValues: 0,
+      });
+    });
 
+    it('fails to analyze attachment types', function () {
       params.field = dataView.fields.getByName('request_body');
       expect(() => getFieldExampleBuckets(params)).toThrowError();
 
diff --git a/src/plugins/unified_field_list/common/utils/field_examples_calculator.ts b/src/plugins/unified_field_list/common/utils/field_examples_calculator.ts
index 6021146b2f960e..66fd348211ac3b 100644
--- a/src/plugins/unified_field_list/common/utils/field_examples_calculator.ts
+++ b/src/plugins/unified_field_list/common/utils/field_examples_calculator.ts
@@ -12,6 +12,7 @@ import { map, sortBy, defaults, isObject, pick } from 'lodash';
 import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { DataView, DataViewField } from '@kbn/data-plugin/common';
 import { flattenHit } from '@kbn/data-plugin/common';
+import { FieldFormat } from '@kbn/field-formats-plugin/common';
 
 type FieldHitValue = any;
 
@@ -26,10 +27,27 @@ export const canProvideExamplesForField = (field: DataViewField): boolean => {
   if (field.name === '_score') {
     return false;
   }
-  return ['string', 'text', 'keyword', 'version', 'ip', 'number'].includes(field.type);
+  return [
+    'string',
+    'text',
+    'keyword',
+    'version',
+    'ip',
+    'number',
+    'geo_point',
+    'geo_shape',
+  ].includes(field.type);
 };
 
-export function getFieldExampleBuckets(params: FieldValueCountsParams) {
+export const showExamplesForField = (field: DataViewField): boolean => {
+  return (
+    (!field.aggregatable && canProvideExamplesForField(field)) ||
+    field.type === 'geo_point' ||
+    field.type === 'geo_shape'
+  );
+};
+
+export function getFieldExampleBuckets(params: FieldValueCountsParams, formatter?: FieldFormat) {
   params = defaults(params, {
     count: 5,
   });
@@ -41,7 +59,8 @@ export function getFieldExampleBuckets(params: FieldValueCountsParams) {
   }
 
   const records = getFieldValues(params.hits, params.field, params.dataView);
-  const { groups, sampledValues } = groupValues(records);
+
+  const { groups, sampledValues } = groupValues(records, formatter);
   const buckets = sortBy(groups, ['count', 'order'])
     .reverse()
     .slice(0, params.count)
@@ -64,7 +83,10 @@ export function getFieldValues(
   });
 }
 
-export function groupValues(records: FieldHitValue[]): {
+export function groupValues(
+  records: FieldHitValue[],
+  formatter?: FieldFormat
+): {
   groups: Record<string, { count: number; key: any; order: number }>;
   sampledValues: number;
 } {
@@ -86,7 +108,9 @@ export function groupValues(records: FieldHitValue[]): {
       values = recordValues == null ? [] : [recordValues];
     }
 
-    values.forEach((value) => {
+    values.forEach((v) => {
+      const value = formatter ? formatter.convert(v) : v;
+
       if (visitedValuesMap[value]) {
         // already counted in groups
         return;
diff --git a/src/plugins/unified_field_list/common/utils/field_stats_utils.ts b/src/plugins/unified_field_list/common/utils/field_stats_utils.ts
index 9fac4c04946c97..ddda8de350e6bf 100644
--- a/src/plugins/unified_field_list/common/utils/field_stats_utils.ts
+++ b/src/plugins/unified_field_list/common/utils/field_stats_utils.ts
@@ -10,8 +10,13 @@ import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import DateMath from '@kbn/datemath';
 import type { DataView, DataViewField } from '@kbn/data-views-plugin/common';
 import type { ESSearchResponse } from '@kbn/es-types';
+import { FieldFormat } from '@kbn/field-formats-plugin/common';
 import type { FieldStatsResponse } from '../types';
-import { getFieldExampleBuckets, canProvideExamplesForField } from './field_examples_calculator';
+import {
+  getFieldExampleBuckets,
+  canProvideExamplesForField,
+  showExamplesForField,
+} from './field_examples_calculator';
 
 export type SearchHandler = ({
   aggs,
@@ -110,6 +115,10 @@ export async function fetchAndCalculateFieldStats({
       : {};
   }
 
+  if (field.type === 'geo_point' || field.type === 'geo_shape') {
+    return await getGeoExamples(searchHandler, field, dataView);
+  }
+
   if (!canProvideAggregatedStatsForField(field)) {
     return {};
   }
@@ -142,8 +151,7 @@ function canProvideAggregatedStatsForField(field: DataViewField): boolean {
 
 export function canProvideStatsForField(field: DataViewField): boolean {
   return (
-    (field.aggregatable && canProvideAggregatedStatsForField(field)) ||
-    (!field.aggregatable && canProvideExamplesForField(field))
+    (field.aggregatable && canProvideAggregatedStatsForField(field)) || showExamplesForField(field)
   );
 }
 
@@ -357,7 +365,8 @@ export async function getDateHistogram(
 export async function getSimpleExamples(
   search: SearchHandler,
   field: DataViewField,
-  dataView: DataView
+  dataView: DataView,
+  formatter?: FieldFormat
 ): Promise<FieldStatsResponse<string | number>> {
   try {
     const fieldRef = getFieldRef(field);
@@ -368,13 +377,15 @@ export async function getSimpleExamples(
     };
 
     const simpleExamplesResult = await search(simpleExamplesBody);
-
-    const fieldExampleBuckets = getFieldExampleBuckets({
-      hits: simpleExamplesResult.hits.hits,
-      field,
-      dataView,
-      count: DEFAULT_TOP_VALUES_SIZE,
-    });
+    const fieldExampleBuckets = getFieldExampleBuckets(
+      {
+        hits: simpleExamplesResult.hits.hits,
+        field,
+        dataView,
+        count: DEFAULT_TOP_VALUES_SIZE,
+      },
+      formatter
+    );
 
     return {
       totalDocuments: getHitsTotal(simpleExamplesResult),
@@ -390,6 +401,19 @@ export async function getSimpleExamples(
   }
 }
 
+export async function getGeoExamples(
+  search: SearchHandler,
+  field: DataViewField,
+  dataView: DataView
+): Promise<FieldStatsResponse<string | number>> {
+  try {
+    const formatter = dataView.getFormatterForField(field);
+    return await getSimpleExamples(search, field, dataView, formatter);
+  } catch (e) {
+    console.error(e); // eslint-disable-line  no-console
+    return {};
+  }
+}
 function getFieldRef(field: DataViewField) {
   return field.scripted
     ? {
diff --git a/src/plugins/unified_field_list/public/components/field_stats/field_stats.test.tsx b/src/plugins/unified_field_list/public/components/field_stats/field_stats.test.tsx
index 317fe9082d28e1..dc0fefabb0d987 100644
--- a/src/plugins/unified_field_list/public/components/field_stats/field_stats.test.tsx
+++ b/src/plugins/unified_field_list/public/components/field_stats/field_stats.test.tsx
@@ -280,14 +280,14 @@ describe('UnifiedFieldList <FieldStats />', () => {
     expect(wrapper.text()).toBe('Analysis is not available for this field.');
   });
 
-  it('should not request field stats for geo fields', async () => {
+  it('should request field examples for geo fields', async () => {
     const wrapper = await mountComponent(
       <FieldStats {...defaultProps} field={dataView.fields.find((f) => f.name === 'geo_shape')!} />
     );
 
     expect(loadFieldStats).toHaveBeenCalled();
 
-    expect(wrapper.text()).toBe('Analysis is not available for this field.');
+    expect(wrapper.text()).toBe('No field data for the current search.');
   });
 
   it('should render a message if no data is found', async () => {
diff --git a/src/plugins/unified_field_list/public/components/field_stats/field_stats.tsx b/src/plugins/unified_field_list/public/components/field_stats/field_stats.tsx
index 99c31fc9f64e1f..ae5857c4feafaf 100755
--- a/src/plugins/unified_field_list/public/components/field_stats/field_stats.tsx
+++ b/src/plugins/unified_field_list/public/components/field_stats/field_stats.tsx
@@ -34,6 +34,7 @@ import {
 } from '@elastic/charts';
 import { i18n } from '@kbn/i18n';
 import { buildEsQuery, Query, Filter, AggregateQuery } from '@kbn/es-query';
+import { showExamplesForField } from '../../../common/utils/field_examples_calculator';
 import { OverrideFieldTopValueBarCallback } from './field_top_values_bucket';
 import type { BucketedAggregation } from '../../../common/types';
 import { canProvideStatsForField } from '../../../common/utils/field_stats_utils';
@@ -208,12 +209,14 @@ const FieldStatsComponent: React.FC<FieldStatsProps> = ({
 
   useEffect(() => {
     fetchData();
+  }, [dataViewOrDataViewId, field, dslQuery, query, filters, fromDate, toDate, services]); // eslint-disable-line react-hooks/exhaustive-deps
 
+  useEffect(() => {
     return () => {
       isCanceledRef.current = true;
       abortControllerRef.current?.abort();
     };
-  }, []); // eslint-disable-line react-hooks/exhaustive-deps
+  }, []);
 
   const chartTheme = charts.theme.useChartsTheme();
   const chartBaseTheme = charts.theme.useChartsBaseTheme();
@@ -262,8 +265,8 @@ const FieldStatsComponent: React.FC<FieldStatsProps> = ({
   if (!dataView) {
     return null;
   }
-
   const formatter = dataView.getFormatterForField(field);
+
   let title = <></>;
 
   function combineWithTitleAndFooter(el: React.ReactElement) {
@@ -423,12 +426,12 @@ const FieldStatsComponent: React.FC<FieldStatsProps> = ({
     title = (
       <EuiTitle size="xxxs">
         <h6>
-          {field.aggregatable
-            ? i18n.translate('unifiedFieldList.fieldStats.topValuesLabel', {
-                defaultMessage: 'Top values',
-              })
-            : i18n.translate('unifiedFieldList.fieldStats.examplesLabel', {
+          {showExamplesForField(field)
+            ? i18n.translate('unifiedFieldList.fieldStats.examplesLabel', {
                 defaultMessage: 'Examples',
+              })
+            : i18n.translate('unifiedFieldList.fieldStats.topValuesLabel', {
+                defaultMessage: 'Top values',
               })}
         </h6>
       </EuiTitle>
diff --git a/x-pack/plugins/lens/public/datasources/form_based/field_item.test.tsx b/x-pack/plugins/lens/public/datasources/form_based/field_item.test.tsx
index 1ce54610aeab84..343f724b71e2ff 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/field_item.test.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/field_item.test.tsx
@@ -463,7 +463,7 @@ describe('IndexPattern Field Item', () => {
     expect(wrapper.find(FieldVisualizeButton).exists()).toBeFalsy();
   });
 
-  it('should not request field stats for geo fields but render Visualize button', async () => {
+  it('should request examples for geo fields and render Visualize button', async () => {
     const wrapper = await getComponent({
       ...defaultProps,
       field: {
@@ -482,7 +482,9 @@ describe('IndexPattern Field Item', () => {
     expect(loadFieldStats).toHaveBeenCalled();
     expect(wrapper.find(EuiPopover).prop('isOpen')).toEqual(true);
     expect(wrapper.find(EuiLoadingSpinner)).toHaveLength(0);
-    expect(wrapper.find(FieldStats).text()).toBe('Analysis is not available for this field.');
+    expect(wrapper.find(FieldStats).text()).toBe(
+      'Lens is unable to create visualizations with this field because it does not contain data. To create a visualization, drag and drop a different field.'
+    );
     expect(wrapper.find(FieldVisualizeButton).exists()).toBeTruthy();
   });
 
diff --git a/x-pack/plugins/ml/common/util/get_field_icon_types.ts b/x-pack/plugins/ml/common/util/get_field_icon_types.ts
new file mode 100644
index 00000000000000..517089d6b0fa67
--- /dev/null
+++ b/x-pack/plugins/ml/common/util/get_field_icon_types.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ES_FIELD_TYPES } from '@kbn/field-types';
+import type { FieldIconProps } from '@kbn/react-field';
+
+export function getKbnFieldIconType(type: string): FieldIconProps['type'] {
+  switch (type) {
+    case ES_FIELD_TYPES.FLOAT:
+    case ES_FIELD_TYPES.HALF_FLOAT:
+    case ES_FIELD_TYPES.SCALED_FLOAT:
+    case ES_FIELD_TYPES.DOUBLE:
+    case ES_FIELD_TYPES.INTEGER:
+    case ES_FIELD_TYPES.LONG:
+    case ES_FIELD_TYPES.SHORT:
+    case ES_FIELD_TYPES.UNSIGNED_LONG:
+      return 'number';
+
+    case ES_FIELD_TYPES.DATE:
+    case ES_FIELD_TYPES.DATE_NANOS:
+      return 'date';
+
+    default:
+      return type as FieldIconProps['type'];
+  }
+}
diff --git a/x-pack/plugins/ml/kibana.json b/x-pack/plugins/ml/kibana.json
index c7191118e25999..b794f3ba39a03f 100644
--- a/x-pack/plugins/ml/kibana.json
+++ b/x-pack/plugins/ml/kibana.json
@@ -51,6 +51,7 @@
     "maps",
     "savedObjects",
     "usageCollection",
+    "unifiedFieldList",
     "unifiedSearch"
   ],
   "extraPublicDirs": [
diff --git a/x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_content.tsx b/x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_content.tsx
new file mode 100644
index 00000000000000..cf04337e06d04b
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_content.tsx
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { FC, useContext, useEffect, useMemo, useState } from 'react';
+import { FieldStats, FieldStatsServices } from '@kbn/unified-field-list-plugin/public';
+import moment from 'moment';
+import { isDefined } from '@kbn/ml-is-defined';
+import { getDefaultDatafeedQuery } from '../../jobs/new_job/utils/new_job_utils';
+import { useMlKibana } from '../../contexts/kibana';
+import { JobCreatorContext } from '../../jobs/new_job/pages/components/job_creator_context';
+import { useFieldStatsFlyoutContext } from './use_field_stats_flytout_context';
+
+const defaultDatafeedQuery = getDefaultDatafeedQuery();
+
+export const FieldStatsContent: FC = () => {
+  const {
+    services: { uiSettings, data, fieldFormats, charts },
+  } = useMlKibana();
+  const fieldStatsServices: FieldStatsServices = {
+    uiSettings,
+    dataViews: data.dataViews,
+    data,
+    fieldFormats,
+    charts,
+  };
+  const { jobCreator, jobCreatorUpdated } = useContext(JobCreatorContext);
+  const { fieldName } = useFieldStatsFlyoutContext();
+
+  const [start, setStart] = useState(jobCreator.start);
+  const [end, setEnd] = useState(jobCreator.end);
+
+  useEffect(() => {
+    if (jobCreator.start !== start || jobCreator.end !== end) {
+      setStart(jobCreator.start);
+      setEnd(jobCreator.end);
+    }
+
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [jobCreatorUpdated]);
+
+  // Format timestamp to ISO formatted date strings
+  const timeRange = useMemo(
+    () =>
+      start && end
+        ? { from: moment(start).toISOString(), to: moment(end).toISOString() }
+        : undefined,
+    [start, end]
+  );
+
+  const fieldForStats = useMemo(
+    () => (isDefined(fieldName) ? jobCreator.dataView.getFieldByName(fieldName) : undefined),
+    [fieldName, jobCreator.dataView]
+  );
+
+  const showFieldStats = timeRange && isDefined(jobCreator.dataViewId) && fieldForStats;
+
+  return showFieldStats ? (
+    <FieldStats
+      key={fieldForStats.name}
+      services={fieldStatsServices}
+      dslQuery={jobCreator.query ?? defaultDatafeedQuery}
+      fromDate={timeRange.from}
+      toDate={timeRange.to}
+      dataViewOrDataViewId={jobCreator.dataView}
+      field={fieldForStats}
+      data-test-subj={`jobCreatorFieldStatsPopover ${fieldForStats.name}`}
+    />
+  ) : null;
+};
diff --git a/x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_flyout.tsx b/x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_flyout.tsx
new file mode 100644
index 00000000000000..31d949a0defca3
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_flyout.tsx
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, FC } from 'react';
+import { FormattedMessage } from '@kbn/i18n-react';
+
+import {
+  EuiFlyout,
+  EuiFlyoutHeader,
+  EuiTitle,
+  EuiFlyoutBody,
+  useGeneratedHtmlId,
+  EuiFlyoutFooter,
+  EuiButton,
+  EuiSpacer,
+} from '@elastic/eui';
+import { css } from '@emotion/react';
+import { useFieldStatsFlyoutContext } from './use_field_stats_flytout_context';
+import { FieldStatsContent } from './field_stats_content';
+
+export const FieldStatsFlyout: FC = () => {
+  const { setIsFlyoutVisible, isFlyoutVisible, fieldName } = useFieldStatsFlyoutContext();
+
+  const closeFlyout = useCallback(() => setIsFlyoutVisible(false), []); // eslint-disable-line react-hooks/exhaustive-deps
+  const pushedFlyoutTitleId = useGeneratedHtmlId({
+    prefix: 'mlJobCreationWizardFieldStats',
+  });
+
+  if (isFlyoutVisible) {
+    return (
+      <EuiFlyout type="push" size="xs" onClose={closeFlyout} aria-labelledby={pushedFlyoutTitleId}>
+        <EuiFlyoutHeader hasBorder>
+          <EuiTitle size="m">
+            <h3 id={pushedFlyoutTitleId}>
+              <FormattedMessage
+                id="xpack.ml.newJob.wizard.fieldContextFlyoutTitle"
+                defaultMessage="Field statistics"
+              />
+            </h3>
+          </EuiTitle>
+        </EuiFlyoutHeader>
+        <EuiFlyoutBody
+          css={css`
+            width: 300px;
+          `}
+        >
+          <b>{fieldName}</b>
+          <EuiSpacer />
+          <FieldStatsContent />
+        </EuiFlyoutBody>
+        <EuiFlyoutFooter>
+          <EuiButton onClick={closeFlyout}>
+            <FormattedMessage
+              id="xpack.ml.newJob.wizard.fieldContextFlyoutCloseButton"
+              defaultMessage="Close"
+            />
+          </EuiButton>
+        </EuiFlyoutFooter>
+      </EuiFlyout>
+    );
+  }
+
+  return null;
+};
diff --git a/x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_flyout_provider.tsx b/x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_flyout_provider.tsx
new file mode 100644
index 00000000000000..49d71894513138
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/components/field_stats_flyout/field_stats_flyout_provider.tsx
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useState } from 'react';
+import { FieldStatsFlyout } from './field_stats_flyout';
+import { MLJobWizardFieldStatsFlyoutContext } from './use_field_stats_flytout_context';
+
+export const FieldStatsFlyoutProvider = ({ children }: { children: React.ReactElement }) => {
+  const [isFieldStatsFlyoutVisible, setFieldStatsIsFlyoutVisible] = useState(false);
+  const [fieldName, setFieldName] = useState<string | undefined>();
+  const [fieldValue, setFieldValue] = useState<string | number | undefined>();
+
+  const toggleFieldStatsFlyoutVisible = useCallback(
+    () => setFieldStatsIsFlyoutVisible(!isFieldStatsFlyoutVisible),
+    [isFieldStatsFlyoutVisible]
+  );
+
+  return (
+    <MLJobWizardFieldStatsFlyoutContext.Provider
+      value={{
+        isFlyoutVisible: isFieldStatsFlyoutVisible,
+        setIsFlyoutVisible: setFieldStatsIsFlyoutVisible,
+        toggleFlyoutVisible: toggleFieldStatsFlyoutVisible,
+        setFieldName,
+        fieldName,
+        setFieldValue,
+        fieldValue,
+      }}
+    >
+      <FieldStatsFlyout />
+      {children}
+    </MLJobWizardFieldStatsFlyoutContext.Provider>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/components/field_stats_flyout/index.ts b/x-pack/plugins/ml/public/application/components/field_stats_flyout/index.ts
new file mode 100644
index 00000000000000..bc20a20a36c069
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/components/field_stats_flyout/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { FieldStatsFlyout } from './field_stats_flyout';
+export { FieldStatsContent } from './field_stats_content';
+export { FieldStatsFlyoutProvider } from './field_stats_flyout_provider';
+export {
+  MLJobWizardFieldStatsFlyoutContext,
+  useFieldStatsFlyoutContext,
+} from './use_field_stats_flytout_context';
diff --git a/x-pack/plugins/ml/public/application/components/field_stats_flyout/use_field_stats_flytout_context.ts b/x-pack/plugins/ml/public/application/components/field_stats_flyout/use_field_stats_flytout_context.ts
new file mode 100644
index 00000000000000..882201a7cd9ea5
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/components/field_stats_flyout/use_field_stats_flytout_context.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createContext, useContext } from 'react';
+interface MLJobWizardFieldStatsFlyoutProps {
+  isFlyoutVisible: boolean;
+  setIsFlyoutVisible: (v: boolean) => void;
+  toggleFlyoutVisible: () => void;
+  setFieldName: (v: string | undefined) => void;
+  fieldName?: string;
+  setFieldValue: (v: string) => void;
+  fieldValue?: string | number;
+}
+export const MLJobWizardFieldStatsFlyoutContext = createContext<MLJobWizardFieldStatsFlyoutProps>({
+  isFlyoutVisible: false,
+  setIsFlyoutVisible: () => {},
+  toggleFlyoutVisible: () => {},
+  setFieldName: () => {},
+  setFieldValue: () => {},
+});
+
+export function useFieldStatsFlyoutContext() {
+  return useContext(MLJobWizardFieldStatsFlyoutContext);
+}
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/components/field_stats_info_button.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/common/components/field_stats_info_button.tsx
new file mode 100644
index 00000000000000..48386731c24c07
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/components/field_stats_info_button.tsx
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiButtonIcon, EuiFlexGroup, EuiFlexItem, EuiHighlight, EuiToolTip } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React from 'react';
+import { FieldIcon } from '@kbn/react-field';
+import { EVENT_RATE_FIELD_ID, Field } from '../../../../../../common/types/fields';
+import { getKbnFieldIconType } from '../../../../../../common/util/get_field_icon_types';
+
+export const FieldStatsInfoButton = ({
+  field,
+  label,
+  searchValue = '',
+  onButtonClick,
+}: {
+  field: Field;
+  label: string;
+  searchValue?: string;
+  onButtonClick?: (field: Field) => void;
+}) => {
+  return (
+    <EuiFlexGroup gutterSize="none" alignItems="center">
+      <EuiFlexItem grow={false}>
+        <EuiToolTip
+          content={i18n.translate(
+            'xpack.ml.newJob.wizard.fieldContextPopover.inspectFieldStatsTooltip',
+            {
+              defaultMessage: 'Inspect field statistics',
+            }
+          )}
+        >
+          <EuiButtonIcon
+            disabled={field.id === EVENT_RATE_FIELD_ID}
+            size="xs"
+            iconType="inspect"
+            onClick={(ev: React.MouseEvent<HTMLButtonElement>) => {
+              if (ev.type === 'click') {
+                ev.currentTarget.focus();
+              }
+              ev.preventDefault();
+              ev.stopPropagation();
+
+              if (onButtonClick) {
+                onButtonClick(field);
+              }
+            }}
+            aria-label={i18n.translate(
+              'xpack.ml.newJob.wizard.fieldContextPopover.inspectFieldStatsTooltipArialabel',
+              {
+                defaultMessage: 'Inspect field statistics',
+              }
+            )}
+            data-test-subj={'mlAggSelectFieldStatsPopoverButton'}
+          />
+        </EuiToolTip>
+      </EuiFlexItem>
+      <EuiFlexItem grow={false} css={{ paddingRight: '4px' }}>
+        <FieldIcon type={getKbnFieldIconType(field.type)} fill="none" />
+      </EuiFlexItem>
+      <EuiFlexItem grow={true}>
+        <EuiHighlight search={searchValue}>{label}</EuiHighlight>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
index 6550e5a6d58cae..36366b31a8ea2d 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts
@@ -105,6 +105,13 @@ export class JobCreator {
     return this._type;
   }
 
+  public get dataView(): DataView {
+    return this._indexPattern;
+  }
+  public get dataViewId(): string | undefined {
+    return this._indexPattern.id;
+  }
+
   public get indexPatternTitle(): string {
     return this._indexPatternTitle;
   }
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
index 3112a9cc4455b7..c3b74fdfad5fe7 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/util/general.ts
@@ -93,11 +93,13 @@ export function createFieldOptions(fields: Field[], additionalFields: Field[]) {
       .filter((f) => f.id !== EVENT_RATE_FIELD_ID)
       .map((f) => ({
         label: f.name,
+        field: f,
       })),
     ...additionalFields
       .filter((f) => fields.some((f2) => f2.id === f.id) === false)
       .map((f) => ({
         label: f.id,
+        field: f,
       })),
   ].sort((a, b) => a.label.localeCompare(b.label));
 }
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/advanced_detector_modal/advanced_detector_modal.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/advanced_detector_modal/advanced_detector_modal.tsx
index b7ec413b18e2ac..d2ce04f8beb7ea 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/advanced_detector_modal/advanced_detector_modal.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/advanced_detector_modal/advanced_detector_modal.tsx
@@ -16,6 +16,7 @@ import {
   EuiHorizontalRule,
   EuiTextArea,
 } from '@elastic/eui';
+import { useFieldStatsTrigger } from '../../../../../utils/use_field_stats_trigger';
 import { JobCreatorContext } from '../../../job_creator_context';
 import { AdvancedJobCreator } from '../../../../../common/job_creator';
 import {
@@ -99,9 +100,12 @@ export const AdvancedDetectorModal: FC<Props> = ({
   const usingScriptFields = jobCreator.additionalFields.length > 0;
   // list of aggregation combobox options.
 
+  const { renderOption, optionCss } = useFieldStatsTrigger();
+
   const aggOptions: EuiComboBoxOptionOption[] = aggs
     .filter((agg) => filterAggs(agg, usingScriptFields))
-    .map(createAggOption);
+    .map(createAggOption)
+    .map((o) => ({ ...o, css: optionCss }));
 
   // fields available for the selected agg
   const { currentFieldOptions, setCurrentFieldOptions } = useCurrentFieldOptions(
@@ -109,17 +113,19 @@ export const AdvancedDetectorModal: FC<Props> = ({
     filterCategoryFields(jobCreator.additionalFields, false),
     selectedFieldNames
   );
-
   const allFieldOptions: EuiComboBoxOptionOption[] = [
     ...createFieldOptions(fields, jobCreator.additionalFields),
-  ].sort(comboBoxOptionsSort);
+  ]
+    .sort(comboBoxOptionsSort)
+    .map((o) => ({ ...o, css: optionCss }));
 
   const splitFieldOptions: EuiComboBoxOptionOption[] = [
     ...allFieldOptions,
     ...createMlcategoryFieldOption(jobCreator.categorizationFieldName),
   ]
     .sort(comboBoxOptionsSort)
-    .filter(({ label }) => selectedFieldNames.includes(label) === false);
+    .filter(({ label }) => selectedFieldNames.includes(label) === false)
+    .map((o) => ({ ...o, css: optionCss }));
 
   const eventRateField = fields.find((f) => f.id === EVENT_RATE_FIELD_ID);
 
@@ -245,6 +251,7 @@ export const AdvancedDetectorModal: FC<Props> = ({
                 selectedOptions={createSelectedOptions(aggOption)}
                 onChange={onOptionChange(setAggOption)}
                 isClearable={true}
+                renderOption={renderOption}
               />
             </AggDescription>
           </EuiFlexItem>
@@ -257,6 +264,7 @@ export const AdvancedDetectorModal: FC<Props> = ({
                 onChange={onOptionChange(setFieldOption)}
                 isClearable={true}
                 isDisabled={fieldOptionEnabled === false}
+                renderOption={renderOption}
               />
             </FieldDescription>
           </EuiFlexItem>
@@ -272,6 +280,7 @@ export const AdvancedDetectorModal: FC<Props> = ({
                 onChange={onOptionChange(setByFieldOption)}
                 isClearable={true}
                 isDisabled={splitFieldsEnabled === false}
+                renderOption={renderOption}
               />
             </ByFieldDescription>
           </EuiFlexItem>
@@ -284,6 +293,7 @@ export const AdvancedDetectorModal: FC<Props> = ({
                 onChange={onOptionChange(setOverFieldOption)}
                 isClearable={true}
                 isDisabled={splitFieldsEnabled === false}
+                renderOption={renderOption}
               />
             </OverFieldDescription>
           </EuiFlexItem>
@@ -296,6 +306,7 @@ export const AdvancedDetectorModal: FC<Props> = ({
                 onChange={onOptionChange(setPartitionFieldOption)}
                 isClearable={true}
                 isDisabled={splitFieldsEnabled === false}
+                renderOption={renderOption}
               />
             </PartitionFieldDescription>
           </EuiFlexItem>
@@ -308,6 +319,7 @@ export const AdvancedDetectorModal: FC<Props> = ({
                 onChange={onOptionChange(setExcludeFrequentOption)}
                 isClearable={true}
                 isDisabled={splitFieldsEnabled === false || excludeFrequentEnabled === false}
+                renderOption={renderOption}
               />
             </ExcludeFrequentDescription>
           </EuiFlexItem>
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/agg_select/agg_select.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/agg_select/agg_select.tsx
index 3b829a61d461fa..7f2e1ec3ebed12 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/agg_select/agg_select.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/agg_select/agg_select.tsx
@@ -5,11 +5,12 @@
  * 2.0.
  */
 
-import React, { FC, useContext, useState, useEffect } from 'react';
+import React, { FC, useContext, useState, useEffect, useMemo } from 'react';
 import { EuiComboBox, EuiComboBoxOptionOption, EuiFormRow } from '@elastic/eui';
-
+import { FieldStatsInfoButton } from '../../../../../common/components/field_stats_info_button';
 import { JobCreatorContext } from '../../../job_creator_context';
 import { Field, Aggregation, AggFieldPair } from '../../../../../../../../../common/types/fields';
+import { useFieldStatsTrigger } from '../../../../../utils/use_field_stats_trigger';
 
 // The display label used for an aggregation e.g. sum(bytes).
 export type Label = string;
@@ -22,7 +23,7 @@ export interface DropDownLabel {
 }
 
 // Label object structure for EUI's ComboBox with support for nesting.
-export interface DropDownOption {
+export interface DropDownOption extends EuiComboBoxOptionOption {
   label: Label;
   options: DropDownLabel[];
 }
@@ -42,24 +43,42 @@ export const AggSelect: FC<Props> = ({ fields, changeHandler, selectedOptions, r
   // create list of labels based on already selected detectors
   // so they can be removed from the dropdown list
   const removeLabels = removeOptions.map(createLabel);
+  const { handleFieldStatsButtonClick } = useFieldStatsTrigger();
 
-  const options: EuiComboBoxOptionOption[] = fields.map((f) => {
-    const aggOption: DropDownOption = { label: f.name, options: [] };
-    if (typeof f.aggs !== 'undefined') {
-      aggOption.options = f.aggs
-        .filter((a) => a.dslName !== null) // don't include aggs which have no ES equivalent
-        .map(
-          (a) =>
-            ({
-              label: `${a.title}(${f.name})`,
-              agg: a,
-              field: f,
-            } as DropDownLabel)
-        )
-        .filter((o) => removeLabels.includes(o.label) === false);
-    }
-    return aggOption;
-  });
+  const options: EuiComboBoxOptionOption[] = useMemo(
+    () =>
+      fields.map((f) => {
+        const aggOption: DropDownOption = {
+          isGroupLabelOption: true,
+          key: f.name,
+          // @ts-ignore Purposefully passing label as element instead of string
+          // for more robust rendering
+          label: (
+            <FieldStatsInfoButton
+              field={f}
+              label={f.name}
+              onButtonClick={handleFieldStatsButtonClick}
+            />
+          ),
+          options: [],
+        };
+        if (typeof f.aggs !== 'undefined') {
+          aggOption.options = f.aggs
+            .filter((a) => a.dslName !== null) // don't include aggs which have no ES equivalent
+            .map(
+              (a) =>
+                ({
+                  label: `${a.title}(${f.name})`,
+                  agg: a,
+                  field: f,
+                } as DropDownLabel)
+            )
+            .filter((o) => removeLabels.includes(o.label) === false);
+        }
+        return aggOption;
+      }),
+    [handleFieldStatsButtonClick, fields, removeLabels]
+  );
 
   useEffect(() => {
     setValidation(jobValidator.duplicateDetectors);
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_field/categorization_field_select.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_field/categorization_field_select.tsx
index a340b79b4567a6..a2992d1572b61a 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_field/categorization_field_select.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_field/categorization_field_select.tsx
@@ -8,6 +8,7 @@
 import React, { FC, useCallback, useContext, useMemo } from 'react';
 import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
 
+import { useFieldStatsTrigger } from '../../../../../utils/use_field_stats_trigger';
 import { JobCreatorContext } from '../../../job_creator_context';
 import { Field } from '../../../../../../../../../common/types/fields';
 import { createFieldOptions } from '../../../../../common/job_creator/util/general';
@@ -20,10 +21,16 @@ interface Props {
 
 export const CategorizationFieldSelect: FC<Props> = ({ fields, changeHandler, selectedField }) => {
   const { jobCreator, jobCreatorUpdated } = useContext(JobCreatorContext);
+  const { renderOption, optionCss } = useFieldStatsTrigger();
+
   const options: EuiComboBoxOptionOption[] = useMemo(
-    () => [...createFieldOptions(fields, jobCreator.additionalFields)],
+    () =>
+      [...createFieldOptions(fields, jobCreator.additionalFields)].map((o) => ({
+        ...o,
+        css: optionCss,
+      })),
     // eslint-disable-next-line react-hooks/exhaustive-deps
-    [fields, jobCreatorUpdated]
+    [fields, jobCreatorUpdated, optionCss]
   );
 
   const selection: EuiComboBoxOptionOption[] = useMemo(() => {
@@ -48,6 +55,7 @@ export const CategorizationFieldSelect: FC<Props> = ({ fields, changeHandler, se
       onChange={onChange}
       isClearable={true}
       data-test-subj="mlCategorizationFieldNameSelect"
+      renderOption={renderOption}
     />
   );
 };
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_partition_field/categorization_per_partition_input.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_partition_field/categorization_per_partition_input.tsx
index b5ab58afd7159e..a63a49bc5f8930 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_partition_field/categorization_per_partition_input.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/categorization_partition_field/categorization_per_partition_input.tsx
@@ -8,6 +8,7 @@
 import React, { FC, useCallback, useContext, useMemo } from 'react';
 import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
 
+import { useFieldStatsTrigger } from '../../../../../utils/use_field_stats_trigger';
 import { JobCreatorContext } from '../../../job_creator_context';
 import { Field } from '../../../../../../../../../common/types/fields';
 import { createFieldOptions } from '../../../../../common/job_creator/util/general';
@@ -24,8 +25,14 @@ export const CategorizationPerPartitionFieldSelect: FC<Props> = ({
   selectedField,
 }) => {
   const { jobCreator, jobCreatorUpdated } = useContext(JobCreatorContext);
+  const { renderOption, optionCss } = useFieldStatsTrigger();
+
   const options: EuiComboBoxOptionOption[] = useMemo(
-    () => [...createFieldOptions(fields, jobCreator.additionalFields)],
+    () =>
+      [...createFieldOptions(fields, jobCreator.additionalFields)].map((o) => ({
+        ...o,
+        css: optionCss,
+      })),
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [fields, jobCreatorUpdated]
   );
@@ -52,6 +59,7 @@ export const CategorizationPerPartitionFieldSelect: FC<Props> = ({
       onChange={onChange}
       isClearable={true}
       data-test-subj="mlJobWizardCategorizationPerPartitionFieldNameSelect"
+      renderOption={renderOption}
     />
   );
 };
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_field/geo_field_select.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_field/geo_field_select.tsx
index 9c0ee8c0233007..f132023f45765a 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_field/geo_field_select.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_field/geo_field_select.tsx
@@ -7,6 +7,7 @@
 
 import React, { FC, useCallback, useMemo } from 'react';
 import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
+import { useFieldStatsTrigger } from '../../../../../utils/use_field_stats_trigger';
 import { Field } from '../../../../../../../../../common/types/fields';
 
 interface DropDownLabel {
@@ -21,6 +22,8 @@ interface Props {
 }
 
 export const GeoFieldSelect: FC<Props> = ({ fields, changeHandler, selectedField }) => {
+  const { renderOption, optionCss } = useFieldStatsTrigger();
+
   const options: EuiComboBoxOptionOption[] = useMemo(
     () =>
       fields.map(
@@ -28,9 +31,10 @@ export const GeoFieldSelect: FC<Props> = ({ fields, changeHandler, selectedField
           ({
             label: f.name,
             field: f,
+            css: optionCss,
           } as DropDownLabel)
       ),
-    [fields]
+    [fields, optionCss]
   );
 
   const selection: EuiComboBoxOptionOption[] = useMemo(() => {
@@ -61,6 +65,7 @@ export const GeoFieldSelect: FC<Props> = ({ fields, changeHandler, selectedField
       onChange={onChange}
       isClearable={true}
       data-test-subj="mlGeoFieldNameSelect"
+      renderOption={renderOption}
     />
   );
 };
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/influencers/influencers_select.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/influencers/influencers_select.tsx
index d235894ebf4044..52e0b5c8c4752e 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/influencers/influencers_select.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/influencers/influencers_select.tsx
@@ -8,6 +8,7 @@
 import React, { FC, useContext } from 'react';
 import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
 
+import { useFieldStatsTrigger } from '../../../../../utils/use_field_stats_trigger';
 import { JobCreatorContext } from '../../../job_creator_context';
 import { Field } from '../../../../../../../../../common/types/fields';
 import {
@@ -23,10 +24,12 @@ interface Props {
 
 export const InfluencersSelect: FC<Props> = ({ fields, changeHandler, selectedInfluencers }) => {
   const { jobCreator } = useContext(JobCreatorContext);
+  const { renderOption, optionCss } = useFieldStatsTrigger();
+
   const options: EuiComboBoxOptionOption[] = [
     ...createFieldOptions(fields, jobCreator.additionalFields),
     ...createMlcategoryFieldOption(jobCreator.categorizationFieldName),
-  ];
+  ].map((o) => ({ ...o, css: optionCss }));
 
   const selection: EuiComboBoxOptionOption[] = selectedInfluencers.map((i) => ({ label: i }));
 
@@ -41,6 +44,7 @@ export const InfluencersSelect: FC<Props> = ({ fields, changeHandler, selectedIn
       onChange={onChange}
       isClearable={false}
       data-test-subj="mlInfluencerSelect"
+      renderOption={renderOption}
     />
   );
 };
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/rare_field/rare_field_select.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/rare_field/rare_field_select.tsx
index 3868554215d897..8393fe111dc330 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/rare_field/rare_field_select.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/rare_field/rare_field_select.tsx
@@ -8,6 +8,7 @@
 import React, { FC } from 'react';
 import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
 
+import { useFieldStatsTrigger } from '../../../../../utils/use_field_stats_trigger';
 import { Field, SplitField } from '../../../../../../../../../common/types/fields';
 
 interface DropDownLabel {
@@ -30,11 +31,14 @@ export const RareFieldSelect: FC<Props> = ({
   testSubject,
   placeholder,
 }) => {
+  const { renderOption, optionCss } = useFieldStatsTrigger();
+
   const options: EuiComboBoxOptionOption[] = fields.map(
     (f) =>
       ({
         label: f.name,
         field: f,
+        css: optionCss,
       } as DropDownLabel)
   );
 
@@ -61,6 +65,7 @@ export const RareFieldSelect: FC<Props> = ({
       placeholder={placeholder}
       data-test-subj={testSubject}
       isClearable={false}
+      renderOption={renderOption}
     />
   );
 };
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/split_field_select/split_field_select.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/split_field_select/split_field_select.tsx
index 8dba85bc9ad25d..ed5a0041508b10 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/split_field_select/split_field_select.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/split_field_select/split_field_select.tsx
@@ -8,6 +8,7 @@
 import React, { FC } from 'react';
 import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
 
+import { useFieldStatsTrigger } from '../../../../../utils/use_field_stats_trigger';
 import { Field, SplitField } from '../../../../../../../../../common/types/fields';
 
 interface DropDownLabel {
@@ -32,11 +33,13 @@ export const SplitFieldSelect: FC<Props> = ({
   testSubject,
   placeholder,
 }) => {
+  const { renderOption, optionCss } = useFieldStatsTrigger();
   const options: EuiComboBoxOptionOption[] = fields.map(
     (f) =>
       ({
         label: f.name,
         field: f,
+        css: optionCss,
       } as DropDownLabel)
   );
 
@@ -63,6 +66,7 @@ export const SplitFieldSelect: FC<Props> = ({
       isClearable={isClearable}
       placeholder={placeholder}
       data-test-subj={testSubject}
+      renderOption={renderOption}
     />
   );
 };
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/summary_count_field/summary_count_field_select.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/summary_count_field/summary_count_field_select.tsx
index 7d741251908ccd..d91f4539a831fa 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/summary_count_field/summary_count_field_select.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/summary_count_field/summary_count_field_select.tsx
@@ -8,6 +8,7 @@
 import React, { FC, useContext } from 'react';
 import { EuiComboBox, EuiComboBoxOptionOption } from '@elastic/eui';
 
+import { useFieldStatsTrigger } from '../../../../../utils/use_field_stats_trigger';
 import { JobCreatorContext } from '../../../job_creator_context';
 import { Field } from '../../../../../../../../../common/types/fields';
 import {
@@ -23,10 +24,12 @@ interface Props {
 
 export const SummaryCountFieldSelect: FC<Props> = ({ fields, changeHandler, selectedField }) => {
   const { jobCreator } = useContext(JobCreatorContext);
+  const { renderOption, optionCss } = useFieldStatsTrigger();
+
   const options: EuiComboBoxOptionOption[] = [
     ...createDocCountFieldOption(jobCreator.aggregationFields.length > 0),
     ...createFieldOptions(fields, jobCreator.additionalFields),
-  ];
+  ].map((o) => ({ ...o, css: optionCss }));
 
   const selection: EuiComboBoxOptionOption[] = [];
   if (selectedField !== null) {
@@ -50,6 +53,7 @@ export const SummaryCountFieldSelect: FC<Props> = ({ fields, changeHandler, sele
       onChange={onChange}
       isClearable={true}
       data-test-subj="mlSummaryCountFieldNameSelect"
+      renderOption={renderOption}
     />
   );
 };
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/pick_fields.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/pick_fields.tsx
index 1dfdd9a854edaa..38389bd61294ee 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/pick_fields.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/pick_fields.tsx
@@ -7,6 +7,7 @@
 
 import React, { Fragment, FC, useContext, useEffect, useState } from 'react';
 
+import { useFieldStatsFlyoutContext } from '../../../../../components/field_stats_flyout';
 import { JobCreatorContext } from '../job_creator_context';
 import { WizardNav } from '../wizard_nav';
 import { WIZARD_STEPS, StepProps } from '../step_types';
@@ -32,10 +33,16 @@ export const PickFieldsStep: FC<StepProps> = ({ setCurrentStep, isCurrentStep })
   const { jobCreator, jobValidator, jobValidatorUpdated } = useContext(JobCreatorContext);
   const [nextActive, setNextActive] = useState(false);
   const [selectionValid, setSelectionValid] = useState(false);
+  const { setIsFlyoutVisible, setFieldName } = useFieldStatsFlyoutContext();
 
   useEffect(() => {
     setNextActive(selectionValid && jobValidator.isPickFieldsStepValid);
-  }, [jobValidator, jobValidatorUpdated, selectionValid]);
+
+    return () => {
+      setIsFlyoutVisible(false);
+      setFieldName(undefined);
+    };
+  }, [jobValidator, jobValidatorUpdated, selectionValid, setIsFlyoutVisible, setFieldName]);
 
   return (
     <Fragment>
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx
index 7e44a730ec0da0..ba4ea850acf84c 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx
@@ -10,7 +10,8 @@ import React, { Fragment, FC, useState } from 'react';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
 
-import { EuiSpacer, EuiTitle } from '@elastic/eui';
+import { EuiSpacer, EuiTitle, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { FieldStatsFlyoutProvider } from '../../../../components/field_stats_flyout';
 import { WIZARD_STEPS } from '../components/step_types';
 
 import { TimeRangeStep } from '../components/time_range_step';
@@ -33,7 +34,6 @@ export const WizardSteps: FC<Props> = ({ currentStep, setCurrentStep }) => {
   // has to be stored at this level to ensure it's remembered on wizard step change
   const [advancedExpanded, setAdvancedExpanded] = useState(false);
   const [additionalExpanded, setAdditionalExpanded] = useState(false);
-
   function getSummaryStepTitle() {
     if (mlContext.currentSavedSearch !== null) {
       return i18n.translate('xpack.ml.newJob.wizard.stepComponentWrapper.summaryTitleSavedSearch', {
@@ -81,16 +81,24 @@ export const WizardSteps: FC<Props> = ({ currentStep, setCurrentStep }) => {
       )}
       {currentStep === WIZARD_STEPS.PICK_FIELDS && (
         <Fragment>
-          <Title data-test-subj="mlJobWizardStepTitlePickFields">
-            <FormattedMessage
-              id="xpack.ml.newJob.wizard.stepComponentWrapper.pickFieldsTitle"
-              defaultMessage="Choose fields"
-            />
-          </Title>
-          <PickFieldsStep
-            isCurrentStep={currentStep === WIZARD_STEPS.PICK_FIELDS}
-            setCurrentStep={setCurrentStep}
-          />
+          <FieldStatsFlyoutProvider>
+            <>
+              <EuiFlexGroup gutterSize="s">
+                <EuiFlexItem grow={false}>
+                  <Title data-test-subj="mlJobWizardStepTitlePickFields">
+                    <FormattedMessage
+                      id="xpack.ml.newJob.wizard.stepComponentWrapper.pickFieldsTitle"
+                      defaultMessage="Choose fields"
+                    />
+                  </Title>
+                </EuiFlexItem>
+              </EuiFlexGroup>
+              <PickFieldsStep
+                isCurrentStep={currentStep === WIZARD_STEPS.PICK_FIELDS}
+                setCurrentStep={setCurrentStep}
+              />
+            </>
+          </FieldStatsFlyoutProvider>
         </Fragment>
       )}
       {currentStep === WIZARD_STEPS.JOB_DETAILS && (
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/utils/use_field_stats_trigger.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/utils/use_field_stats_trigger.tsx
new file mode 100644
index 00000000000000..8de51e3c95a409
--- /dev/null
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/utils/use_field_stats_trigger.tsx
@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { ReactNode, useCallback } from 'react';
+import { EuiComboBoxOptionOption } from '@elastic/eui';
+import { useFieldStatsFlyoutContext } from '../../../components/field_stats_flyout';
+import { FieldStatsInfoButton } from '../common/components/field_stats_info_button';
+import { Field } from '../../../../../common/types/fields';
+
+interface Option extends EuiComboBoxOptionOption<string> {
+  field: Field;
+}
+const optionCss = `
+          .euiComboBoxOption__enterBadge {
+            display: none;
+          }
+          .euiFlexGroup {
+            gap: 0px;
+          }
+          .euiComboBoxOption__content{
+            margin-left: 2px;
+          }
+        `;
+
+export const useFieldStatsTrigger = () => {
+  const { setIsFlyoutVisible, setFieldName } = useFieldStatsFlyoutContext();
+  const handleFieldStatsButtonClick = useCallback(
+    (field: Field) => {
+      if (typeof field.id === 'string') {
+        setFieldName(field.id);
+        setIsFlyoutVisible(true);
+      }
+    },
+    [setFieldName, setIsFlyoutVisible]
+  );
+
+  const renderOption = useCallback(
+    (option: EuiComboBoxOptionOption, searchValue: string): ReactNode => {
+      const field = (option as Option).field;
+      return option.isGroupLabelOption || !field ? (
+        option.label
+      ) : (
+        <FieldStatsInfoButton
+          field={field}
+          label={option.label}
+          onButtonClick={handleFieldStatsButtonClick}
+        />
+      );
+    },
+    [handleFieldStatsButtonClick]
+  );
+  return { renderOption, setIsFlyoutVisible, setFieldName, handleFieldStatsButtonClick, optionCss };
+};
diff --git a/x-pack/plugins/ml/tsconfig.json b/x-pack/plugins/ml/tsconfig.json
index a0e09dc2cb697e..d613793099257a 100644
--- a/x-pack/plugins/ml/tsconfig.json
+++ b/x-pack/plugins/ml/tsconfig.json
@@ -77,5 +77,7 @@
     "@kbn/ml-query-utils",
     "@kbn/shared-ux-page-kibana-template",
     "@kbn/shared-ux-link-redirect-app",
+    "@kbn/react-field",
+    "@kbn/unified-field-list-plugin",
   ],
 }
diff --git a/x-pack/test/functional/apps/lens/group1/fields_list.ts b/x-pack/test/functional/apps/lens/group1/fields_list.ts
index f5a04788ea8315..e314809e5ee254 100644
--- a/x-pack/test/functional/apps/lens/group1/fields_list.ts
+++ b/x-pack/test/functional/apps/lens/group1/fields_list.ts
@@ -113,12 +113,14 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           await testSubjects.missingOrFail('lnsFieldListPanel-buttonGroup-topValuesButton');
         });
 
-        it('should show a placeholder message about geo points field', async () => {
+        it('should show examples for geo points field', async () => {
           const [fieldId] = await PageObjects.lens.findFieldIdsByType('geo_point');
           await log.debug(`Opening field stats for ${fieldId}`);
           await testSubjects.click(fieldId);
-          const message = await testSubjects.getVisibleText('lnsFieldListPanel-missingFieldStats');
-          expect(message).to.eql('Analysis is not available for this field.');
+          // check for top values chart
+          await testSubjects.existOrFail('lnsFieldListPanel-topValues');
+          const topValuesRows = await testSubjects.findAll('lnsFieldListPanel-topValues-bucket');
+          expect(topValuesRows.length).to.eql(11);
         });
 
         it('should show stats for a numeric runtime field', async () => {

From cca7196d9f3aa61e3146876223bf96dc1f9c06fa Mon Sep 17 00:00:00 2001
From: Melissa Alvarez <melissa.alvarez@elastic.co>
Date: Mon, 23 Jan 2023 12:32:38 -0700
Subject: [PATCH 18/54] [ML] Geo job from dashboard map visualization:
 correctly include all filters/queries in job config (#148989)

## Summary

Related issue: https://github.com/elastic/kibana/issues/147567

This PR
- adds job creation compatibility check for map visualizations in
dashboard
- ensures filters/queries (dashboard, visualization, layer-level for
maps) are correctly added to datafeed
- fixes the way queries were merged


### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: James Gowdy <jgowdy@elastic.co>
---
 src/plugins/dashboard/public/index.ts         |  1 +
 .../quick_create_job_base.ts                  | 39 ++++++++++++++-----
 .../jobs/new_job/job_from_map/index.ts        |  6 ++-
 .../new_job/job_from_map/quick_create_job.ts  | 16 +++++++-
 .../new_job/job_from_map/route_resolver.ts    | 15 ++++++-
 .../jobs/new_job/job_from_map/utils.ts        | 13 +++++++
 .../job_from_map/visualization_extractor.ts   |  5 ++-
 .../routing/routes/new_job/from_map.tsx       | 19 ++++++---
 .../layer/compatible_layer.tsx                |  2 +
 .../ui_actions/open_vis_in_ml_action.tsx      |  5 +++
 10 files changed, 100 insertions(+), 21 deletions(-)

diff --git a/src/plugins/dashboard/public/index.ts b/src/plugins/dashboard/public/index.ts
index 83616f0ffceb04..31c0f8476c9693 100644
--- a/src/plugins/dashboard/public/index.ts
+++ b/src/plugins/dashboard/public/index.ts
@@ -15,6 +15,7 @@ export {
   LEGACY_DASHBOARD_APP_ID,
 } from './dashboard_constants';
 export { DASHBOARD_CONTAINER_TYPE } from './dashboard_container';
+export type { DashboardContainer } from './dashboard_container/embeddable/dashboard_container';
 export type { DashboardSetup, DashboardStart, DashboardFeatureFlagConfig } from './plugin';
 
 export {
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_dashboard/quick_create_job_base.ts b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_dashboard/quick_create_job_base.ts
index 51cfeb57a2f42d..a22b6d9fd57a55 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_dashboard/quick_create_job_base.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_dashboard/quick_create_job_base.ts
@@ -6,7 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { mergeWith, uniqBy, isEqual } from 'lodash';
+import { mergeWith, uniqWith, isEqual } from 'lodash';
 import type { IUiSettingsClient } from '@kbn/core/public';
 import type { TimefilterContract } from '@kbn/data-plugin/public';
 import type { SharePluginStart } from '@kbn/share-plugin/public';
@@ -47,6 +47,16 @@ export interface CreateState {
   datafeedStarted: CreationState;
 }
 
+function mergeQueriesCheck(
+  objValue: estypes.QueryDslQueryContainer,
+  srcValue: estypes.QueryDslQueryContainer
+) {
+  if (Array.isArray(objValue)) {
+    const combinedQuery = objValue.concat(srcValue);
+    return uniqWith(combinedQuery, isEqual);
+  }
+}
+
 export class QuickJobCreatorBase {
   constructor(
     protected readonly kibanaConfig: IUiSettingsClient,
@@ -176,8 +186,11 @@ export class QuickJobCreatorBase {
   protected combineQueriesAndFilters(
     dashboard: { query: Query; filters: Filter[] },
     vis: { query: Query; filters: Filter[] },
-    dataView: DataViewBase
+    dataView: DataViewBase,
+    layerQuery?: { query: Query; filters: Filter[] }
   ): estypes.QueryDslQueryContainer {
+    let mergedVisAndLayerQueries;
+
     const { combinedQuery: dashboardQueries } = createQueries(
       {
         query: dashboard.query,
@@ -196,15 +209,23 @@ export class QuickJobCreatorBase {
       this.kibanaConfig
     );
 
+    if (layerQuery) {
+      const { combinedQuery: layerQueries } = createQueries(
+        {
+          query: layerQuery.query,
+          filter: layerQuery.filters,
+        },
+        dataView,
+        this.kibanaConfig
+      );
+      // combine vis and layer queries if layer-level query exists
+      mergedVisAndLayerQueries = mergeWith(visQueries, layerQueries, mergeQueriesCheck);
+    }
+
     const mergedQueries = mergeWith(
       dashboardQueries,
-      visQueries,
-      (objValue: estypes.QueryDslQueryContainer, srcValue: estypes.QueryDslQueryContainer) => {
-        if (Array.isArray(objValue)) {
-          const combinedQuery = objValue.concat(srcValue);
-          return uniqBy(combinedQuery, isEqual);
-        }
-      }
+      mergedVisAndLayerQueries ? mergedVisAndLayerQueries : visQueries,
+      mergeQueriesCheck
     );
 
     return mergedQueries;
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/index.ts b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/index.ts
index 6e10a2f4e1ce50..707b4cd4163322 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/index.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/index.ts
@@ -7,5 +7,9 @@
 
 export { resolver } from './route_resolver';
 export { QuickGeoJobCreator } from './quick_create_job';
-export { getJobsItemsFromEmbeddable, redirectToGeoJobWizard } from './utils';
+export {
+  getJobsItemsFromEmbeddable,
+  isCompatibleMapVisualization,
+  redirectToGeoJobWizard,
+} from './utils';
 export { type LayerResult, VisualizationExtractor } from './visualization_extractor';
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/quick_create_job.ts b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/quick_create_job.ts
index 5530ba2dbfdb4d..62c45143855de6 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/quick_create_job.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/quick_create_job.ts
@@ -35,6 +35,7 @@ interface VisDescriptor {
   geoField: string;
   splitField: string | null;
   bucketSpan?: string;
+  layerLevelQuery?: Query | null;
 }
 
 export class QuickGeoJobCreator extends QuickJobCreatorBase {
@@ -57,6 +58,7 @@ export class QuickGeoJobCreator extends QuickJobCreatorBase {
     sourceDataView,
     geoField,
     splitField,
+    layerLevelQuery,
   }: {
     jobId: string;
     bucketSpan: string;
@@ -67,6 +69,7 @@ export class QuickGeoJobCreator extends QuickJobCreatorBase {
     sourceDataView?: DataView;
     geoField: string;
     splitField: string | null;
+    layerLevelQuery: Query | null;
   }): Promise<CreateState> {
     const {
       query: dashboardQuery,
@@ -92,6 +95,7 @@ export class QuickGeoJobCreator extends QuickJobCreatorBase {
       filters: dashboardFilters,
       embeddableQuery,
       embeddableFilters,
+      layerLevelQuery,
       geoField,
       splitField,
       bucketSpan,
@@ -120,7 +124,8 @@ export class QuickGeoJobCreator extends QuickJobCreatorBase {
     embeddableQuery: Query,
     embeddableFilters: Filter[],
     geoField: string,
-    splitField: string | null = null
+    splitField: string | null = null,
+    layerLevelQuery?: Query
   ) {
     try {
       const { jobConfig, datafeedConfig, start, end, includeTimeRange } = await this.createGeoJob({
@@ -133,6 +138,7 @@ export class QuickGeoJobCreator extends QuickJobCreatorBase {
         embeddableFilters,
         geoField,
         splitField,
+        layerLevelQuery,
       });
 
       // add job config and start and end dates to the
@@ -165,6 +171,7 @@ export class QuickGeoJobCreator extends QuickJobCreatorBase {
     filters,
     embeddableQuery,
     embeddableFilters,
+    layerLevelQuery,
     geoField,
     splitField,
     bucketSpan,
@@ -177,6 +184,7 @@ export class QuickGeoJobCreator extends QuickJobCreatorBase {
     filters: Filter[];
     embeddableQuery: Query;
     embeddableFilters: Filter[];
+    layerLevelQuery?: Query | null;
     geoField: string;
     splitField: string | null;
     bucketSpan?: string;
@@ -186,6 +194,7 @@ export class QuickGeoJobCreator extends QuickJobCreatorBase {
       dataViewId,
       dashboard: { query, filters },
       embeddable: { query: embeddableQuery, filters: embeddableFilters },
+      layerLevelQuery,
       geoField,
       splitField,
       ...(bucketSpan ? { bucketSpan } : {}),
@@ -234,6 +243,7 @@ export class QuickGeoJobCreator extends QuickJobCreatorBase {
     dataViewId,
     dashboard,
     embeddable,
+    layerLevelQuery,
     bucketSpan,
     geoField,
     splitField,
@@ -244,10 +254,12 @@ export class QuickGeoJobCreator extends QuickJobCreatorBase {
 
     const jobConfig = createEmptyJob();
     const datafeedConfig = createEmptyDatafeed(dataView.getIndexPattern());
+
     const combinedFiltersAndQueries = this.combineQueriesAndFilters(
       dashboard,
       embeddable,
-      dataView!
+      dataView!,
+      layerLevelQuery ? { query: layerLevelQuery, filters: [] } : undefined
     );
 
     datafeedConfig.query = combinedFiltersAndQueries;
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/route_resolver.ts b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/route_resolver.ts
index 12f57d28d0cd58..a263ac9fe44f7b 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/route_resolver.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/route_resolver.ts
@@ -21,10 +21,12 @@ export async function resolver(
   geoField: string,
   splitField: string,
   fromRisonString: string,
-  toRisonString: string
+  toRisonString: string,
+  layer?: string
 ) {
   let decodedDashboard;
   let decodedEmbeddable;
+  let decodedLayer;
   let splitFieldDecoded;
   let dvId;
 
@@ -46,6 +48,14 @@ export async function resolver(
     decodedEmbeddable = { query: getDefaultQuery(), filters: [] };
   }
 
+  if (layer) {
+    try {
+      decodedLayer = rison.decode(layer) as { query: Query };
+    } catch (error) {
+      decodedLayer = { query: getDefaultQuery(), filters: [] };
+    }
+  }
+
   try {
     splitFieldDecoded = rison.decode(splitField) as string;
   } catch (error) {
@@ -76,6 +86,7 @@ export async function resolver(
     decodedEmbeddable.query,
     decodedEmbeddable.filters,
     geoField,
-    splitFieldDecoded
+    splitFieldDecoded,
+    decodedLayer?.query
   );
 }
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/utils.ts b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/utils.ts
index a7f8b9790c4d2b..5a3985aa0dc362 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/utils.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/utils.ts
@@ -6,6 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import type { Query } from '@kbn/es-query';
 import type { MapEmbeddable } from '@kbn/maps-plugin/public';
 import type { SharePluginStart } from '@kbn/share-plugin/public';
 import { ML_PAGES, ML_APP_LOCATOR } from '../../../../../common/constants/locator';
@@ -14,6 +15,7 @@ export async function redirectToGeoJobWizard(
   embeddable: MapEmbeddable,
   dataViewId: string,
   geoField: string,
+  layerQuery: Query | null,
   splitField: string | null,
   share: SharePluginStart
 ) {
@@ -30,6 +32,7 @@ export async function redirectToGeoJobWizard(
     splitField,
     from,
     to,
+    ...(layerQuery ? { layer: { query: layerQuery } } : {}),
   };
 
   const url = await locator?.getUrl({
@@ -40,6 +43,16 @@ export async function redirectToGeoJobWizard(
   window.open(url, '_blank');
 }
 
+export function isCompatibleMapVisualization(embeddable: MapEmbeddable) {
+  return embeddable.getLayerList().some((layer) => {
+    const geoField = layer.getGeoFieldNames().length ? layer.getGeoFieldNames()[0] : undefined;
+    const dataViewId = layer.getIndexPatternIds().length
+      ? layer.getIndexPatternIds()[0]
+      : undefined;
+    return geoField && dataViewId;
+  });
+}
+
 export async function getJobsItemsFromEmbeddable(embeddable: MapEmbeddable) {
   // Get dashboard level query/filters
   const { filters, timeRange, ...input } = embeddable.getInput();
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/visualization_extractor.ts b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/visualization_extractor.ts
index bdae2c9facbccc..da2b8e29c0010c 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/visualization_extractor.ts
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/job_from_map/visualization_extractor.ts
@@ -10,6 +10,7 @@ import type { MapEmbeddable } from '@kbn/maps-plugin/public';
 import type { EuiComboBoxOptionOption } from '@elastic/eui';
 import type { DataView } from '@kbn/data-views-plugin/common';
 import type { Query } from '@kbn/es-query';
+import type { DashboardContainer } from '@kbn/dashboard-plugin/public';
 import { categoryFieldTypes } from '../../../../../common/util/fields_utils';
 
 export interface LayerResult {
@@ -27,8 +28,8 @@ export class VisualizationExtractor {
 
   public async getResultLayersFromEmbeddable(embeddable: MapEmbeddable): Promise<LayerResult[]> {
     const layers: LayerResult[] = [];
-    // @ts-ignore
-    const dataViews: DataView[] = embeddable.getRoot()?.getAllDataViews() ?? [];
+    const dataViews: DataView[] =
+      (embeddable.getRoot() as DashboardContainer)?.getAllDataViews() ?? [];
 
     // Keep track of geoFields for layers as they can be repeated
     const layerGeoFields: Record<string, boolean> = {};
diff --git a/x-pack/plugins/ml/public/application/routing/routes/new_job/from_map.tsx b/x-pack/plugins/ml/public/application/routing/routes/new_job/from_map.tsx
index b21d1e950066e2..e9c68f010bbf0f 100644
--- a/x-pack/plugins/ml/public/application/routing/routes/new_job/from_map.tsx
+++ b/x-pack/plugins/ml/public/application/routing/routes/new_job/from_map.tsx
@@ -22,13 +22,22 @@ export const fromMapRouteFactory = (): MlRoute => ({
 });
 
 const PageWrapper: FC<PageProps> = ({ location, deps }) => {
-  const { dashboard, dataViewId, embeddable, geoField, splitField, from, to }: Record<string, any> =
-    parse(location.search, {
-      sort: false,
-    });
+  const {
+    dashboard,
+    dataViewId,
+    embeddable,
+    geoField,
+    splitField,
+    from,
+    to,
+    layer,
+  }: Record<string, any> = parse(location.search, {
+    sort: false,
+  });
 
   const { context } = useResolver(undefined, undefined, deps.config, deps.dataViewsContract, {
-    redirect: () => resolver(dashboard, dataViewId, embeddable, geoField, splitField, from, to),
+    redirect: () =>
+      resolver(dashboard, dataViewId, embeddable, geoField, splitField, from, to, layer),
   });
   return <PageLoader context={context}>{<Redirect to="/jobs/new_job" />}</PageLoader>;
 };
diff --git a/x-pack/plugins/ml/public/embeddables/job_creation/map/map_vis_layer_selection_flyout/layer/compatible_layer.tsx b/x-pack/plugins/ml/public/embeddables/job_creation/map/map_vis_layer_selection_flyout/layer/compatible_layer.tsx
index af462b26480b04..a2d3d09d635b2b 100644
--- a/x-pack/plugins/ml/public/embeddables/job_creation/map/map_vis_layer_selection_flyout/layer/compatible_layer.tsx
+++ b/x-pack/plugins/ml/public/embeddables/job_creation/map/map_vis_layer_selection_flyout/layer/compatible_layer.tsx
@@ -64,6 +64,7 @@ export const CompatibleLayer: FC<Props> = ({ embeddable, layer, layerIndex }) =>
       embeddable,
       layer.dataView!.id!,
       layer.geoField,
+      layer.query,
       selectedSplitField,
       share
     );
@@ -87,6 +88,7 @@ export const CompatibleLayer: FC<Props> = ({ embeddable, layer, layerIndex }) =>
           runInRealTime,
           sourceDataView: layer.dataView,
           geoField: layer.geoField,
+          layerLevelQuery: layer.query,
           splitField: selectedSplitField,
         });
 
diff --git a/x-pack/plugins/ml/public/ui_actions/open_vis_in_ml_action.tsx b/x-pack/plugins/ml/public/ui_actions/open_vis_in_ml_action.tsx
index b34001025044df..5dbdd7e7acac45 100644
--- a/x-pack/plugins/ml/public/ui_actions/open_vis_in_ml_action.tsx
+++ b/x-pack/plugins/ml/public/ui_actions/open_vis_in_ml_action.tsx
@@ -64,6 +64,9 @@ export function createVisToADJobAction(
           import('../application/jobs/new_job/job_from_lens'),
           getStartServices(),
         ]);
+      const { isCompatibleMapVisualization } = await import(
+        '../application/jobs/new_job/job_from_map'
+      );
 
       if (
         !coreStart.application.capabilities.ml?.canCreateJob ||
@@ -76,6 +79,8 @@ export function createVisToADJobAction(
         if (embeddableType === 'lens' && lens) {
           const { chartInfo } = await getJobsItemsFromEmbeddable(context.embeddable, lens);
           return isCompatibleVisualizationType(chartInfo!);
+        } else if (isMapEmbeddable(context.embeddable)) {
+          return isCompatibleMapVisualization(context.embeddable);
         }
         return true;
       } catch (error) {

From e8ceb4ed49bea6ea7f94454ff81a36647985c1cb Mon Sep 17 00:00:00 2001
From: Jon <jon@elastic.co>
Date: Mon, 23 Jan 2023 14:16:56 -0600
Subject: [PATCH 19/54] [ci/on-merge] Trigger container image build (#149350)

Reopens #148864 to trigger via REST instead of yaml. The previous
implementation did not support commit triggered builds.

This conditionally adds a pipeline trigger to
`kibana-artifacts-container-image` at the end of the on-merge pipeline
when tests are passing. The triggered pipeline will build (and
eventually push) our default docker images.
---
 .buildkite/pipelines/on_merge.yml                         | 8 ++++++++
 .../scripts/steps/artifacts/docker_image_trigger.sh       | 5 +++++
 2 files changed, 13 insertions(+)
 create mode 100755 .buildkite/scripts/steps/artifacts/docker_image_trigger.sh

diff --git a/.buildkite/pipelines/on_merge.yml b/.buildkite/pipelines/on_merge.yml
index ffca48499b1598..98524f37c8bfe5 100644
--- a/.buildkite/pipelines/on_merge.yml
+++ b/.buildkite/pipelines/on_merge.yml
@@ -149,3 +149,11 @@ steps:
     timeout_in_minutes: 10
     agents:
       queue: kibana-default
+
+  - wait
+
+  - command: '.buildkite/scripts/steps/artifacts/docker_image_trigger.sh'
+    label: Trigger container image build
+    timeout_in_minutes: 10
+    agents:
+      queue: 'kibana-default'
diff --git a/.buildkite/scripts/steps/artifacts/docker_image_trigger.sh b/.buildkite/scripts/steps/artifacts/docker_image_trigger.sh
new file mode 100755
index 00000000000000..f76eee8986c405
--- /dev/null
+++ b/.buildkite/scripts/steps/artifacts/docker_image_trigger.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+set -euo pipefail
+
+ts-node .buildkite/scripts/steps/trigger_pipeline.ts kibana-artifacts-container-image "$BUILDKITE_BRANCH" "$BUILDKITE_COMMIT"

From 2a18937ef7273337d175ba8d5fd290b5341ba153 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 23 Jan 2023 21:26:53 +0100
Subject: [PATCH 20/54] Update dependency @xstate/react to ^3.0.2 (main)
 (#149352)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index a494bb32a83528..b9a9b3b1e338c2 100644
--- a/package.json
+++ b/package.json
@@ -485,7 +485,7 @@
     "@turf/distance": "6.0.1",
     "@turf/helpers": "6.0.1",
     "@turf/length": "^6.0.2",
-    "@xstate/react": "^3.0.1",
+    "@xstate/react": "^3.0.2",
     "JSONStream": "1.3.5",
     "abort-controller": "^3.0.0",
     "adm-zip": "^0.5.9",
diff --git a/yarn.lock b/yarn.lock
index 544b8a19e336f0..eb2f9402c68e32 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8585,10 +8585,10 @@
   resolved "https://registry.yarnpkg.com/@xobotyi/scrollbar-width/-/scrollbar-width-1.9.5.tgz#80224a6919272f405b87913ca13b92929bdf3c4d"
   integrity sha512-N8tkAACJx2ww8vFMneJmaAgmjAG1tnVBZJRLRcx061tmsLRZHSEZSLuGWnwPtunsSLvSqXQ2wfp7Mgqg1I+2dQ==
 
-"@xstate/react@^3.0.1":
-  version "3.0.1"
-  resolved "https://registry.yarnpkg.com/@xstate/react/-/react-3.0.1.tgz#937eeb5d5d61734ab756ca40146f84a6fe977095"
-  integrity sha512-/tq/gg92P9ke8J+yDNDBv5/PAxBvXJf2cYyGDByzgtl5wKaxKxzDT82Gj3eWlCJXkrBg4J5/V47//gRJuVH2fA==
+"@xstate/react@^3.0.2":
+  version "3.0.2"
+  resolved "https://registry.yarnpkg.com/@xstate/react/-/react-3.0.2.tgz#7907f1e2df464c14b1cac2120a25070a0c81e111"
+  integrity sha512-sFbnMyi+FHF6bXbdvOF6RKVJ9VxrhhUz7KJ/8qKwpqFs0h+EoGOXdfAeuS3aEy29JsFaRclozBxDpsEJd/vlkg==
   dependencies:
     use-isomorphic-layout-effect "^1.0.0"
     use-sync-external-store "^1.0.0"

From 2ed0123c4a470871af66aa7c858b01db39d9e05a Mon Sep 17 00:00:00 2001
From: Andrew Tate <andrew.tate@elastic.co>
Date: Mon, 23 Jan 2023 15:06:31 -0600
Subject: [PATCH 21/54] [Lens] introduce unified user messages system (#147818)

---
 .../public/visualization.tsx                  |    5 -
 ...et_application_user_messages.test.tsx.snap |  104 ++
 .../lens/public/app_plugin/app.test.tsx       |    4 +
 x-pack/plugins/lens/public/app_plugin/app.tsx |  110 +-
 .../get_application_user_messages.test.tsx    |  368 ++++++
 .../get_application_user_messages.tsx         |  219 ++++
 .../lens/public/app_plugin/lens_top_nav.tsx   |   19 +-
 .../lens/public/app_plugin/mounter.tsx        |    1 +
 .../plugins/lens/public/app_plugin/types.ts   |    4 +
 .../dimension_panel/dimension_panel.tsx       |   42 +-
 .../datasources/form_based/form_based.test.ts |  489 ++++----
 .../datasources/form_based/form_based.tsx     |  294 +++--
 .../public/datasources/form_based/utils.tsx   |  127 +-
 .../text_based/text_based_languages.test.ts   |   47 +-
 .../text_based/text_based_languages.tsx       |   19 +-
 .../config_panel/buttons/dimension_button.tsx |    2 +-
 .../config_panel/config_panel.test.tsx        |    1 +
 .../config_panel/layer_panel.test.tsx         |    3 +
 .../editor_frame/config_panel/layer_panel.tsx |   27 +-
 .../editor_frame/config_panel/types.ts        |    2 +
 .../editor_frame/editor_frame.test.tsx        |    2 +
 .../editor_frame/editor_frame.tsx             |   29 +-
 .../editor_frame/state_helpers.ts             |  107 +-
 .../editor_frame/suggestion_panel.test.tsx    |    1 +
 .../editor_frame/suggestion_panel.tsx         |   78 +-
 .../workspace_panel.test.tsx.snap             |   33 +
 .../workspace_panel/workspace_panel.test.tsx  |  322 ++---
 .../workspace_panel/workspace_panel.tsx       |  404 ++-----
 .../workspace_panel_wrapper.test.tsx          |    3 +
 .../workspace_panel_wrapper.tsx               |   46 +-
 .../editor_frame_service/error_helper.ts      |   35 +-
 .../public/editor_frame_service/service.tsx   |   10 +-
 .../lens/public/editor_frame_service/types.ts |    6 -
 .../public/embeddable/embeddable.test.tsx     |  107 +-
 .../lens/public/embeddable/embeddable.tsx     |  472 +++++---
 .../public/embeddable/embeddable_factory.ts   |   15 +-
 .../public/embeddable/expression_wrapper.tsx  |   12 +-
 .../lens/public/mocks/datasource_mock.ts      |    2 +-
 .../lens/public/mocks/visualization_mock.ts   |    1 -
 x-pack/plugins/lens/public/plugin.ts          |    1 +
 .../dimension_trigger/index.tsx               |    2 +-
 .../public/state_management/lens_slice.ts     |   11 +-
 .../lens/public/state_management/selectors.ts |    5 +
 x-pack/plugins/lens/public/types.ts           |  106 +-
 x-pack/plugins/lens/public/utils.ts           |    6 +-
 .../lens/public/visualization_container.scss  |    4 -
 .../datatable/visualization.test.tsx          |   54 -
 .../datatable/visualization.tsx               |    4 -
 .../gauge/visualization.test.ts               |  168 +--
 .../visualizations/gauge/visualization.tsx    |  141 ++-
 .../heatmap/visualization.test.ts             |  183 +--
 .../visualizations/heatmap/visualization.tsx  |   65 +-
 .../legacy_metric/visualization.test.ts       |    8 -
 .../legacy_metric/visualization.tsx           |    5 -
 .../visualizations/metric/visualization.tsx   |    5 -
 .../partition/visualization.test.ts           |   18 +-
 .../partition/visualization.tsx               |  137 ++-
 .../visualizations/xy/annotations/helpers.tsx |    8 +-
 .../public/visualizations/xy/state_helpers.ts |   42 +-
 .../visualizations/xy/visualization.test.ts   | 1055 +++++++++--------
 .../visualizations/xy/visualization.tsx       |  263 ++--
 .../lens/choropleth_chart/visualization.tsx   |    4 -
 .../apps/lens/group1/smokescreen.ts           |    6 +-
 .../functional/apps/lens/group3/formula.ts    |    4 +-
 .../test/functional/page_objects/lens_page.ts |   13 +-
 65 files changed, 3338 insertions(+), 2552 deletions(-)
 create mode 100644 x-pack/plugins/lens/public/app_plugin/__snapshots__/get_application_user_messages.test.tsx.snap
 create mode 100644 x-pack/plugins/lens/public/app_plugin/get_application_user_messages.test.tsx
 create mode 100644 x-pack/plugins/lens/public/app_plugin/get_application_user_messages.tsx
 create mode 100644 x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/__snapshots__/workspace_panel.test.tsx.snap

diff --git a/x-pack/examples/third_party_vis_lens_example/public/visualization.tsx b/x-pack/examples/third_party_vis_lens_example/public/visualization.tsx
index d91583cfdc7c23..e5185be2241441 100644
--- a/x-pack/examples/third_party_vis_lens_example/public/visualization.tsx
+++ b/x-pack/examples/third_party_vis_lens_example/public/visualization.tsx
@@ -181,9 +181,4 @@ export const getRotatingNumberVisualization = ({
       domElement
     );
   },
-
-  getErrorMessages(state) {
-    // Is it possible to break it?
-    return undefined;
-  },
 });
diff --git a/x-pack/plugins/lens/public/app_plugin/__snapshots__/get_application_user_messages.test.tsx.snap b/x-pack/plugins/lens/public/app_plugin/__snapshots__/get_application_user_messages.test.tsx.snap
new file mode 100644
index 00000000000000..0219edefe4b236
--- /dev/null
+++ b/x-pack/plugins/lens/public/app_plugin/__snapshots__/get_application_user_messages.test.tsx.snap
@@ -0,0 +1,104 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`application-level user messages missing index pattern errors generates error if missing an index pattern 1`] = `
+Array [
+  Object {
+    "displayLocations": Array [
+      Object {
+        "id": "visualizationInEditor",
+      },
+    ],
+    "fixableInEditor": true,
+    "longMessage": <React.Fragment>
+      <p
+        className="eui-textBreakWord"
+        data-test-subj="missing-refs-failure"
+      >
+        <FormattedMessage
+          defaultMessage="Data view not found"
+          id="xpack.lens.editorFrame.dataViewNotFound"
+          values={Object {}}
+        />
+      </p>
+      <p
+        className="eui-textBreakWord"
+        style={
+          Object {
+            "userSelect": "text",
+          }
+        }
+      >
+        <FormattedMessage
+          defaultMessage="The {count, plural, one {data view} other {data views}} ({count, plural, one {id} other {ids}}: {indexpatterns}) cannot be found."
+          id="xpack.lens.indexPattern.missingDataView"
+          values={
+            Object {
+              "count": 1,
+              "indexpatterns": "missing_pattern",
+            }
+          }
+        />
+        <RedirectAppLinks
+          coreStart={
+            Object {
+              "application": Object {
+                "capabilities": Object {
+                  "management": Object {
+                    "kibana": Object {
+                      "indexPatterns": true,
+                    },
+                  },
+                  "navLinks": Object {
+                    "management": true,
+                  },
+                },
+                "getUrlForApp": [MockFunction] {
+                  "calls": Array [
+                    Array [
+                      "management",
+                      Object {
+                        "path": "/kibana/indexPatterns/create",
+                      },
+                    ],
+                  ],
+                  "results": Array [
+                    Object {
+                      "type": "return",
+                      "value": "fake/url",
+                    },
+                  ],
+                },
+              },
+            }
+          }
+        >
+          <a
+            data-test-subj="configuration-failure-reconfigure-indexpatterns"
+            href="fake/url"
+            style={
+              Object {
+                "display": "block",
+              }
+            }
+          >
+            Recreate it in the data view management page.
+          </a>
+        </RedirectAppLinks>
+      </p>
+    </React.Fragment>,
+    "severity": "error",
+    "shortMessage": "",
+  },
+  Object {
+    "displayLocations": Array [
+      Object {
+        "id": "visualizationOnEmbeddable",
+      },
+    ],
+    "fixableInEditor": true,
+    "longMessage": "Could not find the data view: missing_pattern",
+    "severity": "error",
+    "shortMessage": "",
+  },
+]
+`;
diff --git a/x-pack/plugins/lens/public/app_plugin/app.test.tsx b/x-pack/plugins/lens/public/app_plugin/app.test.tsx
index fbb82b11c0012b..aa815e833a6d80 100644
--- a/x-pack/plugins/lens/public/app_plugin/app.test.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/app.test.tsx
@@ -36,6 +36,7 @@ import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public';
 import moment from 'moment';
 
 import { setState, LensAppState } from '../state_management';
+import { coreMock } from '@kbn/core/public/mocks';
 jest.mock('../editor_frame_service/editor_frame/expression_helpers');
 jest.mock('@kbn/core/public');
 jest.mock('../persistence/saved_objects_utils/check_for_duplicate_title', () => ({
@@ -85,6 +86,7 @@ describe('Lens App', () => {
       visualizationMap,
       topNavMenuEntryGenerators: [],
       theme$: new Observable(),
+      coreStart: coreMock.createStart(),
     };
   }
 
@@ -144,6 +146,8 @@ describe('Lens App', () => {
     expect(frame.EditorFrameContainer).toHaveBeenLastCalledWith(
       {
         indexPatternService: expect.any(Object),
+        getUserMessages: expect.any(Function),
+        addUserMessages: expect.any(Function),
         lensInspector: {
           adapters: {
             expression: expect.any(Object),
diff --git a/x-pack/plugins/lens/public/app_plugin/app.tsx b/x-pack/plugins/lens/public/app_plugin/app.tsx
index 6c70000ed4e0c1..329ce5e38827bb 100644
--- a/x-pack/plugins/lens/public/app_plugin/app.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/app.tsx
@@ -16,7 +16,7 @@ import type { LensAppLocatorParams } from '../../common/locator/locator';
 import { LensAppProps, LensAppServices } from './types';
 import { LensTopNavMenu } from './lens_top_nav';
 import { LensByReferenceInput } from '../embeddable';
-import { EditorFrameInstance } from '../types';
+import { AddUserMessages, EditorFrameInstance, UserMessage, UserMessagesGetter } from '../types';
 import { Document } from '../persistence/saved_object_store';
 
 import {
@@ -28,6 +28,9 @@ import {
   DispatchSetState,
   selectSavedObjectFormat,
   updateIndexPatterns,
+  updateDatasourceState,
+  selectActiveDatasourceId,
+  selectFrameDatasourceAPI,
 } from '../state_management';
 import { SaveModalContainer, runSaveLensVisualization } from './save_modal_container';
 import { LensInspector } from '../lens_inspector_service';
@@ -38,6 +41,7 @@ import {
   createIndexPatternService,
 } from '../data_views_service/service';
 import { replaceIndexpattern } from '../state_management/lens_slice';
+import { filterUserMessages, getApplicationUserMessages } from './get_application_user_messages';
 
 export type SaveProps = Omit<OnSaveProps, 'onTitleDuplicate' | 'newDescription'> & {
   returnToOrigin: boolean;
@@ -62,6 +66,7 @@ export function App({
   topNavMenuEntryGenerators,
   initialContext,
   theme$,
+  coreStart,
 }: LensAppProps) {
   const lensAppServices = useKibana<LensAppServices>().services;
 
@@ -98,8 +103,10 @@ export function App({
     sharingSavedObjectProps,
     isLinkedToOriginatingApp,
     searchSessionId,
+    datasourceStates,
     isLoading,
     isSaveable,
+    visualization,
   } = useLensSelector((state) => state.lens);
 
   const selectorDependencies = useMemo(
@@ -473,6 +480,98 @@ export function App({
         })
       : undefined;
 
+  const activeDatasourceId = useLensSelector(selectActiveDatasourceId);
+
+  const frameDatasourceAPI = useLensSelector((state) =>
+    selectFrameDatasourceAPI(state, datasourceMap)
+  );
+
+  const [userMessages, setUserMessages] = useState<UserMessage[]>([]);
+
+  useEffect(() => {
+    setUserMessages([
+      ...(activeDatasourceId
+        ? datasourceMap[activeDatasourceId].getUserMessages(
+            datasourceStates[activeDatasourceId].state,
+            {
+              frame: frameDatasourceAPI,
+              setState: (newStateOrUpdater) =>
+                dispatch(
+                  updateDatasourceState({
+                    updater: newStateOrUpdater,
+                    datasourceId: activeDatasourceId,
+                  })
+                ),
+            }
+          )
+        : []),
+      ...(visualization.activeId && visualization.state
+        ? visualizationMap[visualization.activeId]?.getUserMessages?.(visualization.state, {
+            frame: frameDatasourceAPI,
+          }) ?? []
+        : []),
+      ...getApplicationUserMessages({
+        visualizationType: persistedDoc?.visualizationType,
+        visualizationMap,
+        visualization,
+        activeDatasource: activeDatasourceId ? datasourceMap[activeDatasourceId] : null,
+        activeDatasourceState: activeDatasourceId ? datasourceStates[activeDatasourceId] : null,
+        core: coreStart,
+        dataViews: frameDatasourceAPI.dataViews,
+      }),
+    ]);
+  }, [
+    activeDatasourceId,
+    coreStart,
+    datasourceMap,
+    datasourceStates,
+    dispatch,
+    frameDatasourceAPI,
+    persistedDoc?.visualizationType,
+    visualization,
+    visualizationMap,
+  ]);
+
+  // these are messages managed from other parts of Lens
+  const [additionalUserMessages, setAdditionalUserMessages] = useState<Record<string, UserMessage>>(
+    {}
+  );
+
+  const getUserMessages: UserMessagesGetter = (locationId, filterArgs) =>
+    filterUserMessages(
+      [...userMessages, ...Object.values(additionalUserMessages)],
+      locationId,
+      filterArgs
+    );
+
+  const addUserMessages: AddUserMessages = (messages) => {
+    const newMessageMap = {
+      ...additionalUserMessages,
+    };
+
+    const addedMessageIds: string[] = [];
+    messages.forEach((message) => {
+      if (!newMessageMap[message.uniqueId]) {
+        addedMessageIds.push(message.uniqueId);
+        newMessageMap[message.uniqueId] = message;
+      }
+    });
+
+    if (addedMessageIds.length) {
+      setAdditionalUserMessages(newMessageMap);
+    }
+
+    return () => {
+      const withMessagesRemoved = {
+        ...additionalUserMessages,
+      };
+
+      addedMessageIds.forEach((id) => delete withMessagesRemoved[id]);
+
+      setAdditionalUserMessages(withMessagesRemoved);
+    };
+  };
+
   return (
     <>
       <div className="lnsApp" data-test-subj="lnsApp" role="main">
@@ -506,6 +605,7 @@ export function App({
           theme$={theme$}
           indexPatternService={indexPatternService}
           onTextBasedSavedAndExit={onTextBasedSavedAndExit}
+          getUserMessages={getUserMessages}
           shortUrlService={shortUrlService}
         />
         {getLegacyUrlConflictCallout()}
@@ -515,6 +615,8 @@ export function App({
             showNoDataPopover={showNoDataPopover}
             lensInspector={lensInspector}
             indexPatternService={indexPatternService}
+            getUserMessages={getUserMessages}
+            addUserMessages={addUserMessages}
           />
         )}
       </div>
@@ -582,18 +684,24 @@ export function App({
 const MemoizedEditorFrameWrapper = React.memo(function EditorFrameWrapper({
   editorFrame,
   showNoDataPopover,
+  getUserMessages,
+  addUserMessages,
   lensInspector,
   indexPatternService,
 }: {
   editorFrame: EditorFrameInstance;
   lensInspector: LensInspector;
   showNoDataPopover: () => void;
+  getUserMessages: UserMessagesGetter;
+  addUserMessages: AddUserMessages;
   indexPatternService: IndexPatternServiceAPI;
 }) {
   const { EditorFrameContainer } = editorFrame;
   return (
     <EditorFrameContainer
       showNoDataPopover={showNoDataPopover}
+      getUserMessages={getUserMessages}
+      addUserMessages={addUserMessages}
       lensInspector={lensInspector}
       indexPatternService={indexPatternService}
     />
diff --git a/x-pack/plugins/lens/public/app_plugin/get_application_user_messages.test.tsx b/x-pack/plugins/lens/public/app_plugin/get_application_user_messages.test.tsx
new file mode 100644
index 00000000000000..e94fe416c1748a
--- /dev/null
+++ b/x-pack/plugins/lens/public/app_plugin/get_application_user_messages.test.tsx
@@ -0,0 +1,368 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+
+import { CoreStart } from '@kbn/core/public';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
+import { mountWithIntl } from '@kbn/test-jest-helpers';
+import { shallow } from 'enzyme';
+import { Visualization } from '..';
+import { DataViewsState } from '../state_management';
+import { Datasource, UserMessage } from '../types';
+import { filterUserMessages, getApplicationUserMessages } from './get_application_user_messages';
+
+describe('application-level user messages', () => {
+  it('should generate error if vis type is not provided', () => {
+    expect(
+      getApplicationUserMessages({
+        visualizationType: undefined,
+
+        visualizationMap: {},
+        visualization: { activeId: '', state: {} },
+        activeDatasource: {} as Datasource,
+        activeDatasourceState: null,
+        dataViews: {} as DataViewsState,
+        core: {} as CoreStart,
+      })
+    ).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "displayLocations": Array [
+            Object {
+              "id": "visualization",
+            },
+          ],
+          "fixableInEditor": true,
+          "longMessage": "Visualization type not found.",
+          "severity": "warning",
+          "shortMessage": "",
+        },
+      ]
+    `);
+  });
+
+  it('should generate error if vis type is unknown', () => {
+    expect(
+      getApplicationUserMessages({
+        visualizationType: '123',
+        visualizationMap: {},
+        visualization: { activeId: 'id_for_type_that_doesnt_exist', state: {} },
+
+        activeDatasource: {} as Datasource,
+        activeDatasourceState: null,
+        dataViews: {} as DataViewsState,
+        core: {} as CoreStart,
+      })
+    ).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "displayLocations": Array [
+            Object {
+              "id": "visualization",
+            },
+          ],
+          "fixableInEditor": false,
+          "longMessage": "The visualization type id_for_type_that_doesnt_exist could not be resolved.",
+          "severity": "error",
+          "shortMessage": "Unknown visualization type",
+        },
+      ]
+    `);
+  });
+
+  it('should generate error if datasource type is unknown', () => {
+    expect(
+      getApplicationUserMessages({
+        activeDatasource: null,
+
+        visualizationType: '123',
+        visualizationMap: { 'some-id': {} as Visualization },
+        visualization: { activeId: 'some-id', state: {} },
+        activeDatasourceState: null,
+        dataViews: {} as DataViewsState,
+        core: {} as CoreStart,
+      })
+    ).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "displayLocations": Array [
+            Object {
+              "id": "visualization",
+            },
+          ],
+          "fixableInEditor": false,
+          "longMessage": "Could not find datasource for the visualization",
+          "severity": "error",
+          "shortMessage": "Unknown datasource type",
+        },
+      ]
+    `);
+  });
+
+  describe('missing index pattern errors', () => {
+    const defaultPermissions: Record<string, Record<string, boolean | Record<string, boolean>>> = {
+      navLinks: { management: true },
+      management: { kibana: { indexPatterns: true } },
+    };
+
+    function createCoreStartWithPermissions(newCapabilities = defaultPermissions) {
+      const core = {
+        application: {
+          getUrlForApp: jest.fn(() => 'fake/url'),
+          capabilities: {
+            management: {
+              kibana: {
+                indexPatterns: true,
+              },
+            },
+            navLinks: {
+              management: true,
+            },
+          },
+        },
+      } as unknown as CoreStart;
+      (core.application.capabilities as unknown as Record<
+        string,
+        Record<string, boolean | Record<string, boolean>>
+      >) = newCapabilities;
+      return core;
+    }
+
+    const irrelevantProps = {
+      dataViews: {} as DataViewsState,
+      visualizationMap: { foo: {} as Visualization },
+      visualization: { activeId: 'foo', state: {} },
+    };
+
+    it('generates error if missing an index pattern', () => {
+      expect(
+        getApplicationUserMessages({
+          visualizationType: '123',
+          activeDatasource: {
+            checkIntegrity: jest.fn(() => ['missing_pattern']),
+          } as unknown as Datasource,
+          activeDatasourceState: { state: {} },
+          core: createCoreStartWithPermissions(),
+          ...irrelevantProps,
+        })
+      ).toMatchSnapshot();
+    });
+
+    it('doesnt show a recreate link if user has no access', () => {
+      expect(
+        mountWithIntl(
+          <div>
+            {
+              getApplicationUserMessages({
+                visualizationType: '123',
+                activeDatasource: {
+                  checkIntegrity: jest.fn(() => ['missing_pattern']),
+                } as unknown as Datasource,
+                activeDatasourceState: { state: {} },
+                // user can go to management, but indexPatterns management is not accessible
+                core: createCoreStartWithPermissions({
+                  navLinks: { management: true },
+                  management: { kibana: { indexPatterns: false } },
+                }),
+                ...irrelevantProps,
+              })[0].longMessage
+            }
+          </div>
+        ).exists(RedirectAppLinks)
+      ).toBeFalsy();
+
+      expect(
+        shallow(
+          <div>
+            {
+              getApplicationUserMessages({
+                visualizationType: '123',
+                activeDatasource: {
+                  checkIntegrity: jest.fn(() => ['missing_pattern']),
+                } as unknown as Datasource,
+                activeDatasourceState: { state: {} },
+                // user can't go to management at all
+                core: createCoreStartWithPermissions({
+                  navLinks: { management: false },
+                  management: { kibana: { indexPatterns: true } },
+                }),
+                ...irrelevantProps,
+              })[0].longMessage
+            }
+          </div>
+        ).exists(RedirectAppLinks)
+      ).toBeFalsy();
+    });
+  });
+});
+
+describe('filtering user messages', () => {
+  const dimensionId1 = 'foo';
+  const dimensionId2 = 'baz';
+
+  const userMessages: UserMessage[] = [
+    {
+      severity: 'error',
+      fixableInEditor: true,
+      displayLocations: [{ id: 'dimensionTrigger', dimensionId: dimensionId1 }],
+      shortMessage: 'Warning on dimension 1!',
+      longMessage: '',
+    },
+    {
+      severity: 'warning',
+      fixableInEditor: true,
+      displayLocations: [{ id: 'dimensionTrigger', dimensionId: dimensionId2 }],
+      shortMessage: 'Warning on dimension 2!',
+      longMessage: '',
+    },
+    {
+      severity: 'warning',
+      fixableInEditor: true,
+      displayLocations: [{ id: 'banner' }],
+      shortMessage: 'Deprecation notice!',
+      longMessage: '',
+    },
+    {
+      severity: 'error',
+      fixableInEditor: true,
+      displayLocations: [{ id: 'visualization' }],
+      shortMessage: 'Visualization error!',
+      longMessage: '',
+    },
+    {
+      severity: 'error',
+      fixableInEditor: true,
+      displayLocations: [{ id: 'visualizationInEditor' }],
+      shortMessage: 'Visualization editor error!',
+      longMessage: '',
+    },
+    {
+      severity: 'warning',
+      fixableInEditor: true,
+      displayLocations: [{ id: 'visualizationOnEmbeddable' }],
+      shortMessage: 'Visualization embeddable warning!',
+      longMessage: '',
+    },
+  ];
+
+  it('filters by location', () => {
+    expect(filterUserMessages(userMessages, 'banner', {})).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "displayLocations": Array [
+            Object {
+              "id": "banner",
+            },
+          ],
+          "fixableInEditor": true,
+          "longMessage": "",
+          "severity": "warning",
+          "shortMessage": "Deprecation notice!",
+        },
+      ]
+    `);
+    expect(
+      filterUserMessages(userMessages, 'dimensionTrigger', {
+        dimensionId: dimensionId1,
+      })
+    ).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "displayLocations": Array [
+            Object {
+              "dimensionId": "foo",
+              "id": "dimensionTrigger",
+            },
+          ],
+          "fixableInEditor": true,
+          "longMessage": "",
+          "severity": "error",
+          "shortMessage": "Warning on dimension 1!",
+        },
+      ]
+    `);
+    expect(
+      filterUserMessages(userMessages, 'dimensionTrigger', {
+        dimensionId: dimensionId2,
+      })
+    ).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "displayLocations": Array [
+            Object {
+              "dimensionId": "baz",
+              "id": "dimensionTrigger",
+            },
+          ],
+          "fixableInEditor": true,
+          "longMessage": "",
+          "severity": "warning",
+          "shortMessage": "Warning on dimension 2!",
+        },
+      ]
+    `);
+    expect(filterUserMessages(userMessages, ['visualization', 'visualizationInEditor'], {}))
+      .toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "displayLocations": Array [
+            Object {
+              "id": "visualization",
+            },
+          ],
+          "fixableInEditor": true,
+          "longMessage": "",
+          "severity": "error",
+          "shortMessage": "Visualization error!",
+        },
+        Object {
+          "displayLocations": Array [
+            Object {
+              "id": "visualizationInEditor",
+            },
+          ],
+          "fixableInEditor": true,
+          "longMessage": "",
+          "severity": "error",
+          "shortMessage": "Visualization editor error!",
+        },
+      ]
+    `);
+  });
+
+  it('filters by severity', () => {
+    const warnings = filterUserMessages(userMessages, undefined, { severity: 'warning' });
+    const errors = filterUserMessages(userMessages, undefined, { severity: 'error' });
+
+    expect(warnings.length + errors.length).toBe(userMessages.length);
+    expect(warnings.every((message) => message.severity === 'warning'));
+    expect(errors.every((message) => message.severity === 'error'));
+  });
+
+  it('filters by both', () => {
+    expect(
+      filterUserMessages(userMessages, ['visualization', 'visualizationOnEmbeddable'], {
+        severity: 'warning',
+      })
+    ).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "displayLocations": Array [
+            Object {
+              "id": "visualizationOnEmbeddable",
+            },
+          ],
+          "fixableInEditor": true,
+          "longMessage": "",
+          "severity": "warning",
+          "shortMessage": "Visualization embeddable warning!",
+        },
+      ]
+    `);
+  });
+});
diff --git a/x-pack/plugins/lens/public/app_plugin/get_application_user_messages.tsx b/x-pack/plugins/lens/public/app_plugin/get_application_user_messages.tsx
new file mode 100644
index 00000000000000..32faa1742bf0f5
--- /dev/null
+++ b/x-pack/plugins/lens/public/app_plugin/get_application_user_messages.tsx
@@ -0,0 +1,219 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
+import { FormattedMessage } from '@kbn/i18n-react';
+import type { CoreStart } from '@kbn/core/public';
+import type { DataViewsState, VisualizationState } from '../state_management';
+import type {
+  Datasource,
+  UserMessage,
+  UserMessageFilters,
+  UserMessagesDisplayLocationId,
+  VisualizationMap,
+} from '../types';
+import { getMissingIndexPattern } from '../editor_frame_service/editor_frame/state_helpers';
+
+/**
+ * Provides a place to register general user messages that don't belong in the datasource or visualization objects
+ */
+export const getApplicationUserMessages = ({
+  visualizationType,
+  visualization,
+  visualizationMap,
+  activeDatasource,
+  activeDatasourceState,
+  dataViews,
+  core,
+}: {
+  visualizationType: string | null | undefined;
+  visualization: VisualizationState;
+  visualizationMap: VisualizationMap;
+  activeDatasource: Datasource | null;
+  activeDatasourceState: { state: unknown } | null;
+  dataViews: DataViewsState;
+  core: CoreStart;
+}): UserMessage[] => {
+  const messages: UserMessage[] = [];
+
+  if (!visualizationType) {
+    messages.push(getMissingVisTypeError());
+  }
+
+  if (visualization.activeId && !visualizationMap[visualization.activeId]) {
+    messages.push(getUnknownVisualizationTypeError(visualization.activeId));
+  }
+
+  if (!activeDatasource) {
+    messages.push(getUnknownDatasourceTypeError());
+  }
+
+  const missingIndexPatterns = getMissingIndexPattern(
+    activeDatasource,
+    activeDatasourceState,
+    dataViews.indexPatterns
+  );
+
+  if (missingIndexPatterns.length) {
+    messages.push(...getMissingIndexPatternsErrors(core, missingIndexPatterns));
+  }
+
+  return messages;
+};
+
+function getMissingVisTypeError(): UserMessage {
+  return {
+    severity: 'warning',
+    displayLocations: [{ id: 'visualization' }],
+    fixableInEditor: true,
+    shortMessage: '',
+    longMessage: i18n.translate('xpack.lens.editorFrame.expressionMissingVisualizationType', {
+      defaultMessage: 'Visualization type not found.',
+    }),
+  };
+}
+
+function getUnknownVisualizationTypeError(visType: string): UserMessage {
+  return {
+    severity: 'error',
+    fixableInEditor: false,
+    displayLocations: [{ id: 'visualization' }],
+    shortMessage: i18n.translate('xpack.lens.unknownVisType.shortMessage', {
+      defaultMessage: `Unknown visualization type`,
+    }),
+    longMessage: i18n.translate('xpack.lens.unknownVisType.longMessage', {
+      defaultMessage: `The visualization type {visType} could not be resolved.`,
+      values: {
+        visType,
+      },
+    }),
+  };
+}
+
+function getUnknownDatasourceTypeError(): UserMessage {
+  return {
+    severity: 'error',
+    fixableInEditor: false,
+    displayLocations: [{ id: 'visualization' }],
+    shortMessage: i18n.translate('xpack.lens.unknownDatasourceType.shortMessage', {
+      defaultMessage: `Unknown datasource type`,
+    }),
+    longMessage: i18n.translate('xpack.lens.editorFrame.expressionMissingDatasource', {
+      defaultMessage: 'Could not find datasource for the visualization',
+    }),
+  };
+}
+
+function getMissingIndexPatternsErrors(
+  core: CoreStart,
+  missingIndexPatterns: string[]
+): UserMessage[] {
+  // Check for access to both Management app && specific indexPattern section
+  const { management: isManagementEnabled } = core.application.capabilities.navLinks;
+  const isIndexPatternManagementEnabled =
+    core.application.capabilities.management.kibana.indexPatterns;
+  const canFix = isManagementEnabled && isIndexPatternManagementEnabled;
+  return [
+    {
+      severity: 'error',
+      fixableInEditor: canFix,
+      displayLocations: [{ id: 'visualizationInEditor' }],
+      shortMessage: '',
+      longMessage: (
+        <>
+          <p className="eui-textBreakWord" data-test-subj="missing-refs-failure">
+            <FormattedMessage
+              id="xpack.lens.editorFrame.dataViewNotFound"
+              defaultMessage="Data view not found"
+            />
+          </p>
+          <p
+            className="eui-textBreakWord"
+            style={{
+              userSelect: 'text',
+            }}
+          >
+            <FormattedMessage
+              id="xpack.lens.indexPattern.missingDataView"
+              defaultMessage="The {count, plural, one {data view} other {data views}} ({count, plural, one {id} other {ids}}: {indexpatterns}) cannot be found."
+              values={{
+                count: missingIndexPatterns.length,
+                indexpatterns: missingIndexPatterns.join(', '),
+              }}
+            />
+            {canFix && (
+              <RedirectAppLinks coreStart={core}>
+                <a
+                  href={core.application.getUrlForApp('management', {
+                    path: '/kibana/indexPatterns/create',
+                  })}
+                  style={{ display: 'block' }}
+                  data-test-subj="configuration-failure-reconfigure-indexpatterns"
+                >
+                  {i18n.translate('xpack.lens.editorFrame.dataViewReconfigure', {
+                    defaultMessage: `Recreate it in the data view management page.`,
+                  })}
+                </a>
+              </RedirectAppLinks>
+            )}
+          </p>
+        </>
+      ),
+    },
+    {
+      severity: 'error',
+      fixableInEditor: canFix,
+      displayLocations: [{ id: 'visualizationOnEmbeddable' }],
+      shortMessage: '',
+      longMessage: i18n.translate('xpack.lens.editorFrame.expressionMissingDataView', {
+        defaultMessage:
+          'Could not find the {count, plural, one {data view} other {data views}}: {ids}',
+        values: { count: missingIndexPatterns.length, ids: missingIndexPatterns.join(', ') },
+      }),
+    },
+  ];
+}
+
+export const filterUserMessages = (
+  userMessages: UserMessage[],
+  locationId: UserMessagesDisplayLocationId | UserMessagesDisplayLocationId[] | undefined,
+  { dimensionId, severity }: UserMessageFilters
+) => {
+  const locationIds = Array.isArray(locationId)
+    ? locationId
+    : typeof locationId === 'string'
+    ? [locationId]
+    : [];
+
+  return userMessages.filter((message) => {
+    if (locationIds.length) {
+      const hasMatch = message.displayLocations.some((location) => {
+        if (!locationIds.includes(location.id)) {
+          return false;
+        }
+
+        if (location.id === 'dimensionTrigger' && location.dimensionId !== dimensionId) {
+          return false;
+        }
+
+        return true;
+      });
+
+      if (!hasMatch) {
+        return false;
+      }
+    }
+
+    if (severity && message.severity !== severity) {
+      return false;
+    }
+
+    return true;
+  });
+};
diff --git a/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx b/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx
index 4a498cbb23266a..14eaaab75ba739 100644
--- a/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx
@@ -281,6 +281,7 @@ export const LensTopNavMenu = ({
   indexPatternService,
   currentDoc,
   onTextBasedSavedAndExit,
+  getUserMessages,
   shortUrlService,
   isCurrentStateDirty,
 }: LensTopNavMenuProps) => {
@@ -1032,21 +1033,9 @@ export const LensTopNavMenu = ({
     textBasedLanguages: supportedTextBasedLanguages as DataViewPickerProps['textBasedLanguages'],
   };
 
-  // text based languages errors should also appear to the unified search bar
-  const textBasedLanguageModeErrors: Error[] = [];
-  if (activeDatasourceId && allLoaded) {
-    if (
-      datasourceMap[activeDatasourceId] &&
-      datasourceMap[activeDatasourceId].getUnifiedSearchErrors
-    ) {
-      const errors = datasourceMap[activeDatasourceId].getUnifiedSearchErrors?.(
-        datasourceStates[activeDatasourceId].state
-      );
-      if (errors) {
-        textBasedLanguageModeErrors.push(...errors);
-      }
-    }
-  }
+  const textBasedLanguageModeErrors = getUserMessages('textBasedLanguagesQueryInput', {
+    severity: 'error',
+  }).map(({ shortMessage }) => new Error(shortMessage));
 
   return (
     <AggregateQueryTopNavMenu
diff --git a/x-pack/plugins/lens/public/app_plugin/mounter.tsx b/x-pack/plugins/lens/public/app_plugin/mounter.tsx
index fb791c471fcb5e..916664feffd845 100644
--- a/x-pack/plugins/lens/public/app_plugin/mounter.tsx
+++ b/x-pack/plugins/lens/public/app_plugin/mounter.tsx
@@ -364,6 +364,7 @@ export async function mountApp(
             contextOriginatingApp={originatingApp}
             topNavMenuEntryGenerators={topNavMenuEntryGenerators}
             theme$={core.theme.theme$}
+            coreStart={coreStart}
           />
         </Provider>
       );
diff --git a/x-pack/plugins/lens/public/app_plugin/types.ts b/x-pack/plugins/lens/public/app_plugin/types.ts
index 1411598c4033e7..314bc3a2e52f59 100644
--- a/x-pack/plugins/lens/public/app_plugin/types.ts
+++ b/x-pack/plugins/lens/public/app_plugin/types.ts
@@ -13,6 +13,7 @@ import type {
   ApplicationStart,
   AppMountParameters,
   ChromeStart,
+  CoreStart,
   CoreTheme,
   ExecutionContextStart,
   HttpStart,
@@ -50,6 +51,7 @@ import type {
   VisualizeEditorContext,
   LensTopNavMenuEntryGenerator,
   VisualizationMap,
+  UserMessagesGetter,
 } from '../types';
 import type { LensAttributeService } from '../lens_attribute_service';
 import type { LensEmbeddableInput } from '../embeddable/embeddable';
@@ -82,6 +84,7 @@ export interface LensAppProps {
   contextOriginatingApp?: string;
   topNavMenuEntryGenerators: LensTopNavMenuEntryGenerator[];
   theme$: Observable<CoreTheme>;
+  coreStart: CoreStart;
 }
 
 export type RunSave = (
@@ -121,6 +124,7 @@ export interface LensTopNavMenuProps {
   theme$: Observable<CoreTheme>;
   indexPatternService: IndexPatternServiceAPI;
   onTextBasedSavedAndExit: ({ onSave }: { onSave: () => void }) => Promise<void>;
+  getUserMessages: UserMessagesGetter;
   shortUrlService: (params: LensAppLocatorParams) => Promise<string>;
   isCurrentStateDirty: boolean;
 }
diff --git a/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/dimension_panel.tsx b/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/dimension_panel.tsx
index f4bb61b9758b67..533abb4bc4defc 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/dimension_panel.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/dimension_panel.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { memo, useMemo } from 'react';
+import React, { memo } from 'react';
 import { IUiSettingsClient, SavedObjectsClientContract, HttpSetup } from '@kbn/core/public';
 import type { IStorageWrapper } from '@kbn/kibana-utils-plugin/public';
 import type { DataPublicPluginStart } from '@kbn/data-plugin/public';
@@ -15,12 +15,10 @@ import type { FieldFormatsStart } from '@kbn/field-formats-plugin/public';
 import type { DataViewsPublicPluginStart } from '@kbn/data-views-plugin/public';
 import { DatasourceDimensionTriggerProps, DatasourceDimensionEditorProps } from '../../../types';
 import { GenericIndexPatternColumn } from '../form_based';
-import { isColumnInvalid } from '../utils';
 import { FormBasedPrivateState } from '../types';
 import { DimensionEditor } from './dimension_editor';
 import { DateRange } from '../../../../common';
 import { getOperationSupportMatrix } from './operation_support';
-import { DimensionTrigger } from '../../../shared_components/dimension_trigger';
 
 export type FormBasedDimensionTriggerProps =
   DatasourceDimensionTriggerProps<FormBasedPrivateState> & {
@@ -42,43 +40,6 @@ export type FormBasedDimensionEditorProps =
     dateRange: DateRange;
   };
 
-function wrapOnDot(str?: string) {
-  // u200B is a non-width white-space character, which allows
-  // the browser to efficiently word-wrap right after the dot
-  // without us having to draw a lot of extra DOM elements, etc
-  return str ? str.replace(/\./g, '.\u200B') : '';
-}
-
-export const FormBasedDimensionTriggerComponent = function FormBasedDimensionTrigger(
-  props: FormBasedDimensionTriggerProps
-) {
-  const { columnId, uniqueLabel, invalid, invalidMessage, hideTooltip, layerId, dateRange } = props;
-  const layer = props.state.layers[layerId];
-  const currentIndexPattern = props.indexPatterns[layer.indexPatternId];
-
-  const currentColumnHasErrors = useMemo(
-    () => invalid || isColumnInvalid(layer, columnId, currentIndexPattern, dateRange),
-    [layer, columnId, currentIndexPattern, invalid, dateRange]
-  );
-
-  const selectedColumn: GenericIndexPatternColumn | null = layer.columns[props.columnId] ?? null;
-
-  if (!selectedColumn) {
-    return null;
-  }
-  const formattedLabel = wrapOnDot(uniqueLabel);
-
-  return (
-    <DimensionTrigger
-      id={columnId}
-      label={!currentColumnHasErrors ? formattedLabel : selectedColumn.label}
-      isInvalid={Boolean(currentColumnHasErrors)}
-      hideTooltip={hideTooltip}
-      invalidMessage={invalidMessage}
-    />
-  );
-};
-
 export const FormBasedDimensionEditorComponent = function FormBasedDimensionPanel(
   props: FormBasedDimensionEditorProps
 ) {
@@ -102,5 +63,4 @@ export const FormBasedDimensionEditorComponent = function FormBasedDimensionPane
   );
 };
 
-export const FormBasedDimensionTrigger = memo(FormBasedDimensionTriggerComponent);
 export const FormBasedDimensionEditor = memo(FormBasedDimensionEditorComponent);
diff --git a/x-pack/plugins/lens/public/datasources/form_based/form_based.test.ts b/x-pack/plugins/lens/public/datasources/form_based/form_based.test.ts
index 549dff69eabb1b..5c5fe11ebfc946 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/form_based.test.ts
+++ b/x-pack/plugins/lens/public/datasources/form_based/form_based.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { ReactElement } from 'react';
+import { ReactElement } from 'react';
 import { SavedObjectReference } from '@kbn/core/public';
 import { isFragment } from 'react-is';
 import { coreMock } from '@kbn/core/public/mocks';
@@ -21,7 +21,14 @@ import { uiActionsPluginMock } from '@kbn/ui-actions-plugin/public/mocks';
 import { fieldFormatsServiceMock } from '@kbn/field-formats-plugin/public/mocks';
 import { TinymathAST } from '@kbn/tinymath';
 import { getFormBasedDatasource, GenericIndexPatternColumn } from './form_based';
-import { DatasourcePublicAPI, Datasource, FramePublicAPI, OperationDescriptor } from '../../types';
+import {
+  DatasourcePublicAPI,
+  Datasource,
+  FramePublicAPI,
+  OperationDescriptor,
+  FrameDatasourceAPI,
+  UserMessage,
+} from '../../types';
 import { getFieldByNameFactory } from './pure_helpers';
 import {
   operationDefinitionMap,
@@ -43,6 +50,7 @@ import { createMockedFullReference } from './operations/mocks';
 import { cloneDeep } from 'lodash';
 import { DatatableColumn } from '@kbn/expressions-plugin/common';
 import { createMockFramePublicAPI } from '../../mocks';
+import { filterUserMessages } from '../../app_plugin/get_application_user_messages';
 
 jest.mock('./loader');
 jest.mock('../../id_generator');
@@ -3004,237 +3012,298 @@ describe('IndexPattern Data Source', () => {
     });
   });
 
-  describe('#getErrorMessages', () => {
-    it('should use the results of getErrorMessages directly when single layer', () => {
-      (getErrorMessages as jest.Mock).mockClear();
-      (getErrorMessages as jest.Mock).mockReturnValueOnce(['error 1', 'error 2']);
-      const state: FormBasedPrivateState = {
-        layers: {
-          first: {
-            indexPatternId: '1',
-            columnOrder: [],
-            columns: {},
+  describe('#getUserMessages', () => {
+    describe('error messages', () => {
+      it('should generate error messages for a single layer', () => {
+        (getErrorMessages as jest.Mock).mockClear();
+        (getErrorMessages as jest.Mock).mockReturnValueOnce(['error 1', 'error 2']);
+        const state: FormBasedPrivateState = {
+          layers: {
+            first: {
+              indexPatternId: '1',
+              columnOrder: [],
+              columns: {},
+            },
           },
-        },
-        currentIndexPatternId: '1',
-      };
-      expect(FormBasedDatasource.getErrorMessages(state, indexPatterns)).toEqual([
-        { longMessage: 'error 1', shortMessage: '' },
-        { longMessage: 'error 2', shortMessage: '' },
-      ]);
-      expect(getErrorMessages).toHaveBeenCalledTimes(1);
-    });
+          currentIndexPatternId: '1',
+        };
+        expect(
+          FormBasedDatasource.getUserMessages(state, {
+            frame: { dataViews: { indexPatterns } } as unknown as FrameDatasourceAPI,
+            setState: () => {},
+          })
+        ).toMatchInlineSnapshot(`
+          Array [
+            Object {
+              "displayLocations": Array [
+                Object {
+                  "id": "visualization",
+                },
+              ],
+              "fixableInEditor": true,
+              "longMessage": "error 1",
+              "severity": "error",
+              "shortMessage": "",
+            },
+            Object {
+              "displayLocations": Array [
+                Object {
+                  "id": "visualization",
+                },
+              ],
+              "fixableInEditor": true,
+              "longMessage": "error 2",
+              "severity": "error",
+              "shortMessage": "",
+            },
+          ]
+        `);
+        expect(getErrorMessages).toHaveBeenCalledTimes(1);
+      });
 
-    it('should prepend each error with its layer number on multi-layer chart', () => {
-      (getErrorMessages as jest.Mock).mockClear();
-      (getErrorMessages as jest.Mock).mockReturnValueOnce(['error 1', 'error 2']);
-      const state: FormBasedPrivateState = {
-        layers: {
-          first: {
-            indexPatternId: '1',
-            columnOrder: [],
-            columns: {},
-          },
-          second: {
-            indexPatternId: '1',
-            columnOrder: [],
-            columns: {},
+      it('should prepend each error with its layer number on multi-layer chart', () => {
+        (getErrorMessages as jest.Mock).mockClear();
+        (getErrorMessages as jest.Mock).mockReturnValueOnce(['error 1', 'error 2']);
+        const state: FormBasedPrivateState = {
+          layers: {
+            first: {
+              indexPatternId: '1',
+              columnOrder: [],
+              columns: {},
+            },
+            second: {
+              indexPatternId: '1',
+              columnOrder: [],
+              columns: {},
+            },
           },
-        },
-        currentIndexPatternId: '1',
-      };
-      expect(FormBasedDatasource.getErrorMessages(state, indexPatterns)).toEqual([
-        { longMessage: 'Layer 1 error: error 1', shortMessage: '' },
-        { longMessage: 'Layer 1 error: error 2', shortMessage: '' },
-      ]);
-      expect(getErrorMessages).toHaveBeenCalledTimes(2);
+          currentIndexPatternId: '1',
+        };
+        expect(
+          FormBasedDatasource.getUserMessages(state, {
+            frame: { dataViews: { indexPatterns } } as unknown as FrameDatasourceAPI,
+            setState: () => {},
+          })
+        ).toMatchInlineSnapshot(`
+          Array [
+            Object {
+              "displayLocations": Array [
+                Object {
+                  "id": "visualization",
+                },
+              ],
+              "fixableInEditor": true,
+              "longMessage": <FormattedMessage
+                defaultMessage="Layer {position} error: {wrappedMessage}"
+                id="xpack.lens.indexPattern.layerErrorWrapper"
+                values={
+                  Object {
+                    "position": 1,
+                    "wrappedMessage": <React.Fragment>
+                      error 1
+                    </React.Fragment>,
+                  }
+                }
+              />,
+              "severity": "error",
+              "shortMessage": "Layer 1 error: ",
+            },
+            Object {
+              "displayLocations": Array [
+                Object {
+                  "id": "visualization",
+                },
+              ],
+              "fixableInEditor": true,
+              "longMessage": <FormattedMessage
+                defaultMessage="Layer {position} error: {wrappedMessage}"
+                id="xpack.lens.indexPattern.layerErrorWrapper"
+                values={
+                  Object {
+                    "position": 1,
+                    "wrappedMessage": <React.Fragment>
+                      error 2
+                    </React.Fragment>,
+                  }
+                }
+              />,
+              "severity": "error",
+              "shortMessage": "Layer 1 error: ",
+            },
+          ]
+        `);
+        expect(getErrorMessages).toHaveBeenCalledTimes(2);
+      });
     });
-  });
 
-  describe('#getWarningMessages', () => {
-    let state: FormBasedPrivateState;
-    let framePublicAPI: FramePublicAPI;
+    describe('warning messages', () => {
+      let state: FormBasedPrivateState;
+      let framePublicAPI: FramePublicAPI;
 
-    beforeEach(() => {
-      const termsColumn: TermsIndexPatternColumn = {
-        operationType: 'terms',
-        dataType: 'number',
-        isBucketed: true,
-        label: '123211',
-        sourceField: 'foo',
-        params: {
-          size: 10,
-          orderBy: {
-            type: 'alphabetical',
-          },
-          orderDirection: 'asc',
-        },
-      };
+      beforeEach(() => {
+        (getErrorMessages as jest.Mock).mockReturnValueOnce([]);
 
-      state = {
-        layers: {
-          first: {
-            indexPatternId: '1',
-            columnOrder: ['col1', 'col2', 'col3', 'col4', 'col5', 'col6'],
-            columns: {
-              col1: {
-                operationType: 'date_histogram',
-                params: {
-                  interval: '12h',
+        const termsColumn: TermsIndexPatternColumn = {
+          operationType: 'terms',
+          dataType: 'number',
+          isBucketed: true,
+          label: '123211',
+          sourceField: 'foo',
+          params: {
+            size: 10,
+            orderBy: {
+              type: 'alphabetical',
+            },
+            orderDirection: 'asc',
+          },
+        };
+
+        state = {
+          layers: {
+            first: {
+              indexPatternId: '1',
+              columnOrder: ['col1', 'col2', 'col3', 'col4', 'col5', 'col6'],
+              columns: {
+                col1: {
+                  operationType: 'date_histogram',
+                  params: {
+                    interval: '12h',
+                  },
+                  label: '',
+                  dataType: 'date',
+                  isBucketed: true,
+                  sourceField: 'timestamp',
+                } as DateHistogramIndexPatternColumn,
+                col2: {
+                  operationType: 'count',
+                  label: '',
+                  dataType: 'number',
+                  isBucketed: false,
+                  sourceField: 'records',
                 },
-                label: '',
-                dataType: 'date',
-                isBucketed: true,
-                sourceField: 'timestamp',
-              } as DateHistogramIndexPatternColumn,
-              col2: {
-                operationType: 'count',
-                label: '',
-                dataType: 'number',
-                isBucketed: false,
-                sourceField: 'records',
-              },
-              col3: {
-                operationType: 'count',
-                timeShift: '1h',
-                label: '',
-                dataType: 'number',
-                isBucketed: false,
-                sourceField: 'records',
-              },
-              col4: {
-                operationType: 'count',
-                timeShift: '13h',
-                label: '',
-                dataType: 'number',
-                isBucketed: false,
-                sourceField: 'records',
-              },
-              col5: {
-                operationType: 'count',
-                timeShift: '1w',
-                label: '',
-                dataType: 'number',
-                isBucketed: false,
-                sourceField: 'records',
-              },
-              col6: {
-                operationType: 'count',
-                timeShift: 'previous',
-                label: '',
-                dataType: 'number',
-                isBucketed: false,
-                sourceField: 'records',
+                col3: {
+                  operationType: 'count',
+                  timeShift: '1h',
+                  label: '',
+                  dataType: 'number',
+                  isBucketed: false,
+                  sourceField: 'records',
+                },
+                col4: {
+                  operationType: 'count',
+                  timeShift: '13h',
+                  label: '',
+                  dataType: 'number',
+                  isBucketed: false,
+                  sourceField: 'records',
+                },
+                col5: {
+                  operationType: 'count',
+                  timeShift: '1w',
+                  label: '',
+                  dataType: 'number',
+                  isBucketed: false,
+                  sourceField: 'records',
+                },
+                col6: {
+                  operationType: 'count',
+                  timeShift: 'previous',
+                  label: '',
+                  dataType: 'number',
+                  isBucketed: false,
+                  sourceField: 'records',
+                },
+                termsCol: termsColumn,
               },
-              termsCol: termsColumn,
             },
           },
-        },
-        currentIndexPatternId: '1',
-      };
+          currentIndexPatternId: '1',
+        };
 
-      framePublicAPI = {
-        activeData: {
-          first: {
-            type: 'datatable',
-            rows: [],
-            columns: [
-              {
-                id: 'col1',
-                name: 'col1',
-                meta: {
-                  type: 'date',
-                  source: 'esaggs',
-                  sourceParams: {
-                    type: 'date_histogram',
-                    params: {
-                      used_interval: '12h',
+        framePublicAPI = {
+          activeData: {
+            first: {
+              type: 'datatable',
+              rows: [],
+              columns: [
+                {
+                  id: 'col1',
+                  name: 'col1',
+                  meta: {
+                    type: 'date',
+                    source: 'esaggs',
+                    sourceParams: {
+                      type: 'date_histogram',
+                      params: {
+                        used_interval: '12h',
+                      },
                     },
                   },
                 },
-              },
-              {
-                id: 'termsCol',
-                name: 'termsCol',
-                meta: {
-                  type: 'string',
-                  source: 'esaggs',
-                  sourceParams: {
-                    type: 'terms',
+                {
+                  id: 'termsCol',
+                  name: 'termsCol',
+                  meta: {
+                    type: 'string',
+                    source: 'esaggs',
+                    sourceParams: {
+                      type: 'terms',
+                    },
                   },
-                },
-              } as DatatableColumn,
-            ],
+                } as DatatableColumn,
+              ],
+            },
           },
-        },
-        dataViews: {
-          ...createMockFramePublicAPI().dataViews,
-          indexPatterns: expectedIndexPatterns,
-          indexPatternRefs: Object.values(expectedIndexPatterns).map(({ id, title }) => ({
-            id,
-            title,
-          })),
-        },
-      } as unknown as FramePublicAPI;
-    });
-
-    const extractTranslationIdsFromWarnings = (warnings: React.ReactNode[] | undefined) =>
-      warnings?.map((item) =>
-        isFragment(item)
-          ? (item as ReactElement).props.children[0].props.id
-          : (item as ReactElement).props.id
-      );
-
-    it('should return mismatched time shifts', () => {
-      const warnings = FormBasedDatasource.getWarningMessages!(state, framePublicAPI, {}, () => {});
-
-      expect(extractTranslationIdsFromWarnings(warnings)).toMatchInlineSnapshot(`
-        Array [
-          "xpack.lens.indexPattern.timeShiftSmallWarning",
-          "xpack.lens.indexPattern.timeShiftMultipleWarning",
-        ]
-      `);
-    });
+          dataViews: {
+            ...createMockFramePublicAPI().dataViews,
+            indexPatterns: expectedIndexPatterns,
+            indexPatternRefs: Object.values(expectedIndexPatterns).map(({ id, title }) => ({
+              id,
+              title,
+            })),
+          },
+        } as unknown as FramePublicAPI;
+      });
 
-    it('should show different types of warning messages', () => {
-      framePublicAPI.activeData!.first.columns[1].meta.sourceParams!.hasPrecisionError = true;
+      const extractTranslationIdsFromWarnings = (warnings: UserMessage[]) => {
+        const onlyWarnings = filterUserMessages(warnings, undefined, { severity: 'warning' });
+        return onlyWarnings.map(({ longMessage }) =>
+          isFragment(longMessage)
+            ? (longMessage as ReactElement).props.children[0].props.id
+            : (longMessage as ReactElement).props.id
+        );
+      };
 
-      const warnings = FormBasedDatasource.getWarningMessages!(state, framePublicAPI, {}, () => {});
+      it('should return mismatched time shifts', () => {
+        const warnings = FormBasedDatasource.getUserMessages!(state, {
+          frame: framePublicAPI as FrameDatasourceAPI,
+          setState: () => {},
+        });
 
-      expect(extractTranslationIdsFromWarnings(warnings)).toMatchInlineSnapshot(`
-        Array [
-          "xpack.lens.indexPattern.timeShiftSmallWarning",
-          "xpack.lens.indexPattern.timeShiftMultipleWarning",
-          "xpack.lens.indexPattern.precisionErrorWarning.accuracyDisabled",
-        ]
-      `);
-    });
+        expect(extractTranslationIdsFromWarnings(warnings)).toMatchInlineSnapshot(`
+                  Array [
+                    "xpack.lens.indexPattern.timeShiftSmallWarning",
+                    "xpack.lens.indexPattern.timeShiftMultipleWarning",
+                  ]
+              `);
+      });
 
-    it('should prepend each error with its layer number on multi-layer chart', () => {
-      (getErrorMessages as jest.Mock).mockClear();
-      (getErrorMessages as jest.Mock).mockReturnValueOnce(['error 1', 'error 2']);
+      it('should show different types of warning messages', () => {
+        framePublicAPI.activeData!.first.columns[1].meta.sourceParams!.hasPrecisionError = true;
 
-      state = {
-        layers: {
-          first: {
-            indexPatternId: '1',
-            columnOrder: [],
-            columns: {},
-          },
-          second: {
-            indexPatternId: '1',
-            columnOrder: [],
-            columns: {},
-          },
-        },
-        currentIndexPatternId: '1',
-      };
+        const warnings = FormBasedDatasource.getUserMessages!(state, {
+          frame: framePublicAPI as FrameDatasourceAPI,
+          setState: () => {},
+        });
 
-      expect(FormBasedDatasource.getErrorMessages(state, indexPatterns)).toEqual([
-        { longMessage: 'Layer 1 error: error 1', shortMessage: '' },
-        { longMessage: 'Layer 1 error: error 2', shortMessage: '' },
-      ]);
-      expect(getErrorMessages).toHaveBeenCalledTimes(2);
+        expect(extractTranslationIdsFromWarnings(warnings)).toMatchInlineSnapshot(`
+                  Array [
+                    "xpack.lens.indexPattern.timeShiftSmallWarning",
+                    "xpack.lens.indexPattern.timeShiftMultipleWarning",
+                    "xpack.lens.indexPattern.precisionErrorWarning.accuracyDisabled",
+                  ]
+              `);
+      });
     });
   });
 
diff --git a/x-pack/plugins/lens/public/datasources/form_based/form_based.tsx b/x-pack/plugins/lens/public/datasources/form_based/form_based.tsx
index e3f6df8e0887ff..1ce6832f781095 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/form_based.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/form_based.tsx
@@ -23,7 +23,7 @@ import { ChartsPluginSetup } from '@kbn/charts-plugin/public';
 import { UiActionsStart } from '@kbn/ui-actions-plugin/public';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { UnifiedSearchPublicPluginStart } from '@kbn/unified-search-plugin/public';
-import { EuiCallOut, EuiLink } from '@elastic/eui';
+import { EuiButton } from '@elastic/eui';
 import type { SharePluginStart } from '@kbn/share-plugin/public';
 import type {
   DatasourceDimensionEditorProps,
@@ -38,6 +38,9 @@ import type {
   IndexPatternRef,
   DatasourceLayerSettingsProps,
   DataSourceInfo,
+  UserMessage,
+  FrameDatasourceAPI,
+  StateSetter,
 } from '../../types';
 import {
   changeIndexPattern,
@@ -50,12 +53,7 @@ import {
   triggerActionOnIndexPatternChange,
 } from './loader';
 import { toExpression } from './to_expression';
-import {
-  FormBasedDimensionTrigger,
-  FormBasedDimensionEditor,
-  getDropProps,
-  onDrop,
-} from './dimension_panel';
+import { FormBasedDimensionEditor, getDropProps, onDrop } from './dimension_panel';
 import { FormBasedDataPanel } from './datapanel';
 import {
   getDatasourceSuggestionsForField,
@@ -68,6 +66,7 @@ import {
   getFiltersInLayer,
   getShardFailuresWarningMessages,
   getVisualDefaultsForLayer,
+  getDeprecatedSamplingWarningMessage,
   isColumnInvalid,
   cloneLayer,
 } from './utils';
@@ -101,9 +100,17 @@ import { DOCUMENT_FIELD_NAME } from '../../../common/constants';
 import { isColumnOfType } from './operations/definitions/helpers';
 import { LayerSettingsPanel } from './layer_settings';
 import { FormBasedLayer } from '../..';
+import { DimensionTrigger } from '../../shared_components/dimension_trigger';
 export type { OperationType, GenericIndexPatternColumn } from './operations';
 export { deleteColumn } from './operations';
 
+function wrapOnDot(str?: string) {
+  // u200B is a non-width white-space character, which allows
+  // the browser to efficiently word-wrap right after the dot
+  // without us having to draw a lot of extra DOM elements, etc
+  return str ? str.replace(/\./g, '.\u200B') : '';
+}
+
 export function columnToOperation(
   column: GenericIndexPatternColumn,
   uniqueLabel?: string,
@@ -526,6 +533,8 @@ export function getFormBasedDatasource({
       props: DatasourceDimensionTriggerProps<FormBasedPrivateState>
     ) => {
       const columnLabelMap = formBasedDatasource.uniqueLabels(props.state);
+      const uniqueLabel = columnLabelMap[props.columnId];
+      const formattedLabel = wrapOnDot(uniqueLabel);
 
       render(
         <KibanaThemeProvider theme$={core.theme.theme$}>
@@ -542,7 +551,13 @@ export function getFormBasedDatasource({
                 unifiedSearch,
               }}
             >
-              <FormBasedDimensionTrigger uniqueLabel={columnLabelMap[props.columnId]} {...props} />
+              <DimensionTrigger
+                id={props.columnId}
+                label={formattedLabel}
+                isInvalid={props.invalid}
+                hideTooltip={props.hideTooltip}
+                invalidMessage={props.invalidMessage}
+              />
             </KibanaContextProvider>
           </I18nProvider>
         </KibanaThemeProvider>,
@@ -815,119 +830,58 @@ export function getFormBasedDatasource({
     getDatasourceSuggestionsForVisualizeField,
     getDatasourceSuggestionsForVisualizeCharts,
 
-    getErrorMessages(state, indexPatterns) {
+    getUserMessages(state, { frame: frameDatasourceAPI, setState }) {
       if (!state) {
-        return;
+        return [];
       }
 
-      // Forward the indexpattern as well, as it is required by some operationType checks
-      const layerErrors = Object.entries(state.layers)
-        .filter(([_, layer]) => !!indexPatterns[layer.indexPatternId])
-        .map(([layerId, layer]) =>
-          (
-            getErrorMessages(
-              layer,
-              indexPatterns[layer.indexPatternId],
-              state,
-              layerId,
-              core,
-              data
-            ) ?? []
-          ).map((message) => ({
-            shortMessage: '', // Not displayed currently
-            longMessage: typeof message === 'string' ? message : message.message,
-            fixAction: typeof message === 'object' ? message.fixAction : undefined,
-          }))
-        );
+      const layerErrorMessages = getLayerErrorMessages(
+        state,
+        frameDatasourceAPI,
+        setState,
+        core,
+        data
+      );
 
-      // Single layer case, no need to explain more
-      if (layerErrors.length <= 1) {
-        return layerErrors[0]?.length ? layerErrors[0] : undefined;
-      }
+      const dimensionErrorMessages = getDimensionErrorMessages(state, (layerId, columnId) =>
+        this.isValidColumn(state, frameDatasourceAPI.dataViews.indexPatterns, layerId, columnId)
+      );
 
-      // For multiple layers we will prepend each error with the layer number
-      const messages = layerErrors.flatMap((errors, index) => {
-        return errors.map((error) => {
-          const { shortMessage, longMessage } = error;
-          return {
-            shortMessage: shortMessage
-              ? i18n.translate('xpack.lens.indexPattern.layerErrorWrapper', {
-                  defaultMessage: 'Layer {position} error: {wrappedMessage}',
-                  values: {
-                    position: index + 1,
-                    wrappedMessage: shortMessage,
-                  },
-                })
-              : '',
-            longMessage: longMessage
-              ? i18n.translate('xpack.lens.indexPattern.layerErrorWrapper', {
-                  defaultMessage: 'Layer {position} error: {wrappedMessage}',
-                  values: {
-                    position: index + 1,
-                    wrappedMessage: longMessage,
-                  },
-                })
-              : '',
+      const warningMessages = [
+        ...[
+          ...(getStateTimeShiftWarningMessages(
+            data.datatableUtilities,
+            state,
+            frameDatasourceAPI
+          ) || []),
+          ...getPrecisionErrorWarningMessages(
+            data.datatableUtilities,
+            state,
+            frameDatasourceAPI,
+            core.docLinks,
+            setState
+          ),
+        ].map((longMessage) => {
+          const message: UserMessage = {
+            severity: 'warning',
+            fixableInEditor: true,
+            displayLocations: [{ id: 'toolbar' }],
+            shortMessage: '',
+            longMessage,
           };
-        });
-      });
-      return messages.length ? messages : undefined;
-    },
-    getWarningMessages: (state, frame, adapters, setState) => {
-      return [
-        ...(getStateTimeShiftWarningMessages(data.datatableUtilities, state, frame) || []),
-        ...getPrecisionErrorWarningMessages(
-          data.datatableUtilities,
-          state,
-          frame,
-          core.docLinks,
-          setState
-        ),
+
+          return message;
+        }),
+        ...getDeprecatedSamplingWarningMessage(core),
       ];
+
+      return [...layerErrorMessages, ...dimensionErrorMessages, ...warningMessages];
     },
+
     getSearchWarningMessages: (state, warning, request, response) => {
       return [...getShardFailuresWarningMessages(state, warning, request, response, core.theme)];
     },
-    getDeprecationMessages: () => {
-      const deprecatedMessages: React.ReactNode[] = [];
-      const useFieldExistenceSamplingKey = 'lens:useFieldExistenceSampling';
-      const isUsingSampling = core.uiSettings.get(useFieldExistenceSamplingKey);
-
-      if (isUsingSampling) {
-        deprecatedMessages.push(
-          <EuiCallOut
-            color="warning"
-            iconType="alert"
-            size="s"
-            title={
-              <FormattedMessage
-                id="xpack.lens.indexPattern.useFieldExistenceSamplingBody"
-                defaultMessage="Field existence sampling has been deprecated and will be removed in Kibana {version}. You may disable this feature in {link}."
-                values={{
-                  version: '8.6.0',
-                  link: (
-                    <EuiLink
-                      onClick={() => {
-                        core.application.navigateToApp('management', {
-                          path: `/kibana/settings?query=${useFieldExistenceSamplingKey}`,
-                        });
-                      }}
-                    >
-                      <FormattedMessage
-                        id="xpack.lens.indexPattern.useFieldExistenceSampling.advancedSettings"
-                        defaultMessage="Advanced Settings"
-                      />
-                    </EuiLink>
-                  ),
-                }}
-              />
-            }
-          />
-        );
-      }
 
-      return deprecatedMessages;
-    },
     checkIntegrity: (state, indexPatterns) => {
       const ids = Object.values(state.layers || {}).map(({ indexPatternId }) => indexPatternId);
       return ids.filter((id) => !indexPatterns[id]);
@@ -1024,3 +978,125 @@ function blankLayer(indexPatternId: string, linkToLayers?: string[]): FormBasedL
     sampling: 1,
   };
 }
+
+function getLayerErrorMessages(
+  state: FormBasedPrivateState,
+  frameDatasourceAPI: FrameDatasourceAPI,
+  setState: StateSetter<FormBasedPrivateState, unknown>,
+  core: CoreStart,
+  data: DataPublicPluginStart
+) {
+  const indexPatterns = frameDatasourceAPI.dataViews.indexPatterns;
+
+  const layerErrors: UserMessage[][] = Object.entries(state.layers)
+    .filter(([_, layer]) => !!indexPatterns[layer.indexPatternId])
+    .map(([layerId, layer]) =>
+      (
+        getErrorMessages(layer, indexPatterns[layer.indexPatternId], state, layerId, core, data) ??
+        []
+      ).map((error) => {
+        const message: UserMessage = {
+          severity: 'error',
+          fixableInEditor: true,
+          displayLocations: [{ id: 'visualization' }],
+          shortMessage: '',
+          longMessage:
+            typeof error === 'string' ? (
+              error
+            ) : (
+              <>
+                {error.message}
+                {error.fixAction && (
+                  <EuiButton
+                    data-test-subj="errorFixAction"
+                    onClick={async () => {
+                      const newState = await error.fixAction?.newState(frameDatasourceAPI);
+                      if (newState) {
+                        setState(newState);
+                      }
+                    }}
+                  >
+                    {error.fixAction?.label}
+                  </EuiButton>
+                )}
+              </>
+            ),
+        };
+
+        return message;
+      })
+    );
+
+  let errorMessages: UserMessage[];
+  if (layerErrors.length <= 1) {
+    // Single layer case, no need to explain more
+    errorMessages = layerErrors[0]?.length ? layerErrors[0] : [];
+  } else {
+    // For multiple layers we will prepend each error with the layer number
+    errorMessages = layerErrors.flatMap((errors, index) => {
+      return errors.map((error) => {
+        const message: UserMessage = {
+          ...error,
+          shortMessage: i18n.translate('xpack.lens.indexPattern.layerErrorWrapper', {
+            defaultMessage: 'Layer {position} error: {wrappedMessage}',
+            values: {
+              position: index + 1,
+              wrappedMessage: error.shortMessage,
+            },
+          }),
+          longMessage: (
+            <FormattedMessage
+              id="xpack.lens.indexPattern.layerErrorWrapper"
+              defaultMessage="Layer {position} error: {wrappedMessage}"
+              values={{
+                position: index + 1,
+                wrappedMessage: <>{error.longMessage}</>,
+              }}
+            />
+          ),
+        };
+
+        return message;
+      });
+    });
+  }
+
+  return errorMessages;
+}
+
+function getDimensionErrorMessages(
+  state: FormBasedPrivateState,
+  isValidColumn: (layerId: string, columnId: string) => boolean
+) {
+  // generate messages for invalid columns
+  const columnErrorMessages: UserMessage[] = Object.keys(state.layers)
+    .map((layerId) => {
+      const messages: UserMessage[] = [];
+      for (const columnId of Object.keys(state.layers[layerId].columns)) {
+        if (!isValidColumn(layerId, columnId)) {
+          messages.push({
+            severity: 'error',
+            displayLocations: [{ id: 'dimensionTrigger', dimensionId: columnId }],
+            fixableInEditor: true,
+            shortMessage: '',
+            longMessage: (
+              <p>
+                {i18n.translate('xpack.lens.configure.invalidConfigTooltip', {
+                  defaultMessage: 'Invalid configuration.',
+                })}
+                <br />
+                {i18n.translate('xpack.lens.configure.invalidConfigTooltipClick', {
+                  defaultMessage: 'Click for more details.',
+                })}
+              </p>
+            ),
+          });
+        }
+      }
+
+      return messages;
+    })
+    .flat();
+
+  return columnErrorMessages;
+}
diff --git a/x-pack/plugins/lens/public/datasources/form_based/utils.tsx b/x-pack/plugins/lens/public/datasources/form_based/utils.tsx
index dee8dd71592ced..e8d98516ec8a1f 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/utils.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/utils.tsx
@@ -8,10 +8,10 @@
 import React from 'react';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
-import type { DocLinksStart, ThemeServiceStart } from '@kbn/core/public';
+import type { CoreStart, DocLinksStart, ThemeServiceStart } from '@kbn/core/public';
 import type { DatatableUtilitiesService } from '@kbn/data-plugin/common';
 import { TimeRange } from '@kbn/es-query';
-import { EuiLink, EuiSpacer, EuiText } from '@elastic/eui';
+import { EuiCallOut, EuiLink, EuiSpacer, EuiText } from '@elastic/eui';
 
 import type { DatatableColumn } from '@kbn/expressions-plugin/common';
 import { groupBy, escape, uniq } from 'lodash';
@@ -26,7 +26,7 @@ import {
 
 import { estypes } from '@elastic/elasticsearch';
 import type { DateRange } from '../../../common/types';
-import type { FramePublicAPI, IndexPattern, StateSetter } from '../../types';
+import type { FramePublicAPI, IndexPattern, StateSetter, UserMessage } from '../../types';
 import { renewIDs } from '../../utils';
 import type { FormBasedLayer, FormBasedPersistedState, FormBasedPrivateState } from './types';
 import type { ReferenceBasedIndexPatternColumn } from './operations/definitions/column_types';
@@ -186,7 +186,7 @@ export function getShardFailuresWarningMessages(
   request: SearchRequest,
   response: estypes.SearchResponse,
   theme: ThemeServiceStart
-): Array<string | React.ReactNode> {
+): UserMessage[] {
   if (state) {
     if (warning.type === 'shard_failure') {
       switch (warning.reason.type) {
@@ -205,38 +205,55 @@ export function getShardFailuresWarningMessages(
                   ].includes(col.operationType)
                 )
                 .map((col) => col.label)
-            ).map((label) =>
-              i18n.translate('xpack.lens.indexPattern.tsdbRollupWarning', {
-                defaultMessage:
-                  '{label} uses a function that is unsupported by rolled up data. Select a different function or change the time range.',
-                values: {
-                  label,
-                },
-              })
+            ).map(
+              (label) =>
+                ({
+                  uniqueId: `unsupported_aggregation_on_downsampled_index--${label}`,
+                  severity: 'warning',
+                  fixableInEditor: true,
+                  displayLocations: [{ id: 'toolbar' }, { id: 'embeddableBadge' }],
+                  shortMessage: '',
+                  longMessage: i18n.translate('xpack.lens.indexPattern.tsdbRollupWarning', {
+                    defaultMessage:
+                      '{label} uses a function that is unsupported by rolled up data. Select a different function or change the time range.',
+                    values: {
+                      label,
+                    },
+                  }),
+                } as UserMessage)
             )
           );
         default:
           return [
-            <>
-              <EuiText size="s">
-                <strong>{warning.message}</strong>
-                <p>{warning.text}</p>
-              </EuiText>
-              <EuiSpacer size="s" />
-              {warning.text ? (
-                <ShardFailureOpenModalButton
-                  theme={theme}
-                  title={warning.message}
-                  size="m"
-                  getRequestMeta={() => ({
-                    request: request as ShardFailureRequest,
-                    response,
-                  })}
-                  color="primary"
-                  isButtonEmpty={true}
-                />
-              ) : null}
-            </>,
+            {
+              uniqueId: `shard_failure`,
+              severity: 'warning',
+              fixableInEditor: true,
+              displayLocations: [{ id: 'toolbar' }, { id: 'embeddableBadge' }],
+              shortMessage: '',
+              longMessage: (
+                <>
+                  <EuiText size="s">
+                    <strong>{warning.message}</strong>
+                    <p>{warning.text}</p>
+                  </EuiText>
+                  <EuiSpacer size="s" />
+                  {warning.text ? (
+                    <ShardFailureOpenModalButton
+                      theme={theme}
+                      title={warning.message}
+                      size="m"
+                      getRequestMeta={() => ({
+                        request: request as ShardFailureRequest,
+                        response,
+                      })}
+                      color="primary"
+                      isButtonEmpty={true}
+                    />
+                  ) : null}
+                </>
+              ),
+            } as UserMessage,
           ];
       }
     }
@@ -376,6 +393,52 @@ export function getPrecisionErrorWarningMessages(
   return warningMessages;
 }
 
+export function getDeprecatedSamplingWarningMessage(core: CoreStart): UserMessage[] {
+  const useFieldExistenceSamplingKey = 'lens:useFieldExistenceSampling';
+  const isUsingSampling = core.uiSettings.get(useFieldExistenceSamplingKey);
+
+  return isUsingSampling
+    ? [
+        {
+          severity: 'warning',
+          fixableInEditor: false,
+          displayLocations: [{ id: 'banner' }],
+          shortMessage: '',
+          longMessage: (
+            <EuiCallOut
+              color="warning"
+              iconType="alert"
+              size="s"
+              title={
+                <FormattedMessage
+                  id="xpack.lens.indexPattern.useFieldExistenceSamplingBody"
+                  defaultMessage="Field existence sampling has been deprecated and will be removed in Kibana {version}. You may disable this feature in {link}."
+                  values={{
+                    version: '8.6.0',
+                    link: (
+                      <EuiLink
+                        onClick={() => {
+                          core.application.navigateToApp('management', {
+                            path: `/kibana/settings?query=${useFieldExistenceSamplingKey}`,
+                          });
+                        }}
+                      >
+                        <FormattedMessage
+                          id="xpack.lens.indexPattern.useFieldExistenceSampling.advancedSettings"
+                          defaultMessage="Advanced Settings"
+                        />
+                      </EuiLink>
+                    ),
+                  }}
+                />
+              }
+            />
+          ),
+        },
+      ]
+    : [];
+}
+
 export function getVisualDefaultsForLayer(layer: FormBasedLayer) {
   return Object.keys(layer.columns).reduce<Record<string, Record<string, unknown>>>(
     (memo, columnId) => {
diff --git a/x-pack/plugins/lens/public/datasources/text_based/text_based_languages.test.ts b/x-pack/plugins/lens/public/datasources/text_based/text_based_languages.test.ts
index 7c79fc16d2b6bf..60edc6e613451b 100644
--- a/x-pack/plugins/lens/public/datasources/text_based/text_based_languages.test.ts
+++ b/x-pack/plugins/lens/public/datasources/text_based/text_based_languages.test.ts
@@ -13,7 +13,7 @@ import { dataPluginMock } from '@kbn/data-plugin/public/mocks';
 import { dataViewPluginMocks } from '@kbn/data-views-plugin/public/mocks';
 import { getTextBasedDatasource } from './text_based_languages';
 import { generateId } from '../../id_generator';
-import { DatasourcePublicAPI, Datasource } from '../../types';
+import { DatasourcePublicAPI, Datasource, FrameDatasourceAPI } from '../../types';
 
 jest.mock('../../id_generator');
 
@@ -496,8 +496,8 @@ describe('Textbased Data Source', () => {
     });
   });
 
-  describe('#getErrorMessages', () => {
-    it('should use the results of getErrorMessages directly when single layer', () => {
+  describe('#getUserMessages', () => {
+    it('should use the results of getUserMessages directly when single layer', () => {
       const state = {
         layers: {
           a: {
@@ -539,10 +539,43 @@ describe('Textbased Data Source', () => {
           },
         },
       } as unknown as TextBasedPrivateState;
-      expect(TextBasedDatasource.getErrorMessages(state, indexPatterns)).toEqual([
-        { longMessage: 'error 1', shortMessage: 'error 1' },
-        { longMessage: 'error 2', shortMessage: 'error 2' },
-      ]);
+      expect(
+        TextBasedDatasource.getUserMessages(state, {
+          frame: { dataViews: indexPatterns } as unknown as FrameDatasourceAPI,
+          setState: () => {},
+        })
+      ).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "displayLocations": Array [
+              Object {
+                "id": "visualization",
+              },
+              Object {
+                "id": "textBasedLanguagesQueryInput",
+              },
+            ],
+            "fixableInEditor": true,
+            "longMessage": "error 1",
+            "severity": "error",
+            "shortMessage": "error 1",
+          },
+          Object {
+            "displayLocations": Array [
+              Object {
+                "id": "visualization",
+              },
+              Object {
+                "id": "textBasedLanguagesQueryInput",
+              },
+            ],
+            "fixableInEditor": true,
+            "longMessage": "error 2",
+            "severity": "error",
+            "shortMessage": "error 2",
+          },
+        ]
+      `);
     });
   });
 
diff --git a/x-pack/plugins/lens/public/datasources/text_based/text_based_languages.tsx b/x-pack/plugins/lens/public/datasources/text_based/text_based_languages.tsx
index f422aa4a0ea64c..9912fa866245f2 100644
--- a/x-pack/plugins/lens/public/datasources/text_based/text_based_languages.tsx
+++ b/x-pack/plugins/lens/public/datasources/text_based/text_based_languages.tsx
@@ -28,6 +28,7 @@ import {
   TableChangeType,
   DatasourceDimensionTriggerProps,
   DataSourceInfo,
+  UserMessage,
 } from '../../types';
 import { generateId } from '../../id_generator';
 import { toExpression } from './to_expression';
@@ -164,7 +165,7 @@ export function getTextBasedDatasource({
     checkIntegrity: () => {
       return [];
     },
-    getErrorMessages: (state) => {
+    getUserMessages: (state) => {
       const errors: Error[] = [];
 
       Object.values(state.layers).forEach((layer) => {
@@ -173,22 +174,16 @@ export function getTextBasedDatasource({
         }
       });
       return errors.map((err) => {
-        return {
+        const message: UserMessage = {
+          severity: 'error',
+          fixableInEditor: true,
+          displayLocations: [{ id: 'visualization' }, { id: 'textBasedLanguagesQueryInput' }],
           shortMessage: err.message,
           longMessage: err.message,
         };
+        return message;
       });
     },
-    getUnifiedSearchErrors: (state) => {
-      const errors: Error[] = [];
-
-      Object.values(state.layers).forEach((layer) => {
-        if (layer.errors && layer.errors.length > 0) {
-          errors.push(...layer.errors);
-        }
-      });
-      return errors;
-    },
     initialize(
       state?: TextBasedPersistedState,
       savedObjectReferences?,
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/buttons/dimension_button.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/buttons/dimension_button.tsx
index 508148be8b2a9c..c4b4f8c37dc8a6 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/buttons/dimension_button.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/buttons/dimension_button.tsx
@@ -43,7 +43,7 @@ export function DimensionButton({
         onClick={() => onClick(accessorConfig.columnId)}
         aria-label={triggerLinkA11yText(label)}
         title={triggerLinkA11yText(label)}
-        color={invalid || group.invalid ? 'danger' : undefined}
+        color={invalid ? 'danger' : undefined}
       >
         <ColorIndicator accessorConfig={accessorConfig}>{children}</ColorIndicator>
       </EuiLink>
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.test.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.test.tsx
index af63826c1e71da..7f509c9f921b4b 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.test.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/config_panel.test.tsx
@@ -135,6 +135,7 @@ describe('ConfigPanel', () => {
       isFullscreen: false,
       toggleFullscreen: jest.fn(),
       uiActions,
+      getUserMessages: () => [],
     };
   }
 
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.test.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.test.tsx
index f1d5ea36bd1996..e2bb44a61e68e9 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.test.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.test.tsx
@@ -113,6 +113,7 @@ describe('LayerPanel', () => {
       onEmptyDimensionAdd: jest.fn(),
       onChangeIndexPattern: jest.fn(),
       indexPatternService: createIndexPatternServiceMock(),
+      getUserMessages: () => [],
     };
   }
 
@@ -1363,5 +1364,7 @@ describe('LayerPanel', () => {
       expect(mockDatasource.renderDimensionTrigger).not.toHaveBeenCalled();
       expect(mockVisualization.renderDimensionTrigger).toHaveBeenCalled();
     });
+
+    // TODO - test user message display
   });
 });
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx
index 03aed23f952378..fa55e9f5dfb213 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/layer_panel.tsx
@@ -32,6 +32,7 @@ import {
   isOperation,
   LayerAction,
   VisualizationDimensionGroupConfig,
+  UserMessagesGetter,
 } from '../../../types';
 import { DragDropIdentifier, ReorderProvider } from '../../../drag_drop';
 import { LayerSettings } from './layer_settings';
@@ -91,6 +92,7 @@ export function LayerPanel(
       visualizationId?: string;
     }) => void;
     indexPatternService: IndexPatternServiceAPI;
+    getUserMessages: UserMessagesGetter;
   }
 ) {
   const [activeDimension, setActiveDimension] = useState<ActiveDimensionState>(
@@ -509,6 +511,18 @@ export function LayerPanel(
                     <ReorderProvider id={group.groupId} className={'lnsLayerPanel__group'}>
                       {group.accessors.map((accessorConfig, accessorIndex) => {
                         const { columnId } = accessorConfig;
+
+                        const messages = props.getUserMessages('dimensionTrigger', {
+                          // TODO - support warnings
+                          severity: 'error',
+                          dimensionId: columnId,
+                        });
+
+                        const hasMessages = Boolean(messages.length);
+                        const messageToDisplay = hasMessages
+                          ? messages[0].shortMessage || messages[0].longMessage
+                          : undefined;
+
                         return (
                           <DraggableDimensionButton
                             activeVisualization={activeVisualization}
@@ -580,8 +594,8 @@ export function LayerPanel(
                                       groupId: group.groupId,
                                       filterOperations: group.filterOperations,
                                       hideTooltip,
-                                      invalid: group.invalid,
-                                      invalidMessage: group.invalidMessage,
+                                      invalid: hasMessages,
+                                      invalidMessage: messageToDisplay,
                                       indexPatterns: dataViews.indexPatterns,
                                     }}
                                   />
@@ -591,13 +605,8 @@ export function LayerPanel(
                                       columnId,
                                       label: columnLabelMap?.[columnId] ?? '',
                                       hideTooltip,
-                                      ...(activeVisualization?.validateColumn?.(
-                                        visualizationState,
-                                        { dataViews },
-                                        layerId,
-                                        columnId,
-                                        group
-                                      ) || { invalid: false }),
+                                      invalid: hasMessages,
+                                      invalidMessage: messageToDisplay,
                                     })}
                                   </>
                                 )}
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/types.ts b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/types.ts
index c4a2d77c30baba..ca47938710b11a 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/types.ts
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/config_panel/types.ts
@@ -15,6 +15,7 @@ import {
   VisualizationDimensionGroupConfig,
   DatasourceMap,
   VisualizationMap,
+  UserMessagesGetter,
 } from '../../../types';
 export interface ConfigPanelWrapperProps {
   framePublicAPI: FramePublicAPI;
@@ -23,6 +24,7 @@ export interface ConfigPanelWrapperProps {
   core: DatasourceDimensionEditorProps['core'];
   indexPatternService: IndexPatternServiceAPI;
   uiActions: UiActionsStart;
+  getUserMessages: UserMessagesGetter;
 }
 
 export interface LayerPanelProps {
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.test.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.test.tsx
index 2530b8e215ddb6..e414525f18dd9e 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.test.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.test.tsx
@@ -99,6 +99,8 @@ function getDefaultProps() {
     lensInspector: getLensInspectorService(inspectorPluginMock.createStartContract()),
     showNoDataPopover: jest.fn(),
     indexPatternService: createIndexPatternServiceMock(),
+    getUserMessages: () => [],
+    addUserMessages: () => () => {},
   };
   return defaultProps;
 }
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.tsx
index 4100e25da76670..a593165a224f85 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/editor_frame.tsx
@@ -5,11 +5,18 @@
  * 2.0.
  */
 
-import React, { useCallback, useRef, useMemo } from 'react';
+import React, { useCallback, useRef } from 'react';
 import { CoreStart } from '@kbn/core/public';
 import { ReactExpressionRendererType } from '@kbn/expressions-plugin/public';
 import { trackUiCounterEvents } from '../../lens_ui_telemetry';
-import { DatasourceMap, FramePublicAPI, VisualizationMap, Suggestion } from '../../types';
+import {
+  DatasourceMap,
+  FramePublicAPI,
+  VisualizationMap,
+  Suggestion,
+  UserMessagesGetter,
+  AddUserMessages,
+} from '../../types';
 import { DataPanelWrapper } from './data_panel_wrapper';
 import { BannerWrapper } from './banner_wrapper';
 import { ConfigPanelWrapper } from './config_panel';
@@ -41,6 +48,8 @@ export interface EditorFrameProps {
   showNoDataPopover: () => void;
   lensInspector: LensInspector;
   indexPatternService: IndexPatternServiceAPI;
+  getUserMessages: UserMessagesGetter;
+  addUserMessages: AddUserMessages;
 }
 
 export function EditorFrame(props: EditorFrameProps) {
@@ -96,21 +105,15 @@ export function EditorFrame(props: EditorFrameProps) {
     showMemoizedErrorNotification(error);
   }, []);
 
-  const bannerMessages: React.ReactNode[] | undefined = useMemo(() => {
-    if (activeDatasourceId) {
-      return datasourceMap[activeDatasourceId].getDeprecationMessages?.(
-        datasourceStates[activeDatasourceId].state
-      );
-    }
-  }, [activeDatasourceId, datasourceMap, datasourceStates]);
+  const bannerMessages = props.getUserMessages('banner', { severity: 'warning' });
 
   return (
     <RootDragDropProvider>
       <FrameLayout
         bannerMessages={
-          bannerMessages ? (
+          bannerMessages.length ? (
             <ErrorBoundary onError={onError}>
-              <BannerWrapper nodes={bannerMessages} />
+              <BannerWrapper nodes={bannerMessages.map(({ longMessage }) => longMessage)} />
             </ErrorBoundary>
           ) : undefined
         }
@@ -139,6 +142,7 @@ export function EditorFrame(props: EditorFrameProps) {
                 framePublicAPI={framePublicAPI}
                 uiActions={props.plugins.uiActions}
                 indexPatternService={props.indexPatternService}
+                getUserMessages={props.getUserMessages}
               />
             </ErrorBoundary>
           )
@@ -156,6 +160,8 @@ export function EditorFrame(props: EditorFrameProps) {
                 visualizationMap={visualizationMap}
                 framePublicAPI={framePublicAPI}
                 getSuggestionForField={getSuggestionForField.current}
+                getUserMessages={props.getUserMessages}
+                addUserMessages={props.addUserMessages}
               />
             </ErrorBoundary>
           )
@@ -169,6 +175,7 @@ export function EditorFrame(props: EditorFrameProps) {
                 datasourceMap={datasourceMap}
                 visualizationMap={visualizationMap}
                 frame={framePublicAPI}
+                getUserMessages={props.getUserMessages}
               />
             </ErrorBoundary>
           )
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/state_helpers.ts b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/state_helpers.ts
index 9f53e4822e2395..4cda8d1c7c0bde 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/state_helpers.ts
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/state_helpers.ts
@@ -18,26 +18,16 @@ import {
   Datasource,
   DatasourceLayers,
   DatasourceMap,
-  FramePublicAPI,
   IndexPattern,
   IndexPatternMap,
   IndexPatternRef,
   InitializationOptions,
-  Visualization,
   VisualizationMap,
   VisualizeEditorContext,
 } from '../../types';
 import { buildExpression } from './expression_helpers';
-import { showMemoizedErrorNotification } from '../../lens_ui_errors';
 import { Document } from '../../persistence/saved_object_store';
 import { getActiveDatasourceIdFromDoc, sortDataViewRefs } from '../../utils';
-import type { ErrorMessage } from '../types';
-import {
-  getMissingCurrentDatasource,
-  getMissingIndexPatterns,
-  getMissingVisualizationTypeError,
-  getUnknownVisualizationTypeError,
-} from '../error_helper';
 import type { DatasourceStates, DataViewsState, VisualizationState } from '../../state_management';
 import { readFromStorage } from '../../settings_storage';
 import { loadIndexPatternRefs, loadIndexPatterns } from '../../data_views_service/loader';
@@ -325,7 +315,11 @@ export async function persistedStateToExpression(
     dataViews: DataViewsContract;
     timefilter: TimefilterContract;
   }
-): Promise<{ ast: Ast | null; errors: ErrorMessage[] | undefined }> {
+): Promise<{
+  ast: Ast | null;
+  indexPatterns: IndexPatternMap;
+  indexPatternRefs: IndexPatternRef[];
+}> {
   const {
     state: {
       visualization: persistedVisualizationState,
@@ -339,16 +333,7 @@ export async function persistedStateToExpression(
     description,
   } = doc;
   if (!visualizationType) {
-    return {
-      ast: null,
-      errors: [{ shortMessage: '', longMessage: getMissingVisualizationTypeError() }],
-    };
-  }
-  if (!visualizations[visualizationType]) {
-    return {
-      ast: null,
-      errors: [getUnknownVisualizationTypeError(visualizationType)],
-    };
+    return { ast: null, indexPatterns: {}, indexPatternRefs: [] };
   }
   const visualization = visualizations[visualizationType!];
   const visualizationState = initializeVisualization({
@@ -391,30 +376,11 @@ export async function persistedStateToExpression(
   if (datasourceId == null) {
     return {
       ast: null,
-      errors: [{ shortMessage: '', longMessage: getMissingCurrentDatasource() }],
-    };
-  }
-
-  const indexPatternValidation = validateRequiredIndexPatterns(
-    datasourceMap[datasourceId],
-    datasourceStates[datasourceId],
-    indexPatterns
-  );
-
-  if (indexPatternValidation) {
-    return {
-      ast: null,
-      errors: indexPatternValidation,
+      indexPatterns,
+      indexPatternRefs,
     };
   }
 
-  const validationResult = validateDatasourceAndVisualization(
-    datasourceMap[datasourceId],
-    datasourceStates[datasourceId].state,
-    visualization,
-    visualizationState,
-    { datasourceLayers, dataViews: { indexPatterns } as DataViewsState }
-  );
   const currentTimeRange = services.timefilter.getAbsoluteTime();
 
   return {
@@ -429,7 +395,8 @@ export async function persistedStateToExpression(
       indexPatterns,
       dateRange: { fromDate: currentTimeRange.from, toDate: currentTimeRange.to },
     }),
-    errors: validationResult,
+    indexPatterns,
+    indexPatternRefs,
   };
 }
 
@@ -438,7 +405,7 @@ export function getMissingIndexPattern(
   currentDatasourceState: { state: unknown } | null,
   indexPatterns: IndexPatternMap
 ) {
-  if (currentDatasourceState == null || currentDatasource == null) {
+  if (currentDatasourceState?.state == null || currentDatasource == null) {
     return [];
   }
   const missingIds = currentDatasource.checkIntegrity(currentDatasourceState.state, indexPatterns);
@@ -447,55 +414,3 @@ export function getMissingIndexPattern(
   }
   return missingIds;
 }
-
-const validateRequiredIndexPatterns = (
-  currentDatasource: Datasource,
-  currentDatasourceState: { state: unknown } | null,
-  indexPatterns: IndexPatternMap
-): ErrorMessage[] | undefined => {
-  const missingIds = getMissingIndexPattern(
-    currentDatasource,
-    currentDatasourceState,
-    indexPatterns
-  );
-
-  if (!missingIds.length) {
-    return;
-  }
-
-  return [{ shortMessage: '', longMessage: getMissingIndexPatterns(missingIds), type: 'fixable' }];
-};
-
-export const validateDatasourceAndVisualization = (
-  currentDataSource: Datasource | null,
-  currentDatasourceState: unknown | null,
-  currentVisualization: Visualization | null,
-  currentVisualizationState: unknown | undefined,
-  frame: Pick<FramePublicAPI, 'datasourceLayers' | 'dataViews'>
-): ErrorMessage[] | undefined => {
-  try {
-    const datasourceValidationErrors = currentDatasourceState
-      ? currentDataSource?.getErrorMessages(currentDatasourceState, frame.dataViews.indexPatterns)
-      : undefined;
-
-    const visualizationValidationErrors = currentVisualizationState
-      ? currentVisualization?.getErrorMessages(currentVisualizationState, frame)
-      : undefined;
-
-    if (datasourceValidationErrors?.length || visualizationValidationErrors?.length) {
-      return [...(datasourceValidationErrors || []), ...(visualizationValidationErrors || [])];
-    }
-  } catch (e) {
-    showMemoizedErrorNotification(e);
-    if (e.message) {
-      return [
-        {
-          shortMessage: e.message,
-          longMessage: e.message,
-          type: 'critical',
-        },
-      ];
-    }
-  }
-  return undefined;
-};
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.test.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.test.tsx
index 7f0034ad733664..84a6b9d6134cc0 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.test.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.test.tsx
@@ -104,6 +104,7 @@ describe('suggestion_panel', () => {
       },
       ExpressionRenderer: expressionRendererMock,
       frame: createMockFramePublicAPI(),
+      getUserMessages: () => [],
     };
   });
 
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx
index 0e2cf398ab7287..6190c1c9d66153 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/suggestion_panel.tsx
@@ -38,15 +38,13 @@ import {
   DatasourceMap,
   VisualizationMap,
   DatasourceLayers,
+  UserMessagesGetter,
+  FrameDatasourceAPI,
 } from '../../types';
 import { getSuggestions, switchToSuggestion } from './suggestion_helpers';
 import { getDatasourceExpressionsByLayers } from './expression_helpers';
 import { showMemoizedErrorNotification } from '../../lens_ui_errors/memoized_error_notification';
-import {
-  getMissingIndexPattern,
-  validateDatasourceAndVisualization,
-  getDatasourceLayers,
-} from './state_helpers';
+import { getMissingIndexPattern } from './state_helpers';
 import {
   rollbackSuggestion,
   selectExecutionContextSearch,
@@ -63,16 +61,45 @@ import {
   selectChangesApplied,
   applyChanges,
   selectStagedActiveData,
+  selectFrameDatasourceAPI,
 } from '../../state_management';
+import { filterUserMessages } from '../../app_plugin/get_application_user_messages';
 
 const MAX_SUGGESTIONS_DISPLAYED = 5;
 const LOCAL_STORAGE_SUGGESTIONS_PANEL = 'LENS_SUGGESTIONS_PANEL_HIDDEN';
 
+const configurationsValid = (
+  currentDataSource: Datasource | null,
+  currentDatasourceState: unknown,
+  currentVisualization: Visualization,
+  currentVisualizationState: unknown,
+  frame: FrameDatasourceAPI
+): boolean => {
+  try {
+    return (
+      filterUserMessages(
+        [
+          ...(currentDataSource?.getUserMessages?.(currentDatasourceState, {
+            frame,
+            setState: () => {},
+          }) ?? []),
+          ...(currentVisualization?.getUserMessages?.(currentVisualizationState, { frame }) ?? []),
+        ],
+        undefined,
+        { severity: 'error' }
+      ).length === 0
+    );
+  } catch (e) {
+    return false;
+  }
+};
+
 export interface SuggestionPanelProps {
   datasourceMap: DatasourceMap;
   visualizationMap: VisualizationMap;
   ExpressionRenderer: ReactExpressionRendererType;
   frame: FramePublicAPI;
+  getUserMessages: UserMessagesGetter;
 }
 
 const PreviewRenderer = ({
@@ -189,6 +216,7 @@ export function SuggestionPanel({
   visualizationMap,
   frame,
   ExpressionRenderer: ExpressionRendererComponent,
+  getUserMessages,
 }: SuggestionPanelProps) {
   const dispatchLens = useLensDispatch();
   const activeDatasourceId = useLensSelector(selectActiveDatasourceId);
@@ -197,6 +225,10 @@ export function SuggestionPanel({
   const existsStagedPreview = useLensSelector((state) => Boolean(state.lens.stagedPreview));
   const currentVisualization = useLensSelector(selectCurrentVisualization);
   const currentDatasourceStates = useLensSelector(selectCurrentDatasourceStates);
+
+  const frameDatasourceAPI = useLensSelector((state) =>
+    selectFrameDatasourceAPI(state, datasourceMap)
+  );
   const changesApplied = useLensSelector(selectChangesApplied);
   // get user's selection from localStorage, this key defines if the suggestions panel will be hidden or not
   const [hideSuggestions, setHideSuggestions] = useLocalStorage(
@@ -237,28 +269,13 @@ export function SuggestionPanel({
             }) => {
               return (
                 !hide &&
-                validateDatasourceAndVisualization(
+                configurationsValid(
                   suggestionDatasourceId ? datasourceMap[suggestionDatasourceId] : null,
                   suggestionDatasourceState,
                   visualizationMap[visualizationId],
                   suggestionVisualizationState,
-                  {
-                    ...frame,
-                    dataViews: frame.dataViews,
-                    datasourceLayers: getDatasourceLayers(
-                      suggestionDatasourceId
-                        ? {
-                            [suggestionDatasourceId]: {
-                              isLoading: true,
-                              state: suggestionDatasourceState,
-                            },
-                          }
-                        : {},
-                      datasourceMap,
-                      frame.dataViews.indexPatterns
-                    ),
-                  }
-                ) == null
+                  frameDatasourceAPI
+                )
               );
             }
           )
@@ -274,16 +291,11 @@ export function SuggestionPanel({
             ),
           }));
 
-    const validationErrors = validateDatasourceAndVisualization(
-      activeDatasourceId ? datasourceMap[activeDatasourceId] : null,
-      activeDatasourceId && currentDatasourceStates[activeDatasourceId]?.state,
-      currentVisualization.activeId ? visualizationMap[currentVisualization.activeId] : null,
-      currentVisualization.state,
-      frame
-    );
+    const hasErrors =
+      getUserMessages(['visualization', 'visualizationInEditor'], { severity: 'error' }).length > 0;
 
     const newStateExpression =
-      currentVisualization.state && currentVisualization.activeId && !validationErrors
+      currentVisualization.state && currentVisualization.activeId && !hasErrors
         ? preparePreviewExpression(
             { visualizationState: currentVisualization.state },
             visualizationMap[currentVisualization.activeId],
@@ -296,7 +308,7 @@ export function SuggestionPanel({
     return {
       suggestions: newSuggestions,
       currentStateExpression: newStateExpression,
-      currentStateError: validationErrors,
+      currentStateError: hasErrors,
     };
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [
@@ -387,7 +399,7 @@ export function SuggestionPanel({
       {currentVisualization.activeId && !hideSuggestions && (
         <SuggestionPreview
           preview={{
-            error: currentStateError != null,
+            error: currentStateError,
             expression: currentStateExpression,
             icon:
               visualizationMap[currentVisualization.activeId].getDescription(
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/__snapshots__/workspace_panel.test.tsx.snap b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/__snapshots__/workspace_panel.test.tsx.snap
new file mode 100644
index 00000000000000..d797131423964a
--- /dev/null
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/__snapshots__/workspace_panel.test.tsx.snap
@@ -0,0 +1,33 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`workspace_panel should show an error message if the expression fails to parse 1`] = `
+Array [
+  Array [
+    Object {
+      "displayLocations": Array [
+        Object {
+          "id": "visualization",
+        },
+      ],
+      "fixableInEditor": true,
+      "longMessage": <React.Fragment>
+        <p
+          data-test-subj="expression-failure"
+        >
+          <FormattedMessage
+            defaultMessage="An error occurred in the expression"
+            id="xpack.lens.editorFrame.expressionFailure"
+            values={Object {}}
+          />
+        </p>
+        <p>
+          Error: Unable to parse expression: Expected "/*", "//", [ ,\\t,\\r,\\n], or function but "|" found.
+        </p>
+      </React.Fragment>,
+      "severity": "error",
+      "shortMessage": "An unexpected error occurred while preparing the chart",
+      "uniqueId": "expression_build_error",
+    },
+  ],
+]
+`;
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel.test.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel.test.tsx
index 257d6d78cff994..b876645319d3a3 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel.test.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel.test.tsx
@@ -8,7 +8,7 @@
 import React from 'react';
 import { act } from 'react-dom/test-utils';
 import { ReactExpressionRendererProps } from '@kbn/expressions-plugin/public';
-import { FramePublicAPI, Visualization } from '../../../types';
+import { FramePublicAPI, UserMessage, Visualization } from '../../../types';
 import {
   createMockVisualization,
   createMockDatasource,
@@ -61,6 +61,7 @@ function createCoreStartWithPermissions(newCapabilities = defaultPermissions) {
 
 const defaultProps = {
   datasourceMap: {},
+  visualizationMap: {},
   framePublicAPI: createMockFramePublicAPI(),
   ExpressionRenderer: createExpressionRendererMock(),
   core: createCoreStartWithPermissions(),
@@ -71,6 +72,8 @@ const defaultProps = {
   getSuggestionForField: () => undefined,
   lensInspector: getLensInspectorService(inspectorPluginMock.createStartContract()),
   toggleFullscreen: jest.fn(),
+  getUserMessages: () => [],
+  addUserMessages: () => () => {},
 };
 
 const toExpr = (
@@ -309,15 +312,6 @@ describe('workspace_panel', () => {
   });
 
   it('should base saveability on working changes when auto-apply disabled', async () => {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    mockVisualization.getErrorMessages.mockImplementation((currentVisualizationState: any) => {
-      if (currentVisualizationState.hasProblem) {
-        return [{ shortMessage: 'An error occurred', longMessage: 'An long description here' }];
-      } else {
-        return [];
-      }
-    });
-
     const framePublicAPI = createMockFramePublicAPI();
     framePublicAPI.datasourceLayers = {
       first: mockDatasource.publicAPIMock,
@@ -325,9 +319,12 @@ describe('workspace_panel', () => {
     mockDatasource.toExpression.mockReturnValue('datasource');
     mockDatasource.getLayers.mockReturnValue(['first']);
 
+    let userMessages: UserMessage[] = [];
+
     const mounted = await mountWithProvider(
       <WorkspacePanel
         {...defaultProps}
+        getUserMessages={() => userMessages}
         datasourceMap={{
           testDatasource: mockDatasource,
         }}
@@ -355,11 +352,24 @@ describe('workspace_panel', () => {
     `);
     expect(isSaveable()).toBe(true);
 
+    // note that populating the user messages and then dispatching a state update is true to
+    // how Lens interacts with the workspace panel from its perspective. all the panel does is call
+    // that getUserMessages function any time it gets re-rendered (aka state update)
+    userMessages = [
+      {
+        severity: 'error',
+        fixableInEditor: true,
+        displayLocations: [{ id: 'visualization' }],
+        shortMessage: 'hey there',
+        longMessage: "i'm another error",
+      },
+    ] as UserMessage[];
+
     act(() => {
       mounted.lensStore.dispatch(
         updateVisualizationState({
           visualizationId: 'testVis',
-          newState: { activeId: 'testVis', hasProblem: true },
+          newState: {},
         })
       );
     });
@@ -564,7 +574,6 @@ describe('workspace_panel', () => {
       type: 'lens/onActiveDataChange',
       payload: {
         activeData: tablesData,
-        requestWarnings: [],
       },
     });
   });
@@ -662,203 +671,25 @@ describe('workspace_panel', () => {
     expect(expressionRendererMock).toHaveBeenCalledTimes(3);
   });
 
-  it('should show an error message if there are missing indexpatterns in the visualization', async () => {
-    mockDatasource.getLayers.mockReturnValue(['first']);
-    mockDatasource.checkIntegrity.mockReturnValue(['a']);
-    const framePublicAPI = createMockFramePublicAPI();
-    framePublicAPI.datasourceLayers = {
-      first: mockDatasource.publicAPIMock,
-    };
-    const mounted = await mountWithProvider(
-      <WorkspacePanel
-        {...defaultProps}
-        datasourceMap={{
-          testDatasource: mockDatasource,
-        }}
-        framePublicAPI={framePublicAPI}
-        visualizationMap={{
-          testVis: { ...mockVisualization, toExpression: () => 'testVis' },
-        }}
-      />,
-
-      {
-        preloadedState: {
-          datasourceStates: {
-            testDatasource: {
-              // define a layer with an indexpattern not available
-              state: { layers: { indexPatternId: 'a' }, indexPatterns: {} },
-              isLoading: false,
-            },
-          },
-        },
-      }
-    );
-    instance = mounted.instance;
-
-    expect(instance.find('[data-test-subj="missing-refs-failure"]').exists()).toBeTruthy();
-    expect(instance.find(expressionRendererMock)).toHaveLength(0);
-  });
-
-  it('should not show the management action in case of missing indexpattern and no navigation permissions', async () => {
-    mockDatasource.getLayers.mockReturnValue(['first']);
-    const framePublicAPI = createMockFramePublicAPI();
-    framePublicAPI.datasourceLayers = {
-      first: mockDatasource.publicAPIMock,
-    };
-
-    const mounted = await mountWithProvider(
-      <WorkspacePanel
-        {...defaultProps}
-        datasourceMap={{
-          testDatasource: mockDatasource,
-        }}
-        framePublicAPI={framePublicAPI}
-        visualizationMap={{
-          testVis: { ...mockVisualization, toExpression: () => 'testVis' },
-        }}
-        // Use cannot navigate to the management page
-        core={createCoreStartWithPermissions({
-          navLinks: { management: false },
-          management: { kibana: { indexPatterns: true } },
-        })}
-      />,
-
+  it('should show configuration error messages if present', async () => {
+    const messages: UserMessage[] = [
       {
-        preloadedState: {
-          datasourceStates: {
-            testDatasource: {
-              // define a layer with an indexpattern not available
-              state: { layers: { indexPatternId: 'a' }, indexPatterns: {} },
-              isLoading: false,
-            },
-          },
-        },
-      }
-    );
-    instance = mounted.instance;
-
-    expect(
-      instance.find('[data-test-subj="configuration-failure-reconfigure-indexpatterns"]').exists()
-    ).toBeFalsy();
-  });
-
-  it('should not show the management action in case of missing indexpattern and no indexPattern specific permissions', async () => {
-    mockDatasource.getLayers.mockReturnValue(['first']);
-    const framePublicAPI = createMockFramePublicAPI();
-    framePublicAPI.datasourceLayers = {
-      first: mockDatasource.publicAPIMock,
-    };
-
-    const mounted = await mountWithProvider(
-      <WorkspacePanel
-        {...defaultProps}
-        datasourceMap={{
-          testDatasource: mockDatasource,
-        }}
-        framePublicAPI={framePublicAPI}
-        visualizationMap={{
-          testVis: { ...mockVisualization, toExpression: () => 'testVis' },
-        }}
-        // user can go to management, but indexPatterns management is not accessible
-        core={createCoreStartWithPermissions({
-          navLinks: { management: true },
-          management: { kibana: { indexPatterns: false } },
-        })}
-      />,
-
+        severity: 'error',
+        fixableInEditor: true,
+        displayLocations: [{ id: 'visualization' }],
+        shortMessage: 'hey there',
+        longMessage: "i'm an error",
+      },
       {
-        preloadedState: {
-          datasourceStates: {
-            testDatasource: {
-              // define a layer with an indexpattern not available
-              state: { layers: { indexPatternId: 'a' }, indexPatterns: {} },
-              isLoading: false,
-            },
-          },
-        },
-      }
-    );
-    instance = mounted.instance;
-
-    expect(
-      instance.find('[data-test-subj="configuration-failure-reconfigure-indexpatterns"]').exists()
-    ).toBeFalsy();
-  });
-
-  it('should show an error message if validation on datasource does not pass', async () => {
-    mockDatasource.getErrorMessages.mockReturnValue([
-      { shortMessage: 'An error occurred', longMessage: 'An long description here' },
-    ]);
-    mockDatasource.getLayers.mockReturnValue(['first']);
-    const framePublicAPI = createMockFramePublicAPI();
-    framePublicAPI.datasourceLayers = {
-      first: mockDatasource.publicAPIMock,
-    };
-
-    const mounted = await mountWithProvider(
-      <WorkspacePanel
-        {...defaultProps}
-        datasourceMap={{
-          testDatasource: mockDatasource,
-        }}
-        framePublicAPI={framePublicAPI}
-        visualizationMap={{
-          testVis: { ...mockVisualization, toExpression: () => 'testVis' },
-        }}
-      />
-    );
-    instance = mounted.instance;
-    act(() => {
-      instance.update();
-    });
-
-    expect(instance.find('[data-test-subj="configuration-failure"]').exists()).toBeTruthy();
-    expect(instance.find(expressionRendererMock)).toHaveLength(0);
-  });
-
-  it('should show an error message if validation on visualization does not pass', async () => {
-    mockDatasource.getErrorMessages.mockReturnValue(undefined);
-    mockDatasource.getLayers.mockReturnValue(['first']);
-    mockVisualization.getErrorMessages.mockReturnValue([
-      { shortMessage: 'Some error happened', longMessage: 'Some long description happened' },
-    ]);
-    mockVisualization.toExpression.mockReturnValue('testVis');
-    const framePublicAPI = createMockFramePublicAPI();
-    framePublicAPI.datasourceLayers = {
-      first: mockDatasource.publicAPIMock,
-    };
-
-    const mounted = await mountWithProvider(
-      <WorkspacePanel
-        {...defaultProps}
-        datasourceMap={{
-          testDatasource: mockDatasource,
-        }}
-        framePublicAPI={framePublicAPI}
-        visualizationMap={{
-          testVis: mockVisualization,
-        }}
-      />
-    );
-    instance = mounted.instance;
-
-    expect(instance.find('[data-test-subj="configuration-failure"]').exists()).toBeTruthy();
-    expect(instance.find(expressionRendererMock)).toHaveLength(0);
-  });
+        severity: 'error',
+        fixableInEditor: true,
+        displayLocations: [{ id: 'visualization' }],
+        shortMessage: 'hey there',
+        longMessage: "i'm another error",
+      },
+    ];
 
-  it('should show an error message if validation on both datasource and visualization do not pass', async () => {
-    mockDatasource.getErrorMessages.mockReturnValue([
-      { shortMessage: 'An error occurred', longMessage: 'An long description here' },
-    ]);
-    mockDatasource.getLayers.mockReturnValue(['first']);
-    mockVisualization.getErrorMessages.mockReturnValue([
-      { shortMessage: 'Some error happened', longMessage: 'Some long description happened' },
-    ]);
-    mockVisualization.toExpression.mockReturnValue('testVis');
-    const framePublicAPI = createMockFramePublicAPI();
-    framePublicAPI.datasourceLayers = {
-      first: mockDatasource.publicAPIMock,
-    };
+    const getUserMessages = jest.fn(() => messages);
 
     const mounted = await mountWithProvider(
       <WorkspacePanel
@@ -866,56 +697,35 @@ describe('workspace_panel', () => {
         datasourceMap={{
           testDatasource: mockDatasource,
         }}
-        framePublicAPI={framePublicAPI}
-        visualizationMap={{
-          testVis: mockVisualization,
-        }}
+        getUserMessages={getUserMessages}
       />
     );
     instance = mounted.instance;
 
     // EuiFlexItem duplicates internally the attribute, so we need to filter only the most inner one here
-    expect(
-      instance.find('[data-test-subj="configuration-failure-more-errors"]').last().text()
-    ).toEqual(' +1 error');
+    expect(instance.find('[data-test-subj="workspace-more-errors-button"]').last().text()).toEqual(
+      ' +1 error'
+    );
     expect(instance.find(expressionRendererMock)).toHaveLength(0);
+    expect(getUserMessages).toHaveBeenCalledWith(['visualization', 'visualizationInEditor'], {
+      severity: 'error',
+    });
   });
 
-  it('should NOT display errors for unapplied changes', async () => {
+  it('should NOT display config errors for unapplied changes', async () => {
     // this test is important since we don't want the workspace panel to
     // display errors if the user has disabled auto-apply, messed something up,
     // but not yet applied their changes
 
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    mockDatasource.getErrorMessages.mockImplementation((currentDatasourceState: any) => {
-      if (currentDatasourceState.hasProblem) {
-        return [{ shortMessage: 'An error occurred', longMessage: 'An long description here' }];
-      } else {
-        return [];
-      }
-    });
-    mockDatasource.getLayers.mockReturnValue(['first']);
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    mockVisualization.getErrorMessages.mockImplementation((currentVisualizationState: any) => {
-      if (currentVisualizationState.hasProblem) {
-        return [{ shortMessage: 'An error occurred', longMessage: 'An long description here' }];
-      } else {
-        return [];
-      }
-    });
-    mockVisualization.toExpression.mockReturnValue('testVis');
-    const framePublicAPI = createMockFramePublicAPI();
-    framePublicAPI.datasourceLayers = {
-      first: mockDatasource.publicAPIMock,
-    };
+    let userMessages = [] as UserMessage[];
 
     const mounted = await mountWithProvider(
       <WorkspacePanel
         {...defaultProps}
+        getUserMessages={() => userMessages}
         datasourceMap={{
           testDatasource: mockDatasource,
         }}
-        framePublicAPI={framePublicAPI}
         visualizationMap={{
           testVis: mockVisualization,
         }}
@@ -925,9 +735,7 @@ describe('workspace_panel', () => {
     instance = mounted.instance;
     const lensStore = mounted.lensStore;
 
-    const showingErrors = () =>
-      instance.exists('[data-test-subj="configuration-failure-error"]') ||
-      instance.exists('[data-test-subj="configuration-failure-more-errors"]');
+    const showingErrors = () => instance.exists('[data-test-subj="workspace-error-message"]');
 
     expect(showingErrors()).toBeFalsy();
 
@@ -939,27 +747,24 @@ describe('workspace_panel', () => {
     expect(showingErrors()).toBeFalsy();
 
     // introduce some issues
+    userMessages = [
+      {
+        severity: 'error',
+        fixableInEditor: true,
+        displayLocations: [{ id: 'visualization' }],
+        shortMessage: 'hey there',
+        longMessage: "i'm another error",
+      },
+    ] as UserMessage[];
+
     act(() => {
       lensStore.dispatch(
         updateDatasourceState({
           datasourceId: 'testDatasource',
-          updater: { hasProblem: true },
+          updater: {},
         })
       );
     });
-    instance.update();
-
-    expect(showingErrors()).toBeFalsy();
-
-    act(() => {
-      lensStore.dispatch(
-        updateVisualizationState({
-          visualizationId: 'testVis',
-          newState: { activeId: 'testVis', hasProblem: true },
-        })
-      );
-    });
-    instance.update();
 
     expect(showingErrors()).toBeFalsy();
 
@@ -970,6 +775,7 @@ describe('workspace_panel', () => {
     expect(showingErrors()).toBeTruthy();
   });
 
+  // TODO - test refresh after expression failure error
   it('should show an error message if the expression fails to parse', async () => {
     mockDatasource.toExpression.mockReturnValue('|||');
     mockDatasource.getLayers.mockReturnValue(['first']);
@@ -978,6 +784,10 @@ describe('workspace_panel', () => {
       first: mockDatasource.publicAPIMock,
     };
 
+    const mockRemoveUserMessages = jest.fn();
+    const mockAddUserMessages = jest.fn(() => mockRemoveUserMessages);
+    const mockGetUserMessages = jest.fn<UserMessage[], unknown[]>(() => []);
+
     const mounted = await mountWithProvider(
       <WorkspacePanel
         {...defaultProps}
@@ -988,11 +798,13 @@ describe('workspace_panel', () => {
         visualizationMap={{
           testVis: { ...mockVisualization, toExpression: () => 'testVis' },
         }}
+        addUserMessages={mockAddUserMessages}
+        getUserMessages={mockGetUserMessages}
       />
     );
     instance = mounted.instance;
 
-    expect(instance.find('[data-test-subj="expression-failure"]').exists()).toBeTruthy();
+    expect(mockAddUserMessages.mock.lastCall).toMatchSnapshot();
     expect(instance.find(expressionRendererMock)).toHaveLength(0);
   });
 
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel.tsx
index e5b4495b2a7a5d..165dba174b0ac6 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel.tsx
@@ -18,13 +18,11 @@ import {
   EuiText,
   EuiButtonEmpty,
   EuiLink,
-  EuiButton,
-  EuiSpacer,
   EuiTextColor,
+  EuiSpacer,
 } from '@elastic/eui';
 import type { CoreStart } from '@kbn/core/public';
 import type { DataPublicPluginStart, ExecutionContextSearch } from '@kbn/data-plugin/public';
-import { RedirectAppLinks } from '@kbn/shared-ux-link-redirect-app';
 import type {
   ExpressionRendererEvent,
   ExpressionRenderError,
@@ -44,9 +42,12 @@ import {
   isLensEditEvent,
   VisualizationMap,
   DatasourceMap,
-  DatasourceFixAction,
   Suggestion,
   DatasourceLayers,
+  UserMessage,
+  UserMessagesGetter,
+  AddUserMessages,
+  isMessageRemovable,
 } from '../../../types';
 import { DragDrop, DragContext, DragDropIdentifier } from '../../../drag_drop';
 import { switchToSuggestion } from '../suggestion_helpers';
@@ -54,16 +55,11 @@ import { buildExpression } from '../expression_helpers';
 import { WorkspacePanelWrapper } from './workspace_panel_wrapper';
 import applyChangesIllustrationDark from '../../../assets/render_dark@2x.png';
 import applyChangesIllustrationLight from '../../../assets/render_light@2x.png';
-import {
-  getOriginalRequestErrorMessages,
-  getUnknownVisualizationTypeError,
-} from '../../error_helper';
-import { getMissingIndexPattern, validateDatasourceAndVisualization } from '../state_helpers';
+import { getOriginalRequestErrorMessages } from '../../error_helper';
 import {
   onActiveDataChange,
   useLensDispatch,
   editVisualizationAction,
-  updateDatasourceState,
   setSaveable,
   useLensSelector,
   selectExecutionContext,
@@ -94,14 +90,11 @@ export interface WorkspacePanelProps {
   plugins: { uiActions?: UiActionsStart; data: DataPublicPluginStart };
   getSuggestionForField: (field: DragDropIdentifier) => Suggestion | undefined;
   lensInspector: LensInspector;
+  getUserMessages: UserMessagesGetter;
+  addUserMessages: AddUserMessages;
 }
 
 interface WorkspaceState {
-  expressionBuildError?: Array<{
-    shortMessage: string;
-    longMessage: React.ReactNode;
-    fixAction?: DatasourceFixAction<unknown>;
-  }>;
   expandError: boolean;
   expressionToRender: string | null | undefined;
 }
@@ -125,7 +118,8 @@ const executionContext: KibanaExecutionContext = {
   },
 };
 
-// Exported for testing purposes only.
+const EXPRESSION_BUILD_ERROR_ID = 'expression_build_error';
+
 export const WorkspacePanel = React.memo(function WorkspacePanel(props: WorkspacePanelProps) {
   const { getSuggestionForField, ...restProps } = props;
 
@@ -151,6 +145,8 @@ export const InnerWorkspacePanel = React.memo(function InnerWorkspacePanel({
   ExpressionRenderer: ExpressionRendererComponent,
   suggestionForDraggedField,
   lensInspector,
+  getUserMessages,
+  addUserMessages,
 }: Omit<WorkspacePanelProps, 'getSuggestionForField'> & {
   suggestionForDraggedField: Suggestion | undefined;
 }) {
@@ -166,12 +162,10 @@ export const InnerWorkspacePanel = React.memo(function InnerWorkspacePanel({
   const searchSessionId = useLensSelector(selectSearchSessionId);
 
   const [localState, setLocalState] = useState<WorkspaceState>({
-    expressionBuildError: undefined,
     expandError: false,
     expressionToRender: undefined,
   });
 
-  // const expressionToRender = useRef<null | undefined | string>();
   const initialRenderComplete = useRef<boolean>();
 
   const renderDeps = useRef<{
@@ -228,14 +222,17 @@ export const InnerWorkspacePanel = React.memo(function InnerWorkspacePanel({
     }
   }, []);
 
+  const removeSearchWarningMessagesRef = useRef<() => void>();
+  const removeExpressionBuildErrorsRef = useRef<() => void>();
+
   const onData$ = useCallback(
-    (data: unknown, adapters?: Partial<DefaultInspectorAdapters>) => {
+    (_data: unknown, adapters?: Partial<DefaultInspectorAdapters>) => {
       if (renderDeps.current) {
         const [defaultLayerId] = Object.keys(renderDeps.current.datasourceLayers);
         const datasource = Object.values(renderDeps.current.datasourceMap)[0];
         const datasourceState = Object.values(renderDeps.current.datasourceStates)[0].state;
 
-        let requestWarnings: Array<React.ReactNode | string> = [];
+        let requestWarnings: UserMessage[] = [];
 
         if (adapters?.requests) {
           requestWarnings = getSearchWarningMessages(
@@ -248,24 +245,31 @@ export const InnerWorkspacePanel = React.memo(function InnerWorkspacePanel({
           );
         }
 
-        dispatchLens(
-          onActiveDataChange({
-            activeData:
-              adapters && adapters.tables
-                ? Object.entries(adapters.tables?.tables).reduce<Record<string, Datatable>>(
-                    (acc, [key, value], index, tables) => ({
-                      ...acc,
-                      [tables.length === 1 ? defaultLayerId : key]: value,
-                    }),
-                    {}
-                  )
-                : undefined,
-            requestWarnings,
-          })
-        );
+        if (requestWarnings.length) {
+          removeSearchWarningMessagesRef.current = addUserMessages(
+            requestWarnings.filter(isMessageRemovable)
+          );
+        } else if (removeSearchWarningMessagesRef.current) {
+          removeSearchWarningMessagesRef.current();
+          removeSearchWarningMessagesRef.current = undefined;
+        }
+
+        if (adapters && adapters.tables) {
+          dispatchLens(
+            onActiveDataChange({
+              activeData: Object.entries(adapters.tables?.tables).reduce<Record<string, Datatable>>(
+                (acc, [key, value], _index, tables) => ({
+                  ...acc,
+                  [tables.length === 1 ? defaultLayerId : key]: value,
+                }),
+                {}
+              ),
+            })
+          );
+        }
       }
     },
-    [dispatchLens, plugins.data.search]
+    [addUserMessages, dispatchLens, plugins.data.search]
   );
 
   const shouldApplyExpression = autoApplyEnabled || !initialRenderComplete.current || triggerApply;
@@ -273,56 +277,15 @@ export const InnerWorkspacePanel = React.memo(function InnerWorkspacePanel({
     ? visualizationMap[visualization.activeId]
     : null;
 
-  const missingIndexPatterns = getMissingIndexPattern(
-    activeDatasourceId ? datasourceMap[activeDatasourceId] : null,
-    activeDatasourceId ? datasourceStates[activeDatasourceId] : null,
-    dataViews.indexPatterns
-  );
-
-  const missingRefsErrors = missingIndexPatterns.length
-    ? [
-        {
-          shortMessage: '',
-          longMessage: i18n.translate('xpack.lens.indexPattern.missingDataView', {
-            defaultMessage:
-              'The {count, plural, one {data view} other {data views}} ({count, plural, one {id} other {ids}}: {indexpatterns}) cannot be found',
-            values: {
-              count: missingIndexPatterns.length,
-              indexpatterns: missingIndexPatterns.join(', '),
-            },
-          }),
-        },
-      ]
-    : [];
-
-  const unknownVisError = visualization.activeId && !activeVisualization;
-
-  // Note: mind to all these eslint disable lines: the frameAPI will change too frequently
-  // and to prevent race conditions it is ok to leave them there.
-
-  const configurationValidationError = useMemo(
-    () =>
-      validateDatasourceAndVisualization(
-        activeDatasourceId ? datasourceMap[activeDatasourceId] : null,
-        activeDatasourceId && datasourceStates[activeDatasourceId]?.state,
-        activeVisualization,
-        visualization.state,
-        framePublicAPI
-      ),
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [
-      activeVisualization,
-      visualization.state,
-      activeDatasourceId,
-      datasourceMap,
-      datasourceStates,
-      framePublicAPI.dateRange,
-    ]
-  );
+  const workspaceErrors = getUserMessages(['visualization', 'visualizationInEditor'], {
+    severity: 'error',
+  });
 
   // if the expression is undefined, it means we hit an error that should be displayed to the user
   const unappliedExpression = useMemo(() => {
-    if (!configurationValidationError?.length && !missingRefsErrors.length && !unknownVisError) {
+    // shouldn't build expression if there is any type of error other than an expression build error
+    // (in which case we try again every time because the config might have changed)
+    if (workspaceErrors.every((error) => error.uniqueId === EXPRESSION_BUILD_ERROR_ID)) {
       try {
         const ast = buildExpression({
           visualization: activeVisualization,
@@ -344,39 +307,42 @@ export const InnerWorkspacePanel = React.memo(function InnerWorkspacePanel({
           return null;
         }
       } catch (e) {
-        const buildMessages = activeVisualization?.getErrorMessages(visualization.state);
-        const defaultMessage = {
-          shortMessage: i18n.translate('xpack.lens.editorFrame.buildExpressionError', {
-            defaultMessage: 'An unexpected error occurred while preparing the chart',
-          }),
-          longMessage: e.toString(),
-        };
-        // Most likely an error in the expression provided by a datasource or visualization
-        setLocalState((s) => ({
-          ...s,
-          expressionBuildError: buildMessages ?? [defaultMessage],
-        }));
+        removeExpressionBuildErrorsRef.current = addUserMessages([
+          {
+            uniqueId: EXPRESSION_BUILD_ERROR_ID,
+            severity: 'error',
+            fixableInEditor: true,
+            displayLocations: [{ id: 'visualization' }],
+            shortMessage: i18n.translate('xpack.lens.editorFrame.buildExpressionError', {
+              defaultMessage: 'An unexpected error occurred while preparing the chart',
+            }),
+            longMessage: (
+              <>
+                <p data-test-subj="expression-failure">
+                  <FormattedMessage
+                    id="xpack.lens.editorFrame.expressionFailure"
+                    defaultMessage="An error occurred in the expression"
+                  />
+                </p>
+
+                <p>{e.toString()}</p>
+              </>
+            ),
+          },
+        ]);
       }
     }
-    if (unknownVisError) {
-      setLocalState((s) => ({
-        ...s,
-        expressionBuildError: [getUnknownVisualizationTypeError(visualization.activeId!)],
-      }));
-    }
   }, [
-    configurationValidationError?.length,
-    missingRefsErrors.length,
-    unknownVisError,
+    workspaceErrors,
     activeVisualization,
     visualization.state,
-    visualization.activeId,
     datasourceMap,
     datasourceStates,
     datasourceLayers,
     dataViews.indexPatterns,
-    searchSessionId,
     framePublicAPI.dateRange,
+    searchSessionId,
+    addUserMessages,
   ]);
 
   useEffect(() => {
@@ -399,6 +365,15 @@ export const InnerWorkspacePanel = React.memo(function InnerWorkspacePanel({
   }, [unappliedExpression, shouldApplyExpression]);
 
   const expressionExists = Boolean(localState.expressionToRender);
+
+  useEffect(() => {
+    // reset expression error if component attempts to run it again
+    if (expressionExists && removeExpressionBuildErrorsRef.current) {
+      removeExpressionBuildErrorsRef.current();
+      removeExpressionBuildErrorsRef.current = undefined;
+    }
+  }, [expressionExists]);
+
   useEffect(() => {
     // null signals an empty workspace which should count as an initial render
     if (
@@ -464,16 +439,6 @@ export const InnerWorkspacePanel = React.memo(function InnerWorkspacePanel({
     [plugins.uiActions]
   );
 
-  useEffect(() => {
-    // reset expression error if component attempts to run it again
-    if (expressionExists && localState.expressionBuildError) {
-      setLocalState((s) => ({
-        ...s,
-        expressionBuildError: undefined,
-      }));
-    }
-  }, [expressionExists, localState.expressionBuildError]);
-
   const onDrop = useCallback(() => {
     if (suggestionForDraggedField) {
       trackUiCounterEvents('drop_onto_workspace');
@@ -588,7 +553,8 @@ export const InnerWorkspacePanel = React.memo(function InnerWorkspacePanel({
         onEvent={onEvent}
         hasCompatibleActions={hasCompatibleActions}
         setLocalState={setLocalState}
-        localState={{ ...localState, configurationValidationError, missingRefsErrors }}
+        localState={{ ...localState }}
+        errors={workspaceErrors}
         ExpressionRendererComponent={ExpressionRendererComponent}
         core={core}
         activeDatasourceId={activeDatasourceId}
@@ -650,6 +616,7 @@ export const InnerWorkspacePanel = React.memo(function InnerWorkspacePanel({
       visualizationMap={visualizationMap}
       isFullscreen={isFullscreen}
       lensInspector={lensInspector}
+      getUserMessages={getUserMessages}
     >
       {renderWorkspace()}
     </WorkspacePanelWrapper>
@@ -664,6 +631,7 @@ export const VisualizationWrapper = ({
   hasCompatibleActions,
   setLocalState,
   localState,
+  errors,
   ExpressionRendererComponent,
   core,
   activeDatasourceId,
@@ -676,15 +644,8 @@ export const VisualizationWrapper = ({
   onEvent: (event: ExpressionRendererEvent) => void;
   hasCompatibleActions: (event: ExpressionRendererEvent) => Promise<boolean>;
   setLocalState: (dispatch: (prevState: WorkspaceState) => WorkspaceState) => void;
-  localState: WorkspaceState & {
-    configurationValidationError?: Array<{
-      shortMessage: string;
-      longMessage: React.ReactNode;
-      fixAction?: DatasourceFixAction<unknown>;
-    }>;
-    missingRefsErrors?: Array<{ shortMessage: string; longMessage: React.ReactNode }>;
-    unknownVisError?: Array<{ shortMessage: string; longMessage: React.ReactNode }>;
-  };
+  localState: WorkspaceState;
+  errors: UserMessage[];
   ExpressionRendererComponent: ReactExpressionRendererType;
   core: CoreStart;
   activeDatasourceId: string | null;
@@ -706,171 +667,46 @@ export const VisualizationWrapper = ({
   );
   const searchSessionId = useLensSelector(selectSearchSessionId);
 
-  const dispatchLens = useLensDispatch();
-
-  function renderFixAction(
-    validationError:
-      | {
-          shortMessage: string;
-          longMessage: React.ReactNode;
-          fixAction?: DatasourceFixAction<unknown>;
-        }
-      | undefined
-  ) {
-    return (
-      validationError &&
-      validationError.fixAction &&
-      activeDatasourceId && (
-        <>
-          <EuiButton
-            data-test-subj="errorFixAction"
-            onClick={async () => {
-              const newState = await validationError.fixAction?.newState({
-                ...framePublicAPI,
-                ...context,
-              });
-              dispatchLens(
-                updateDatasourceState({
-                  updater: newState,
-                  datasourceId: activeDatasourceId,
-                })
-              );
-            }}
-          >
-            {validationError.fixAction.label}
-          </EuiButton>
-          <EuiSpacer />
-        </>
-      )
-    );
-  }
-
-  if (localState.configurationValidationError?.length) {
-    let showExtraErrors = null;
-    let showExtraErrorsAction = null;
-
-    if (localState.configurationValidationError.length > 1) {
-      if (localState.expandError) {
-        showExtraErrors = localState.configurationValidationError
-          .slice(1)
-          .map((validationError) => (
-            <>
-              <p
-                key={validationError.shortMessage}
-                className="eui-textBreakWord"
-                data-test-subj="configuration-failure-error"
-              >
-                {validationError.longMessage}
-              </p>
-              {renderFixAction(validationError)}
-            </>
-          ));
-      } else {
-        showExtraErrorsAction = (
-          <EuiButtonEmpty
-            onClick={() => {
-              setLocalState((prevState: WorkspaceState) => ({
-                ...prevState,
-                expandError: !prevState.expandError,
-              }));
-            }}
-            data-test-subj="configuration-failure-more-errors"
-          >
-            {i18n.translate('xpack.lens.editorFrame.configurationFailureMoreErrors', {
-              defaultMessage: ` +{errors} {errors, plural, one {error} other {errors}}`,
-              values: { errors: localState.configurationValidationError.length - 1 },
-            })}
-          </EuiButtonEmpty>
-        );
-      }
-    }
-
-    return (
-      <EuiFlexGroup data-test-subj="configuration-failure">
-        <EuiFlexItem>
-          <EuiEmptyPrompt
-            actions={showExtraErrorsAction}
-            body={
-              <>
-                <p className="eui-textBreakWord" data-test-subj="configuration-failure-error">
-                  {localState.configurationValidationError[0].longMessage}
-                </p>
-                {renderFixAction(localState.configurationValidationError?.[0])}
-
-                {showExtraErrors}
-              </>
-            }
-            iconColor="danger"
-            iconType="alert"
-          />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    );
-  }
-
-  if (localState.missingRefsErrors?.length) {
-    // Check for access to both Management app && specific indexPattern section
-    const { management: isManagementEnabled } = core.application.capabilities.navLinks;
-    const isIndexPatternManagementEnabled =
-      core.application.capabilities.management.kibana.indexPatterns;
-    return (
-      <EuiFlexGroup data-test-subj="configuration-failure">
-        <EuiFlexItem>
-          <EuiEmptyPrompt
-            actions={
-              isManagementEnabled && isIndexPatternManagementEnabled ? (
-                <RedirectAppLinks coreStart={core}>
-                  <a
-                    href={core.application.getUrlForApp('management', {
-                      path: '/kibana/indexPatterns/create',
-                    })}
-                    style={{ width: '100%' }}
-                    data-test-subj="configuration-failure-reconfigure-indexpatterns"
-                  >
-                    {i18n.translate('xpack.lens.editorFrame.dataViewReconfigure', {
-                      defaultMessage: `Recreate it in the data view management page`,
-                    })}
-                  </a>
-                </RedirectAppLinks>
-              ) : null
-            }
-            body={
-              <>
-                <p className="eui-textBreakWord" data-test-subj="missing-refs-failure">
-                  <FormattedMessage
-                    id="xpack.lens.editorFrame.dataViewNotFound"
-                    defaultMessage="Data view not found"
-                  />
-                </p>
-                <p className="eui-textBreakWord lnsSelectableErrorMessage">
-                  {localState.missingRefsErrors[0].longMessage}
-                </p>
-              </>
-            }
-            iconColor="danger"
-            iconType="alert"
-          />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    );
-  }
+  if (errors?.length) {
+    const showExtraErrorsAction =
+      !localState.expandError && errors.length > 1 ? (
+        <EuiButtonEmpty
+          onClick={() => {
+            setLocalState((prevState: WorkspaceState) => ({
+              ...prevState,
+              expandError: !prevState.expandError,
+            }));
+          }}
+          data-test-subj="workspace-more-errors-button"
+        >
+          {i18n.translate('xpack.lens.editorFrame.configurationFailureMoreErrors', {
+            defaultMessage: ` +{errors} {errors, plural, one {error} other {errors}}`,
+            values: { errors: errors.length - 1 },
+          })}
+        </EuiButtonEmpty>
+      ) : null;
+
+    const [firstMessage, ...rest] = errors;
 
-  if (localState.expressionBuildError?.length) {
-    const firstError = localState.expressionBuildError[0];
     return (
       <EuiFlexGroup>
         <EuiFlexItem>
           <EuiEmptyPrompt
+            actions={showExtraErrorsAction}
             body={
               <>
-                <p data-test-subj="expression-failure">
-                  <FormattedMessage
-                    id="xpack.lens.editorFrame.expressionFailure"
-                    defaultMessage="An error occurred in the expression"
-                  />
-                </p>
-
-                <p>{firstError.longMessage}</p>
+                <div data-test-subj="workspace-error-message">{firstMessage.longMessage}</div>
+                {localState.expandError && (
+                  <>
+                    <EuiSpacer />
+                    {rest.map((message) => (
+                      <div data-test-subj="workspace-error-message">
+                        {message.longMessage}
+                        <EuiSpacer />
+                      </div>
+                    ))}
+                  </>
+                )}
               </>
             }
             iconColor="danger"
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.test.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.test.tsx
index 844f3e6cb845e9..42735bde405c41 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.test.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.test.tsx
@@ -41,6 +41,7 @@ describe('workspace_panel_wrapper', () => {
         datasourceStates={{}}
         isFullscreen={false}
         lensInspector={{} as unknown as LensInspector}
+        getUserMessages={() => []}
       >
         <MyChild />
       </WorkspacePanelWrapper>
@@ -63,6 +64,7 @@ describe('workspace_panel_wrapper', () => {
         datasourceStates={{}}
         isFullscreen={false}
         lensInspector={{} as unknown as LensInspector}
+        getUserMessages={() => []}
       />
     );
 
@@ -118,6 +120,7 @@ describe('workspace_panel_wrapper', () => {
           datasourceStates={{}}
           isFullscreen={false}
           lensInspector={{} as unknown as LensInspector}
+          getUserMessages={() => []}
         >
           <div />
         </WorkspacePanelWrapper>
diff --git a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.tsx b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.tsx
index c5adf2089ecb96..9013621c280bf6 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/editor_frame/workspace_panel/workspace_panel_wrapper.tsx
@@ -11,7 +11,12 @@ import React, { useCallback } from 'react';
 import { EuiPageTemplate, EuiFlexGroup, EuiFlexItem, EuiButton } from '@elastic/eui';
 import classNames from 'classnames';
 import { FormattedMessage } from '@kbn/i18n-react';
-import { DatasourceMap, FramePublicAPI, VisualizationMap } from '../../../types';
+import {
+  DatasourceMap,
+  FramePublicAPI,
+  UserMessagesGetter,
+  VisualizationMap,
+} from '../../../types';
 import { DONT_CLOSE_DIMENSION_CONTAINER_ON_CLICK_CLASS } from '../../../utils';
 import { NativeRenderer } from '../../../native_renderer';
 import { ChartSwitch } from './chart_switch';
@@ -21,7 +26,6 @@ import {
   updateVisualizationState,
   DatasourceStates,
   VisualizationState,
-  updateDatasourceState,
   useLensSelector,
   selectChangesApplied,
   applyChanges,
@@ -43,6 +47,7 @@ export interface WorkspacePanelWrapperProps {
   datasourceStates: DatasourceStates;
   isFullscreen: boolean;
   lensInspector: LensInspector;
+  getUserMessages: UserMessagesGetter;
 }
 
 export function WorkspacePanelWrapper({
@@ -52,9 +57,8 @@ export function WorkspacePanelWrapper({
   visualizationId,
   visualizationMap,
   datasourceMap,
-  datasourceStates,
   isFullscreen,
-  lensInspector,
+  getUserMessages,
 }: WorkspacePanelWrapperProps) {
   const dispatchLens = useLensDispatch();
 
@@ -77,37 +81,13 @@ export function WorkspacePanelWrapper({
     },
     [dispatchLens, activeVisualization]
   );
-  const setDatasourceState = useCallback(
-    (updater: unknown, datasourceId: string) => {
-      dispatchLens(
-        updateDatasourceState({
-          updater,
-          datasourceId,
-        })
-      );
-    },
-    [dispatchLens]
-  );
 
   const warningMessages: React.ReactNode[] = [];
-  if (activeVisualization?.getWarningMessages) {
-    warningMessages.push(
-      ...(activeVisualization.getWarningMessages(visualizationState, framePublicAPI) || [])
-    );
-  }
-  Object.entries(datasourceStates).forEach(([datasourceId, datasourceState]) => {
-    const datasource = datasourceMap[datasourceId];
-    if (!datasourceState.isLoading && datasource.getWarningMessages) {
-      warningMessages.push(
-        ...(datasource.getWarningMessages(
-          datasourceState.state,
-          framePublicAPI,
-          lensInspector.adapters,
-          (updater) => setDatasourceState(updater, datasourceId)
-        ) || [])
-      );
-    }
-  });
+
+  warningMessages.push(
+    ...getUserMessages('toolbar', { severity: 'warning' }).map(({ longMessage }) => longMessage)
+  );
+
   if (requestWarnings) {
     warningMessages.push(...requestWarnings);
   }
diff --git a/x-pack/plugins/lens/public/editor_frame_service/error_helper.ts b/x-pack/plugins/lens/public/editor_frame_service/error_helper.ts
index 91c1237027771f..6086c65c254055 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/error_helper.ts
+++ b/x-pack/plugins/lens/public/editor_frame_service/error_helper.ts
@@ -149,35 +149,6 @@ export function getOriginalRequestErrorMessages(error?: ExpressionRenderError |
   return errorMessages;
 }
 
-export function getMissingVisualizationTypeError() {
-  return i18n.translate('xpack.lens.editorFrame.expressionMissingVisualizationType', {
-    defaultMessage: 'Visualization type not found.',
-  });
-}
-
-export function getMissingCurrentDatasource() {
-  return i18n.translate('xpack.lens.editorFrame.expressionMissingDatasource', {
-    defaultMessage: 'Could not find datasource for the visualization',
-  });
-}
-
-export function getMissingIndexPatterns(indexPatternIds: string[]) {
-  return i18n.translate('xpack.lens.editorFrame.expressionMissingDataView', {
-    defaultMessage: 'Could not find the {count, plural, one {data view} other {data views}}: {ids}',
-    values: { count: indexPatternIds.length, ids: indexPatternIds.join(', ') },
-  });
-}
-
-export function getUnknownVisualizationTypeError(visType: string) {
-  return {
-    shortMessage: i18n.translate('xpack.lens.unknownVisType.shortMessage', {
-      defaultMessage: `Unknown visualization type`,
-    }),
-    longMessage: i18n.translate('xpack.lens.unknownVisType.longMessage', {
-      defaultMessage: `The visualization type {visType} could not be resolved.`,
-      values: {
-        visType,
-      },
-    }),
-  };
-}
+// NOTE - if you are adding a new error message, add it as a UserMessage in get_application_error_messages
+// or the getUserMessages method of a particular datasource or visualization class! Alternatively, use the
+// addUserMessage function passed down by the application component.
diff --git a/x-pack/plugins/lens/public/editor_frame_service/service.tsx b/x-pack/plugins/lens/public/editor_frame_service/service.tsx
index d375b75866cbbb..80a30ab9325e06 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/service.tsx
+++ b/x-pack/plugins/lens/public/editor_frame_service/service.tsx
@@ -118,7 +118,13 @@ export class EditorFrameService {
       const { EditorFrame } = await import('../async_services');
 
       return {
-        EditorFrameContainer: ({ showNoDataPopover, lensInspector, indexPatternService }) => {
+        EditorFrameContainer: ({
+          showNoDataPopover,
+          lensInspector,
+          indexPatternService,
+          getUserMessages,
+          addUserMessages,
+        }) => {
           return (
             <div className="lnsApp__frame">
               <EditorFrame
@@ -127,6 +133,8 @@ export class EditorFrameService {
                 plugins={plugins}
                 lensInspector={lensInspector}
                 showNoDataPopover={showNoDataPopover}
+                getUserMessages={getUserMessages}
+                addUserMessages={addUserMessages}
                 indexPatternService={indexPatternService}
                 datasourceMap={resolvedDatasources}
                 visualizationMap={resolvedVisualizations}
diff --git a/x-pack/plugins/lens/public/editor_frame_service/types.ts b/x-pack/plugins/lens/public/editor_frame_service/types.ts
index 109543e3711e30..7834cc82ca119f 100644
--- a/x-pack/plugins/lens/public/editor_frame_service/types.ts
+++ b/x-pack/plugins/lens/public/editor_frame_service/types.ts
@@ -8,9 +8,3 @@
 import type { Datatable } from '@kbn/expressions-plugin/common';
 
 export type TableInspectorAdapter = Record<string, Datatable>;
-
-export interface ErrorMessage {
-  shortMessage: string;
-  longMessage: React.ReactNode;
-  type?: 'fixable' | 'critical';
-}
diff --git a/x-pack/plugins/lens/public/embeddable/embeddable.test.tsx b/x-pack/plugins/lens/public/embeddable/embeddable.test.tsx
index 5a2f3d002ad8ec..db00db6a87f7f5 100644
--- a/x-pack/plugins/lens/public/embeddable/embeddable.test.tsx
+++ b/x-pack/plugins/lens/public/embeddable/embeddable.test.tsx
@@ -23,7 +23,7 @@ import { Document } from '../persistence';
 import { dataPluginMock } from '@kbn/data-plugin/public/mocks';
 import { VIS_EVENT_TO_TRIGGER } from '@kbn/visualizations-plugin/public/embeddable';
 import { coreMock, httpServiceMock, themeServiceMock } from '@kbn/core/public/mocks';
-import { IBasePath, IUiSettingsClient } from '@kbn/core/public';
+import { CoreStart, IBasePath, IUiSettingsClient } from '@kbn/core/public';
 import { AttributeService, ViewMode } from '@kbn/embeddable-plugin/public';
 import { LensAttributeService } from '../lens_attribute_service';
 import { OnSaveProps } from '@kbn/saved-objects-plugin/public/save_modal';
@@ -143,6 +143,7 @@ describe('embeddable', () => {
         attributeService,
         data: dataMock,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         dataViews: {} as DataViewsContract,
         capabilities: {
@@ -166,7 +167,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
       },
@@ -194,6 +196,7 @@ describe('embeddable', () => {
         attributeService,
         data: dataMock,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         dataViews: {} as DataViewsContract,
         capabilities: {
@@ -217,7 +220,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
       },
@@ -253,6 +257,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         dataViews: {} as DataViewsContract,
         inspector: inspectorPluginMock.createStartContract(),
@@ -276,7 +281,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       {
@@ -305,6 +311,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -328,11 +335,23 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: [{ shortMessage: '', longMessage: 'my validation error' }],
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       {} as LensEmbeddableInput
     );
+
+    jest.spyOn(embeddable, 'getUserMessages').mockReturnValue([
+      {
+        severity: 'error',
+        fixableInEditor: true,
+        displayLocations: [{ id: 'visualization' }],
+        longMessage: 'lol',
+        shortMessage: 'lol',
+      },
+    ]);
+
     await embeddable.initializeSavedVis({} as LensEmbeddableInput);
     embeddable.render(mountpoint);
 
@@ -368,6 +387,7 @@ describe('embeddable', () => {
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         inspector: inspectorPluginMock.createStartContract(),
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         dataViews: {} as DataViewsContract,
         spaces: spacesPluginStart,
@@ -391,7 +411,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       {} as LensEmbeddableInput
@@ -418,6 +439,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {
@@ -443,7 +465,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       {} as LensEmbeddableInput
@@ -469,6 +492,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {
@@ -494,7 +518,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       {} as LensEmbeddableInput
@@ -518,6 +543,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -541,7 +567,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       { id: '123' } as LensEmbeddableInput
@@ -571,6 +598,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -594,7 +622,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       { id: '123' } as LensEmbeddableInput
@@ -628,6 +657,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -651,7 +681,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       { id: '123' } as LensEmbeddableInput
@@ -683,6 +714,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -706,7 +738,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       { id: '123' } as LensEmbeddableInput
@@ -745,6 +778,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -768,7 +802,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       input
@@ -808,6 +843,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -831,7 +867,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       input
@@ -874,6 +911,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: { get: jest.fn() } as unknown as DataViewsContract,
@@ -897,7 +935,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       input
@@ -925,6 +964,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -948,7 +988,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       { id: '123' } as LensEmbeddableInput
@@ -978,6 +1019,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -1001,7 +1043,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       { id: '123' } as LensEmbeddableInput
@@ -1028,6 +1071,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -1051,7 +1095,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       { id: '123', timeRange, query, filters } as LensEmbeddableInput
@@ -1094,6 +1139,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -1117,7 +1163,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       { id: '123', onLoad } as unknown as LensEmbeddableInput
@@ -1178,6 +1225,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -1201,7 +1249,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       { id: '123', onFilter } as unknown as LensEmbeddableInput
@@ -1237,6 +1286,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -1260,7 +1310,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       { id: '123', onBrushEnd } as unknown as LensEmbeddableInput
@@ -1293,6 +1344,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -1316,7 +1368,8 @@ describe('embeddable', () => {
                 { type: 'function', function: 'expression', arguments: {} },
               ],
             },
-            errors: undefined,
+            indexPatterns: {},
+            indexPatternRefs: [],
           }),
       },
       { id: '123', onTableRowClick } as unknown as LensEmbeddableInput
@@ -1347,7 +1400,8 @@ describe('embeddable', () => {
             },
           ],
         },
-        errors: undefined,
+        indexPatterns: {},
+        indexPatternRefs: [],
       };
     });
 
@@ -1370,6 +1424,7 @@ describe('embeddable', () => {
         data: dataMock,
         uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         expressionRenderer,
+        coreStart: {} as CoreStart,
         basePath,
         inspector: inspectorPluginMock.createStartContract(),
         dataViews: {} as DataViewsContract,
@@ -1385,6 +1440,7 @@ describe('embeddable', () => {
         visualizationMap: {
           [visDocument.visualizationType as string]: {
             onEditAction: onEditActionMock,
+            initialize: () => {},
           } as unknown as Visualization,
         },
         datasourceMap: {},
@@ -1438,6 +1494,7 @@ describe('embeddable', () => {
           attributeService: attributeServiceMockFromSavedVis(visDocument),
           data: dataMock,
           expressionRenderer,
+          coreStart: {} as CoreStart,
           basePath,
           dataViews: {} as DataViewsContract,
           capabilities: {
@@ -1452,6 +1509,7 @@ describe('embeddable', () => {
           visualizationMap: {
             [visDocument.visualizationType as string]: {
               getDisplayOptions: displayOptions ? () => displayOptions : undefined,
+              initialize: () => {},
             } as unknown as Visualization,
           },
           datasourceMap: {},
@@ -1465,7 +1523,8 @@ describe('embeddable', () => {
                   { type: 'function', function: 'expression', arguments: {} },
                 ],
               },
-              errors: undefined,
+              indexPatterns: {},
+              indexPatternRefs: [],
             }),
           uiSettings: { get: () => undefined } as unknown as IUiSettingsClient,
         },
diff --git a/x-pack/plugins/lens/public/embeddable/embeddable.tsx b/x-pack/plugins/lens/public/embeddable/embeddable.tsx
index af1feb2223e2b3..4bc431b2e50da3 100644
--- a/x-pack/plugins/lens/public/embeddable/embeddable.tsx
+++ b/x-pack/plugins/lens/public/embeddable/embeddable.tsx
@@ -60,6 +60,7 @@ import type { Action, UiActionsStart } from '@kbn/ui-actions-plugin/public';
 import type { DataViewsContract, DataView } from '@kbn/data-views-plugin/public';
 import type {
   Capabilities,
+  CoreStart,
   IBasePath,
   IUiSettingsClient,
   KibanaExecutionContext,
@@ -67,7 +68,7 @@ import type {
 } from '@kbn/core/public';
 import type { SpacesPluginStart } from '@kbn/spaces-plugin/public';
 import { BrushTriggerEvent, ClickTriggerEvent, Warnings } from '@kbn/charts-plugin/public';
-import { DataViewPersistableStateService, DataViewSpec } from '@kbn/data-views-plugin/common';
+import { DataViewSpec } from '@kbn/data-views-plugin/common';
 import { getExecutionContextEvents, trackUiCounterEvents } from '../lens_ui_telemetry';
 import { Document } from '../persistence';
 import { ExpressionWrapper, ExpressionWrapperProps } from './expression_wrapper';
@@ -83,11 +84,17 @@ import {
   Datasource,
   IndexPatternMap,
   GetCompatibleCellValueActions,
+  UserMessage,
+  IndexPatternRef,
+  FrameDatasourceAPI,
+  AddUserMessages,
+  isMessageRemovable,
+  UserMessagesGetter,
 } from '../types';
 
 import { getEditPath, DOC_TYPE } from '../../common';
 import { LensAttributeService } from '../lens_attribute_service';
-import type { ErrorMessage, TableInspectorAdapter } from '../editor_frame_service/types';
+import type { TableInspectorAdapter } from '../editor_frame_service/types';
 import { getLensInspectorService, LensInspector } from '../lens_inspector_service';
 import { SharingSavedObjectProps, VisualizationDisplayOptions } from '../types';
 import {
@@ -98,7 +105,10 @@ import {
   inferTimeField,
 } from '../utils';
 import { getLayerMetaInfo, combineQueryAndFilters } from '../app_plugin/show_underlying_data';
-import { convertDataViewIntoLensIndexPattern } from '../data_views_service/loader';
+import {
+  filterUserMessages,
+  getApplicationUserMessages,
+} from '../app_plugin/get_application_user_messages';
 
 export type LensSavedObjectAttributes = Omit<Document, 'savedObjectId' | 'type'>;
 
@@ -141,9 +151,11 @@ export interface LensEmbeddableOutput extends EmbeddableOutput {
 export interface LensEmbeddableDeps {
   attributeService: LensAttributeService;
   data: DataPublicPluginStart;
-  documentToExpression: (
-    doc: Document
-  ) => Promise<{ ast: Ast | null; errors: ErrorMessage[] | undefined }>;
+  documentToExpression: (doc: Document) => Promise<{
+    ast: Ast | null;
+    indexPatterns: IndexPatternMap;
+    indexPatternRefs: IndexPatternRef[];
+  }>;
   injectFilterReferences: FilterManager['inject'];
   visualizationMap: VisualizationMap;
   datasourceMap: DatasourceMap;
@@ -160,6 +172,7 @@ export interface LensEmbeddableDeps {
     navLinks: Capabilities['navLinks'];
     discover: Capabilities['discover'];
   };
+  coreStart: CoreStart;
   usageCollection?: UsageCollectionSetup;
   spaces?: SpacesPluginStart;
   theme: ThemeServiceStart;
@@ -178,11 +191,8 @@ const getExpressionFromDocument = async (
   document: Document,
   documentToExpression: LensEmbeddableDeps['documentToExpression']
 ) => {
-  const { ast, errors } = await documentToExpression(document);
-  return {
-    expression: ast ? toExpression(ast) : null,
-    errors,
-  };
+  const { ast, indexPatterns, indexPatternRefs } = await documentToExpression(document);
+  return { ast: ast ? toExpression(ast) : null, indexPatterns, indexPatternRefs };
 };
 
 function getViewUnderlyingDataArgs({
@@ -276,7 +286,6 @@ export class Embeddable
   private warningDomNode: HTMLElement | Element | undefined;
   private subscription: Subscription;
   private isInitialized = false;
-  private errors: ErrorMessage[] | undefined;
   private inputReloadSubscriptions: Subscription[];
   private isDestroyed?: boolean;
   private embeddableTitle?: string;
@@ -296,15 +305,9 @@ export class Embeddable
     searchSessionId?: string;
   } = {};
 
-  private activeDataInfo: {
-    activeData?: TableInspectorAdapter;
-    activeDatasource?: Datasource;
-    activeDatasourceState?: unknown;
-    activeVisualization?: Visualization;
-    activeVisualizationState?: unknown;
-  } = {};
+  private activeData?: TableInspectorAdapter;
 
-  private indexPatterns: DataView[] = [];
+  private dataViews: DataView[] = [];
 
   private viewUnderlyingDataArgs?: ViewUnderlyingDataArgs;
 
@@ -326,6 +329,7 @@ export class Embeddable
     let containerStateChangedCalledAlready = false;
     this.initializeSavedVis(initialInput)
       .then(() => {
+        this.loadUserMessages();
         if (!containerStateChangedCalledAlready) {
           this.onContainerStateChanged(initialInput);
         } else {
@@ -417,6 +421,152 @@ export class Embeddable
     );
   }
 
+  private get activeDatasourceId() {
+    return getActiveDatasourceIdFromDoc(this.savedVis);
+  }
+
+  private get activeDatasource() {
+    if (!this.activeDatasourceId) return;
+    return this.deps.datasourceMap[this.activeDatasourceId];
+  }
+
+  private get activeVisualizationId() {
+    return getActiveVisualizationIdFromDoc(this.savedVis);
+  }
+
+  private get activeVisualization() {
+    if (!this.activeVisualizationId) return;
+    return this.deps.visualizationMap[this.activeVisualizationId];
+  }
+
+  private get activeVisualizationState() {
+    if (!this.activeVisualization) return;
+    return this.activeVisualization.initialize(() => '', this.savedVis?.state.visualization);
+  }
+
+  private indexPatterns: IndexPatternMap = {};
+
+  private indexPatternRefs: IndexPatternRef[] = [];
+
+  private get activeDatasourceState(): undefined | unknown {
+    if (!this.activeDatasourceId || !this.activeDatasource) return;
+
+    const docDatasourceState = this.savedVis?.state.datasourceStates[this.activeDatasourceId];
+
+    return this.activeDatasource.initialize(
+      docDatasourceState,
+      [...(this.savedVis?.references || []), ...(this.savedVis?.state.internalReferences || [])],
+      undefined,
+      undefined,
+      this.indexPatterns
+    );
+  }
+
+  public getUserMessages: UserMessagesGetter = (locationId, filters) => {
+    return filterUserMessages(
+      [...this._userMessages, ...Object.values(this.additionalUserMessages)],
+      locationId,
+      filters
+    );
+  };
+
+  private get hasAnyErrors() {
+    return this.getUserMessages(undefined, { severity: 'error' }).length > 0;
+  }
+
+  private _userMessages: UserMessage[] = [];
+
+  // loads all available user messages
+  private loadUserMessages() {
+    const userMessages: UserMessage[] = [];
+
+    if (this.activeVisualizationState && this.activeDatasource) {
+      userMessages.push(
+        ...getApplicationUserMessages({
+          visualizationType: this.savedVis?.visualizationType,
+          visualization: {
+            state: this.activeVisualizationState,
+            activeId: this.activeVisualizationId,
+          },
+          visualizationMap: this.deps.visualizationMap,
+          activeDatasource: this.activeDatasource,
+          activeDatasourceState: { state: this.activeDatasourceState },
+          dataViews: {
+            indexPatterns: this.indexPatterns,
+            indexPatternRefs: this.indexPatternRefs, // TODO - are these actually used?
+          },
+          core: this.deps.coreStart,
+        })
+      );
+    }
+
+    const mergedSearchContext = this.getMergedSearchContext();
+
+    if (!this.savedVis) {
+      return userMessages;
+    }
+
+    const frameDatasourceAPI: FrameDatasourceAPI = {
+      dataViews: {
+        indexPatterns: this.indexPatterns,
+        indexPatternRefs: this.indexPatternRefs,
+      },
+      datasourceLayers: {}, // TODO
+      query: this.savedVis.state.query,
+      filters: mergedSearchContext.filters ?? [],
+      dateRange: {
+        fromDate: mergedSearchContext.timeRange?.from ?? '',
+        toDate: mergedSearchContext.timeRange?.to ?? '',
+      },
+      activeData: this.activeData,
+    };
+
+    userMessages.push(
+      ...(this.activeDatasource?.getUserMessages(this.activeDatasourceState, {
+        setState: () => {},
+        frame: frameDatasourceAPI,
+      }) ?? []),
+      ...(this.activeVisualization?.getUserMessages?.(this.activeVisualizationState, {
+        frame: frameDatasourceAPI,
+      }) ?? [])
+    );
+
+    this._userMessages = userMessages;
+  }
+
+  private additionalUserMessages: Record<string, UserMessage> = {};
+
+  // used to add warnings and errors from elsewhere in the embeddable
+  private addUserMessages: AddUserMessages = (messages) => {
+    const newMessageMap = {
+      ...this.additionalUserMessages,
+    };
+
+    const addedMessageIds: string[] = [];
+    messages.forEach((message) => {
+      if (!newMessageMap[message.uniqueId]) {
+        addedMessageIds.push(message.uniqueId);
+        newMessageMap[message.uniqueId] = message;
+      }
+    });
+
+    if (addedMessageIds.length) {
+      this.additionalUserMessages = newMessageMap;
+    }
+
+    this.reload();
+
+    return () => {
+      const withMessagesRemoved = {
+        ...this.additionalUserMessages,
+      };
+
+      messages.map(({ uniqueId }) => uniqueId).forEach((id) => delete withMessagesRemoved[id]);
+
+      this.additionalUserMessages = withMessagesRemoved;
+    };
+  };
+
   public reportsEmbeddableLoad() {
     return true;
   }
@@ -433,54 +583,6 @@ export class Embeddable
     return this.lensInspector.adapters;
   }
 
-  private maybeAddConflictError(
-    errors?: ErrorMessage[],
-    sharingSavedObjectProps?: SharingSavedObjectProps
-  ) {
-    const ret = [...(errors || [])];
-
-    if (sharingSavedObjectProps?.outcome === 'conflict' && !!this.deps.spaces) {
-      ret.push({
-        shortMessage: i18n.translate('xpack.lens.embeddable.legacyURLConflict.shortMessage', {
-          defaultMessage: `You've encountered a URL conflict`,
-        }),
-        longMessage: (
-          <this.deps.spaces.ui.components.getEmbeddableLegacyUrlConflict
-            targetType={DOC_TYPE}
-            sourceId={sharingSavedObjectProps.sourceId!}
-          />
-        ),
-      });
-    }
-
-    return ret?.length ? ret : undefined;
-  }
-
-  private maybeAddTimeRangeError(
-    errors: ErrorMessage[] | undefined,
-    input: LensEmbeddableInput,
-    indexPatterns: DataView[]
-  ) {
-    // if at least one indexPattern is time based, then the Lens embeddable requires the timeRange prop
-    if (
-      input.timeRange == null &&
-      indexPatterns.some((indexPattern) => indexPattern.isTimeBased())
-    ) {
-      return [
-        ...(errors || []),
-        {
-          shortMessage: i18n.translate('xpack.lens.embeddable.missingTimeRangeParam.shortMessage', {
-            defaultMessage: `Missing timeRange property`,
-          }),
-          longMessage: i18n.translate('xpack.lens.embeddable.missingTimeRangeParam.longMessage', {
-            defaultMessage: `The timeRange property is required for the given configuration`,
-          }),
-        },
-      ];
-    }
-    return errors;
-  }
-
   async initializeSavedVis(input: LensEmbeddableInput) {
     const unwrapResult: LensUnwrapResult | false = await this.deps.attributeService
       .unwrapAttributes(input)
@@ -500,15 +602,40 @@ export class Embeddable
       savedObjectId: (input as LensByReferenceInput)?.savedObjectId,
     };
 
-    const { expression, errors } = await getExpressionFromDocument(
+    const { ast, indexPatterns, indexPatternRefs } = await getExpressionFromDocument(
       this.savedVis,
       this.deps.documentToExpression
     );
-    this.expression = expression;
-    this.errors = this.maybeAddConflictError(errors, metaInfo?.sharingSavedObjectProps);
+
+    this.expression = ast;
+    this.indexPatterns = indexPatterns;
+    this.indexPatternRefs = indexPatternRefs;
+
+    if (metaInfo?.sharingSavedObjectProps?.outcome === 'conflict' && !!this.deps.spaces) {
+      this.addUserMessages([
+        {
+          uniqueId: 'url-conflict',
+          severity: 'error',
+          displayLocations: [{ id: 'visualization' }],
+          shortMessage: i18n.translate('xpack.lens.embeddable.legacyURLConflict.shortMessage', {
+            defaultMessage: `You've encountered a URL conflict`,
+          }),
+          longMessage: (
+            <this.deps.spaces.ui.components.getEmbeddableLegacyUrlConflict
+              targetType={DOC_TYPE}
+              sourceId={metaInfo?.sharingSavedObjectProps?.sourceId!}
+            />
+          ),
+          fixableInEditor: false,
+        },
+      ]);
+    }
 
     await this.initializeOutput();
 
+    // deferred loading of this embeddable is complete
+    this.setInitializationFinished();
+
     this.isInitialized = true;
   }
 
@@ -551,37 +678,27 @@ export class Embeddable
     return isDirty;
   }
 
-  private handleWarnings(adapters?: Partial<DefaultInspectorAdapters>) {
-    const activeDatasourceId = getActiveDatasourceIdFromDoc(this.savedVis);
-
-    if (!activeDatasourceId || !adapters?.requests) {
-      return;
+  private getSearchWarningMessages(adapters?: Partial<DefaultInspectorAdapters>): UserMessage[] {
+    if (!this.activeDatasource || !this.activeDatasourceId || !adapters?.requests) {
+      return [];
     }
 
-    const activeDatasource = this.deps.datasourceMap[activeDatasourceId];
-    const docDatasourceState = this.savedVis?.state.datasourceStates[activeDatasourceId];
+    const docDatasourceState = this.savedVis?.state.datasourceStates[this.activeDatasourceId];
 
     const requestWarnings = getSearchWarningMessages(
       adapters.requests,
-      activeDatasource,
+      this.activeDatasource,
       docDatasourceState,
       {
         searchService: this.deps.data.search,
       }
     );
 
-    if (requestWarnings.length && this.warningDomNode) {
-      render(
-        <KibanaThemeProvider theme$={this.deps.theme.theme$}>
-          <Warnings warnings={requestWarnings} compressed />
-        </KibanaThemeProvider>,
-        this.warningDomNode
-      );
-    }
+    return requestWarnings;
   }
 
+  private removeActiveDataWarningMessages: () => void = () => {};
   private updateActiveData: ExpressionWrapperProps['onData$'] = (data, adapters) => {
-    this.activeDataInfo.activeData = adapters?.tables?.tables;
     if (this.input.onLoad) {
       // once onData$ is get's called from expression renderer, loading becomes false
       this.input.onLoad(false, adapters);
@@ -589,12 +706,23 @@ export class Embeddable
 
     const { type, error } = data as { type: string; error: ErrorLike };
     this.updateOutput({
-      ...this.getOutput(),
       loading: false,
       error: type === 'error' ? error : undefined,
     });
 
-    this.handleWarnings(adapters);
+    const newActiveData = adapters?.tables?.tables;
+
+    if (!fastIsEqual(this.activeData, newActiveData)) {
+      // we check equality because this.addUserMessage triggers a render, so we get an infinite loop
+      // if we just execute without checking if the data has changed
+      this.removeActiveDataWarningMessages();
+      const searchWarningMessages = this.getSearchWarningMessages(adapters);
+      this.removeActiveDataWarningMessages = this.addUserMessages(
+        searchWarningMessages.filter(isMessageRemovable)
+      );
+    }
+
+    this.activeData = newActiveData;
   };
 
   private onRender: ExpressionWrapperProps['onRender$'] = () => {
@@ -662,25 +790,6 @@ export class Embeddable
     }
   }
 
-  private getError(): Error | undefined {
-    const message =
-      typeof this.errors?.[0]?.longMessage === 'string'
-        ? this.errors[0].longMessage
-        : this.errors?.[0]?.shortMessage;
-
-    if (message != null) {
-      return new Error(message);
-    }
-
-    if (!this.expression) {
-      return new Error(
-        i18n.translate('xpack.lens.embeddable.failure', {
-          defaultMessage: "Visualization couldn't be displayed",
-        })
-      );
-    }
-  }
-
   /**
    *
    * @param {HTMLElement} domNode
@@ -698,15 +807,22 @@ export class Embeddable
 
     this.domNode.setAttribute('data-shared-item', '');
 
-    const error = this.getError();
+    const errors = this.getUserMessages(['visualization', 'visualizationOnEmbeddable'], {
+      severity: 'error',
+    });
 
     this.updateOutput({
-      ...this.getOutput(),
       loading: true,
-      error,
+      error: errors.length
+        ? new Error(
+            typeof errors[0].longMessage === 'string'
+              ? errors[0].longMessage
+              : errors[0].shortMessage
+          )
+        : undefined,
     });
 
-    if (error) {
+    if (errors.length) {
       this.renderComplete.dispatchError();
     } else {
       this.renderComplete.dispatchInProgress();
@@ -719,7 +835,7 @@ export class Embeddable
         <ExpressionWrapper
           ExpressionRenderer={this.expressionRenderer}
           expression={this.expression || null}
-          errors={this.errors}
+          errors={errors}
           lensInspector={this.lensInspector}
           searchContext={this.getMergedSearchContext()}
           variables={{
@@ -763,6 +879,19 @@ export class Embeddable
       </KibanaThemeProvider>,
       domNode
     );
+
+    const warningsToDisplay = this.getUserMessages('embeddableBadge', {
+      severity: 'warning',
+    });
+
+    if (warningsToDisplay.length && this.warningDomNode) {
+      render(
+        <KibanaThemeProvider theme$={this.deps.theme.theme$}>
+          <Warnings warnings={warningsToDisplay.map((message) => message.longMessage)} compressed />
+        </KibanaThemeProvider>,
+        this.warningDomNode
+      );
+    }
   }
 
   private readonly hasCompatibleActions = async (
@@ -902,13 +1031,14 @@ export class Embeddable
       newVis.state.visualization = this.onEditAction(newVis.state.visualization, event);
       this.savedVis = newVis;
 
-      const { expression, errors } = await getExpressionFromDocument(
+      const { ast } = await getExpressionFromDocument(
         this.savedVis,
         this.deps.documentToExpression
       );
-      this.expression = expression;
-      this.errors = errors;
 
+      this.expression = ast;
+
+      this.loadUserMessages();
       this.reload();
     }
   };
@@ -924,81 +1054,36 @@ export class Embeddable
   }
 
   private async loadViewUnderlyingDataArgs(): Promise<boolean> {
-    if (!this.savedVis || !this.activeDataInfo.activeData) {
+    if (
+      !this.savedVis ||
+      !this.activeData ||
+      !this.activeDatasource ||
+      !this.activeDatasourceState ||
+      !this.activeVisualization ||
+      !this.activeVisualizationState
+    ) {
       return false;
     }
+
     const mergedSearchContext = this.getMergedSearchContext();
 
     if (!mergedSearchContext.timeRange) {
       return false;
     }
 
-    const activeDatasourceId = getActiveDatasourceIdFromDoc(this.savedVis);
-    if (!activeDatasourceId) {
-      return false;
-    }
-
-    const activeVisualizationId = getActiveVisualizationIdFromDoc(this.savedVis);
-    if (!activeVisualizationId) {
-      return false;
-    }
-
-    this.activeDataInfo.activeDatasource = this.deps.datasourceMap[activeDatasourceId];
-    this.activeDataInfo.activeVisualization = this.deps.visualizationMap[activeVisualizationId];
-
-    const docDatasourceState = this.savedVis?.state.datasourceStates[activeDatasourceId];
-    const adHocDataviews = await Promise.all(
-      Object.values(this.savedVis?.state.adHocDataViews || {})
-        .map((persistedSpec) => {
-          return DataViewPersistableStateService.inject(persistedSpec, [
-            ...(this.savedVis?.references || []),
-            ...(this.savedVis?.state.internalReferences || []),
-          ]);
-        })
-        .map((spec) => this.deps.dataViews.create(spec))
-    );
-
-    const allIndexPatterns = [...this.indexPatterns, ...adHocDataviews];
-
-    const indexPatternsCache = allIndexPatterns.reduce(
-      (acc, indexPattern) => ({
-        [indexPattern.id!]: convertDataViewIntoLensIndexPattern(indexPattern),
-        ...acc,
-      }),
-      {}
-    );
-
-    if (!this.activeDataInfo.activeDatasourceState) {
-      this.activeDataInfo.activeDatasourceState = this.activeDataInfo.activeDatasource.initialize(
-        docDatasourceState,
-        [...(this.savedVis?.references || []), ...(this.savedVis?.state.internalReferences || [])],
-        undefined,
-        undefined,
-        indexPatternsCache
-      );
-    }
-
-    if (!this.activeDataInfo.activeVisualizationState) {
-      this.activeDataInfo.activeVisualizationState =
-        this.activeDataInfo.activeVisualization.initialize(
-          () => '',
-          this.savedVis?.state.visualization
-        );
-    }
-
     const viewUnderlyingDataArgs = getViewUnderlyingDataArgs({
-      activeDatasource: this.activeDataInfo.activeDatasource,
-      activeDatasourceState: this.activeDataInfo.activeDatasourceState,
-      activeVisualization: this.activeDataInfo.activeVisualization,
-      activeVisualizationState: this.activeDataInfo.activeVisualizationState,
-      activeData: this.activeDataInfo.activeData,
-      dataViews: this.indexPatterns,
+      activeDatasource: this.activeDatasource,
+      activeDatasourceState: this.activeDatasourceState,
+      activeVisualization: this.activeVisualization,
+      activeVisualizationState: this.activeVisualizationState,
+      activeData: this.activeData,
+      dataViews: this.dataViews,
       capabilities: this.deps.capabilities,
       query: mergedSearchContext.query,
       filters: mergedSearchContext.filters || [],
       timeRange: mergedSearchContext.timeRange,
       esQueryConfig: getEsQueryConfig(this.deps.uiSettings),
-      indexPatternsCache,
+      indexPatternsCache: this.indexPatterns,
     });
 
     const loaded = typeof viewUnderlyingDataArgs !== 'undefined';
@@ -1038,33 +1123,48 @@ export class Embeddable
       )
     ).forEach((dataView) => indexPatterns.push(dataView));
 
-    this.indexPatterns = uniqBy(indexPatterns, 'id');
+    this.dataViews = uniqBy(indexPatterns, 'id');
 
     // passing edit url and index patterns to the output of this embeddable for
     // the container to pick them up and use them to configure filter bar and
     // config dropdown correctly.
     const input = this.getInput();
 
-    this.errors = this.maybeAddTimeRangeError(this.errors, input, this.indexPatterns);
+    // if at least one indexPattern is time based, then the Lens embeddable requires the timeRange prop
+    if (
+      input.timeRange == null &&
+      indexPatterns.some((indexPattern) => indexPattern.isTimeBased())
+    ) {
+      this.addUserMessages([
+        {
+          uniqueId: 'missing-time-range-on-embeddable',
+          severity: 'error',
+          fixableInEditor: false,
+          displayLocations: [{ id: 'visualization' }],
+          shortMessage: i18n.translate('xpack.lens.embeddable.missingTimeRangeParam.shortMessage', {
+            defaultMessage: `Missing timeRange property`,
+          }),
+          longMessage: i18n.translate('xpack.lens.embeddable.missingTimeRangeParam.longMessage', {
+            defaultMessage: `The timeRange property is required for the given configuration`,
+          }),
+        },
+      ]);
+    }
 
-    if (this.errors) {
+    if (this.hasAnyErrors) {
       this.logError('validation');
     }
 
     const title = input.hidePanelTitles ? '' : input.title ?? this.savedVis.title;
     const savedObjectId = (input as LensByReferenceInput).savedObjectId;
     this.updateOutput({
-      ...this.getOutput(),
       defaultTitle: this.savedVis.title,
       editable: this.getIsEditable(),
       title,
       editPath: getEditPath(savedObjectId),
       editUrl: this.deps.basePath.prepend(`/app/lens${getEditPath(savedObjectId)}`),
-      indexPatterns: this.indexPatterns,
+      indexPatterns: this.dataViews,
     });
-
-    // deferred loading of this embeddable is complete
-    this.setInitializationFinished();
   }
 
   private getIsEditable() {
diff --git a/x-pack/plugins/lens/public/embeddable/embeddable_factory.ts b/x-pack/plugins/lens/public/embeddable/embeddable_factory.ts
index 7904ba4c38f143..f57e532bc13804 100644
--- a/x-pack/plugins/lens/public/embeddable/embeddable_factory.ts
+++ b/x-pack/plugins/lens/public/embeddable/embeddable_factory.ts
@@ -7,6 +7,7 @@
 
 import type {
   Capabilities,
+  CoreStart,
   HttpSetup,
   IUiSettingsClient,
   ThemeServiceStart,
@@ -30,14 +31,14 @@ import type { LensByReferenceInput, LensEmbeddableInput } from './embeddable';
 import type { Document } from '../persistence/saved_object_store';
 import type { LensAttributeService } from '../lens_attribute_service';
 import { DOC_TYPE } from '../../common/constants';
-import type { ErrorMessage } from '../editor_frame_service/types';
 import { extract, inject } from '../../common/embeddable_factory';
-import type { DatasourceMap, VisualizationMap } from '../types';
+import type { DatasourceMap, IndexPatternMap, IndexPatternRef, VisualizationMap } from '../types';
 
 export interface LensEmbeddableStartServices {
   data: DataPublicPluginStart;
   timefilter: TimefilterContract;
   coreHttp: HttpSetup;
+  coreStart: CoreStart;
   inspector: InspectorStart;
   attributeService: LensAttributeService;
   capabilities: RecursiveReadonly<Capabilities>;
@@ -45,9 +46,11 @@ export interface LensEmbeddableStartServices {
   dataViews: DataViewsContract;
   uiActions?: UiActionsStart;
   usageCollection?: UsageCollectionSetup;
-  documentToExpression: (
-    doc: Document
-  ) => Promise<{ ast: Ast | null; errors: ErrorMessage[] | undefined }>;
+  documentToExpression: (doc: Document) => Promise<{
+    ast: Ast | null;
+    indexPatterns: IndexPatternMap;
+    indexPatternRefs: IndexPatternRef[];
+  }>;
   injectFilterReferences: FilterManager['inject'];
   visualizationMap: VisualizationMap;
   datasourceMap: DatasourceMap;
@@ -106,6 +109,7 @@ export class EmbeddableFactory implements EmbeddableFactoryDefinition {
         datasourceMap,
         uiActions,
         coreHttp,
+        coreStart,
         attributeService,
         dataViews,
         capabilities,
@@ -139,6 +143,7 @@ export class EmbeddableFactory implements EmbeddableFactoryDefinition {
             navLinks: capabilities.navLinks,
             discover: capabilities.discover,
           },
+          coreStart,
           usageCollection,
           theme,
           spaces,
diff --git a/x-pack/plugins/lens/public/embeddable/expression_wrapper.tsx b/x-pack/plugins/lens/public/embeddable/expression_wrapper.tsx
index d5aaf99788ae7a..717e28d94ab7a7 100644
--- a/x-pack/plugins/lens/public/embeddable/expression_wrapper.tsx
+++ b/x-pack/plugins/lens/public/embeddable/expression_wrapper.tsx
@@ -19,13 +19,13 @@ import { ExecutionContextSearch } from '@kbn/data-plugin/public';
 import { DefaultInspectorAdapters, RenderMode } from '@kbn/expressions-plugin/common';
 import classNames from 'classnames';
 import { getOriginalRequestErrorMessages } from '../editor_frame_service/error_helper';
-import { ErrorMessage } from '../editor_frame_service/types';
 import { LensInspector } from '../lens_inspector_service';
+import { UserMessage } from '../types';
 
 export interface ExpressionWrapperProps {
   ExpressionRenderer: ReactExpressionRendererType;
   expression: string | null;
-  errors: ErrorMessage[] | undefined;
+  errors: UserMessage[];
   variables?: Record<string, unknown>;
   interactive?: boolean;
   searchContext: ExecutionContextSearch;
@@ -57,8 +57,8 @@ interface VisualizationErrorProps {
 }
 
 export function VisualizationErrorPanel({ errors, canEdit }: VisualizationErrorProps) {
-  const showMore = errors && errors.length > 1;
-  const canFixInLens = canEdit && errors?.some(({ type }) => type === 'fixable');
+  const showMore = errors.length > 1;
+  const canFixInLens = canEdit && errors.some(({ fixableInEditor }) => fixableInEditor);
   return (
     <div className="lnsEmbeddedError">
       <EuiEmptyPrompt
@@ -67,7 +67,7 @@ export function VisualizationErrorPanel({ errors, canEdit }: VisualizationErrorP
         data-test-subj="embeddable-lens-failure"
         body={
           <>
-            {errors ? (
+            {errors.length ? (
               <>
                 <p>{errors[0].longMessage}</p>
                 {showMore && !canFixInLens ? (
@@ -129,7 +129,7 @@ export function ExpressionWrapper({
 }: ExpressionWrapperProps) {
   return (
     <I18nProvider>
-      {errors || expression === null || expression === '' ? (
+      {errors.length || expression === null || expression === '' ? (
         <VisualizationErrorPanel errors={errors} canEdit={canEdit} />
       ) : (
         <div className={classNames('lnsExpressionRenderer', className)} style={style}>
diff --git a/x-pack/plugins/lens/public/mocks/datasource_mock.ts b/x-pack/plugins/lens/public/mocks/datasource_mock.ts
index ab4a5fb519ab5e..34a0c9197d7e35 100644
--- a/x-pack/plugins/lens/public/mocks/datasource_mock.ts
+++ b/x-pack/plugins/lens/public/mocks/datasource_mock.ts
@@ -63,7 +63,7 @@ export function createMockDatasource(
     // this is an additional property which doesn't exist on real datasources
     // but can be used to validate whether specific API mock functions are called
     publicAPIMock,
-    getErrorMessages: jest.fn((_state, _indexPatterns) => undefined),
+    getUserMessages: jest.fn((_state, _deps) => []),
     checkIntegrity: jest.fn((_state, _indexPatterns) => []),
     isTimeBased: jest.fn(),
     isValidColumn: jest.fn(),
diff --git a/x-pack/plugins/lens/public/mocks/visualization_mock.ts b/x-pack/plugins/lens/public/mocks/visualization_mock.ts
index 27a6826e3d08a3..a03914dfdd3967 100644
--- a/x-pack/plugins/lens/public/mocks/visualization_mock.ts
+++ b/x-pack/plugins/lens/public/mocks/visualization_mock.ts
@@ -49,7 +49,6 @@ export function createMockVisualization(id = 'testVis'): jest.Mocked<Visualizati
 
     setDimension: jest.fn(),
     removeDimension: jest.fn(),
-    getErrorMessages: jest.fn((_state) => undefined),
     renderDimensionEditor: jest.fn(),
   };
 }
diff --git a/x-pack/plugins/lens/public/plugin.ts b/x-pack/plugins/lens/public/plugin.ts
index 2b3dce55839782..6db5d4abb90e83 100644
--- a/x-pack/plugins/lens/public/plugin.ts
+++ b/x-pack/plugins/lens/public/plugin.ts
@@ -300,6 +300,7 @@ export class LensPlugin {
         attributeService: getLensAttributeService(coreStart, plugins),
         capabilities: coreStart.application.capabilities,
         coreHttp: coreStart.http,
+        coreStart,
         data: plugins.data,
         timefilter: plugins.data.query.timefilter.timefilter,
         expressionRenderer: plugins.expressions.ReactExpressionRenderer,
diff --git a/x-pack/plugins/lens/public/shared_components/dimension_trigger/index.tsx b/x-pack/plugins/lens/public/shared_components/dimension_trigger/index.tsx
index 25d81424c58df9..320667a73edf26 100644
--- a/x-pack/plugins/lens/public/shared_components/dimension_trigger/index.tsx
+++ b/x-pack/plugins/lens/public/shared_components/dimension_trigger/index.tsx
@@ -31,7 +31,7 @@ export const DimensionTrigger = ({
   id: string;
   isInvalid?: boolean;
   hideTooltip?: boolean;
-  invalidMessage?: string | JSX.Element;
+  invalidMessage?: string | React.ReactNode;
 }) => {
   if (isInvalid) {
     return (
diff --git a/x-pack/plugins/lens/public/state_management/lens_slice.ts b/x-pack/plugins/lens/public/state_management/lens_slice.ts
index da64209a8a80f3..5f00eed48005f0 100644
--- a/x-pack/plugins/lens/public/state_management/lens_slice.ts
+++ b/x-pack/plugins/lens/public/state_management/lens_slice.ts
@@ -5,7 +5,6 @@
  * 2.0.
  */
 
-import type { ReactNode } from 'react';
 import { createAction, createReducer, current, PayloadAction } from '@reduxjs/toolkit';
 import { VisualizeFieldContext } from '@kbn/ui-actions-plugin/public';
 import { mapValues, uniq } from 'lodash';
@@ -125,8 +124,7 @@ export const getPreloadedState = ({
 
 export const setState = createAction<Partial<LensAppState>>('lens/setState');
 export const onActiveDataChange = createAction<{
-  activeData?: TableInspectorAdapter;
-  requestWarnings?: Array<ReactNode | string>;
+  activeData: TableInspectorAdapter;
 }>('lens/onActiveDataChange');
 export const setSaveable = createAction<boolean>('lens/setSaveable');
 export const enableAutoApply = createAction<void>('lens/enableAutoApply');
@@ -286,14 +284,11 @@ export const makeLensReducer = (storeDeps: LensStoreDeps) => {
     },
     [onActiveDataChange.type]: (
       state,
-      {
-        payload: { activeData, requestWarnings },
-      }: PayloadAction<{ activeData: TableInspectorAdapter; requestWarnings?: string[] }>
+      { payload: { activeData } }: PayloadAction<{ activeData: TableInspectorAdapter }>
     ) => {
       return {
         ...state,
-        ...(activeData ? { activeData } : {}),
-        ...(requestWarnings ? { requestWarnings } : {}),
+        activeData,
       };
     },
     [setSaveable.type]: (state, { payload }: PayloadAction<boolean>) => {
diff --git a/x-pack/plugins/lens/public/state_management/selectors.ts b/x-pack/plugins/lens/public/state_management/selectors.ts
index f7402bf2339d32..38286e78a90785 100644
--- a/x-pack/plugins/lens/public/state_management/selectors.ts
+++ b/x-pack/plugins/lens/public/state_management/selectors.ts
@@ -238,3 +238,8 @@ export const selectFramePublicAPI = createSelector(
     };
   }
 );
+
+export const selectFrameDatasourceAPI = createSelector(
+  [selectFramePublicAPI, selectExecutionContext],
+  (framePublicAPI, context) => ({ ...context, ...framePublicAPI })
+);
diff --git a/x-pack/plugins/lens/public/types.ts b/x-pack/plugins/lens/public/types.ts
index 9e226dcdb1edc9..4a2987a6c57466 100644
--- a/x-pack/plugins/lens/public/types.ts
+++ b/x-pack/plugins/lens/public/types.ts
@@ -18,7 +18,6 @@ import type {
   ExpressionRendererEvent,
 } from '@kbn/expressions-plugin/public';
 import type { Configuration, NavigateToLensContext } from '@kbn/visualizations-plugin/common';
-import { Adapters } from '@kbn/inspector-plugin/public';
 import type { Query } from '@kbn/es-query';
 import type {
   UiActionsStart,
@@ -105,6 +104,8 @@ export interface EditorFrameProps {
   showNoDataPopover: () => void;
   lensInspector: LensInspector;
   indexPatternService: IndexPatternServiceAPI;
+  getUserMessages: UserMessagesGetter;
+  addUserMessages: AddUserMessages;
 }
 
 export type VisualizationMap = Record<string, Visualization>;
@@ -272,6 +273,49 @@ interface DimensionLink {
   };
 }
 
+type UserMessageDisplayLocation =
+  | {
+      // NOTE: We want to move toward more errors that do not block the render!
+      id:
+        | 'toolbar'
+        | 'embeddableBadge'
+        | 'visualization' // blocks render
+        | 'visualizationOnEmbeddable' // blocks render in embeddable only
+        | 'visualizationInEditor' // blocks render in editor only
+        | 'textBasedLanguagesQueryInput'
+        | 'banner';
+    }
+  | { id: 'dimensionTrigger'; dimensionId: string };
+
+export type UserMessagesDisplayLocationId = UserMessageDisplayLocation['id'];
+
+export interface UserMessage {
+  uniqueId?: string;
+  severity: 'error' | 'warning';
+  shortMessage: string;
+  longMessage: React.ReactNode | string;
+  fixableInEditor: boolean;
+  displayLocations: UserMessageDisplayLocation[];
+}
+
+export type RemovableUserMessage = UserMessage & { uniqueId: string };
+
+export interface UserMessageFilters {
+  severity?: UserMessage['severity'];
+  dimensionId?: string;
+}
+
+export type UserMessagesGetter = (
+  locationId: UserMessagesDisplayLocationId | UserMessagesDisplayLocationId[] | undefined,
+  filters: UserMessageFilters
+) => UserMessage[];
+
+export type AddUserMessages = (messages: RemovableUserMessage[]) => () => void;
+
+export function isMessageRemovable(message: UserMessage): message is RemovableUserMessage {
+  return Boolean(message.uniqueId);
+}
+
 /**
  * Interface for the datasource registry
  */
@@ -291,7 +335,6 @@ export interface Datasource<T = unknown, P = unknown> {
 
   // Given the current state, which parts should be saved?
   getPersistableState: (state: T) => { state: P; savedObjectReferences: SavedObjectReference[] };
-  getUnifiedSearchErrors?: (state: T) => Error[];
 
   insertLayer: (state: T, newLayerId: string, linkToLayers?: string[]) => T;
   createEmptyLayer: (indexPatternId: string) => T;
@@ -433,28 +476,16 @@ export interface Datasource<T = unknown, P = unknown> {
    */
   checkIntegrity: (state: T, indexPatterns: IndexPatternMap) => string[];
 
-  getErrorMessages: (
-    state: T,
-    indexPatterns: Record<string, IndexPattern>
-  ) =>
-    | Array<{
-        shortMessage: string;
-        longMessage: React.ReactNode;
-        fixAction?: { label: string; newState: () => Promise<T> };
-      }>
-    | undefined;
-
   /**
-   * The frame calls this function to display warnings about visualization
+   * The frame calls this function to display messages to the user
    */
-  getWarningMessages?: (
+  getUserMessages: (
     state: T,
-    frame: FramePublicAPI,
-    adapters: Adapters,
-    setState: StateSetter<T>
-  ) => React.ReactNode[] | undefined;
-
-  getDeprecationMessages?: (state: T) => React.ReactNode[] | undefined;
+    deps: {
+      frame: FrameDatasourceAPI;
+      setState: StateSetter<T>;
+    }
+  ) => UserMessage[];
 
   /**
    * The embeddable calls this function to display warnings about visualization on the dashboard
@@ -464,7 +495,7 @@ export interface Datasource<T = unknown, P = unknown> {
     warning: SearchResponseWarning,
     request: SearchRequest,
     response: estypes.SearchResponse
-  ) => Array<string | React.ReactNode> | undefined;
+  ) => UserMessage[];
 
   /**
    * Checks if the visualization created is time based, for example date histogram
@@ -623,7 +654,7 @@ export type DatasourceDimensionProps<T> = SharedDimensionProps & {
   indexPatterns: IndexPatternMap;
   hideTooltip?: boolean;
   invalid?: boolean;
-  invalidMessage?: string;
+  invalidMessage?: string | React.ReactNode;
 };
 export type ParamEditorCustomProps = Record<string, unknown> & {
   labels?: string[];
@@ -835,9 +866,6 @@ export type VisualizationDimensionGroupConfig = SharedDimensionProps & {
   // this dimension group in the hierarchy. If not specified, the position of the dimension in the array is used. specified nesting
   // orders are always higher in the hierarchy than non-specified ones.
   nestingOrder?: number;
-  // some type of layers can produce groups even if invalid. Keep this information to visually show the user that.
-  invalid?: boolean;
-  invalidMessage?: string;
   // need a special flag to know when to pass the previous column on duplicating
   requiresPreviousColumnOnDuplicate?: boolean;
   supportStaticValue?: boolean;
@@ -1214,7 +1242,7 @@ export interface Visualization<T = unknown, P = unknown> {
     label: string;
     hideTooltip?: boolean;
     invalid?: boolean;
-    invalidMessage?: string;
+    invalidMessage?: string | React.ReactNode;
   }) => JSX.Element | null;
   /**
    * Creates map of columns ids and unique lables. Used only for noDatasource layers
@@ -1246,32 +1274,12 @@ export interface Visualization<T = unknown, P = unknown> {
     datasourceLayers: DatasourceLayers,
     datasourceExpressionsByLayers?: Record<string, Ast>
   ) => ExpressionAstExpression | string | null;
+
   /**
    * The frame will call this function on all visualizations at few stages (pre-build/build error) in order
    * to provide more context to the error and show it to the user
    */
-  getErrorMessages: (
-    state: T,
-    frame?: Pick<FramePublicAPI, 'datasourceLayers' | 'dataViews'>
-  ) =>
-    | Array<{
-        shortMessage: string;
-        longMessage: React.ReactNode;
-      }>
-    | undefined;
-
-  validateColumn?: (
-    state: T,
-    frame: Pick<FramePublicAPI, 'dataViews'>,
-    layerId: string,
-    columnId: string,
-    group?: VisualizationDimensionGroupConfig
-  ) => { invalid: boolean; invalidMessage?: string };
-
-  /**
-   * The frame calls this function to display warnings about visualization
-   */
-  getWarningMessages?: (state: T, frame: FramePublicAPI) => React.ReactNode[] | undefined;
+  getUserMessages?: (state: T, deps: { frame: FramePublicAPI }) => UserMessage[];
 
   /**
    * On Edit events the frame will call this to know what's going to be the next visualization state
diff --git a/x-pack/plugins/lens/public/utils.ts b/x-pack/plugins/lens/public/utils.ts
index c268a79599e77c..ad3d6a61788072 100644
--- a/x-pack/plugins/lens/public/utils.ts
+++ b/x-pack/plugins/lens/public/utils.ts
@@ -16,7 +16,6 @@ import type { DatatableUtilitiesService } from '@kbn/data-plugin/common';
 import { BrushTriggerEvent, ClickTriggerEvent } from '@kbn/charts-plugin/public';
 import { RequestAdapter } from '@kbn/inspector-plugin/common';
 import { ISearchStart } from '@kbn/data-plugin/public';
-import React from 'react';
 import type { Document } from './persistence/saved_object_store';
 import {
   Datasource,
@@ -27,6 +26,7 @@ import {
   DraggedField,
   DragDropOperation,
   isOperation,
+  UserMessage,
 } from './types';
 import type { DatasourceStates, VisualizationState } from './state_management';
 import type { IndexPatternServiceAPI } from './data_views_service/service';
@@ -329,8 +329,8 @@ export const getSearchWarningMessages = (
   deps: {
     searchService: ISearchStart;
   }
-) => {
-  const warningsMap: Map<string, Array<string | React.ReactNode>> = new Map();
+): UserMessage[] => {
+  const warningsMap: Map<string, UserMessage[]> = new Map();
 
   deps.searchService.showWarnings(adapter, (warning, meta) => {
     const { request, response, requestId } = meta;
diff --git a/x-pack/plugins/lens/public/visualization_container.scss b/x-pack/plugins/lens/public/visualization_container.scss
index a20bcef82e17b7..ea4a8bdbce994a 100644
--- a/x-pack/plugins/lens/public/visualization_container.scss
+++ b/x-pack/plugins/lens/public/visualization_container.scss
@@ -25,8 +25,4 @@
   align-items: center;
   justify-content: center;
   overflow: auto;
-}
-
-.lnsSelectableErrorMessage {
-  user-select: text;
 }
\ No newline at end of file
diff --git a/x-pack/plugins/lens/public/visualizations/datatable/visualization.test.tsx b/x-pack/plugins/lens/public/visualizations/datatable/visualization.test.tsx
index a38d669d73cd5a..a6810e77d43885 100644
--- a/x-pack/plugins/lens/public/visualizations/datatable/visualization.test.tsx
+++ b/x-pack/plugins/lens/public/visualizations/datatable/visualization.test.tsx
@@ -695,60 +695,6 @@ describe('Datatable Visualization', () => {
     });
   });
 
-  describe('#getErrorMessages', () => {
-    it('returns undefined if the datasource is missing a metric dimension', () => {
-      const datasource = createMockDatasource('test');
-      const frame = mockFrame();
-      frame.datasourceLayers = { a: datasource.publicAPIMock };
-      datasource.publicAPIMock.getTableSpec.mockReturnValue([
-        { columnId: 'c', fields: [] },
-        { columnId: 'b', fields: [] },
-      ]);
-      datasource.publicAPIMock.getOperationForColumnId.mockReturnValue({
-        dataType: 'string',
-        isBucketed: true, // move it from the metric to the break down by side
-        label: 'label',
-        isStaticValue: false,
-        hasTimeShift: false,
-        hasReducedTimeRange: false,
-      });
-
-      const error = datatableVisualization.getErrorMessages({
-        layerId: 'a',
-        layerType: LayerTypes.DATA,
-        columns: [{ columnId: 'b' }, { columnId: 'c' }],
-      });
-
-      expect(error).toBeUndefined();
-    });
-
-    it('returns undefined if the metric dimension is defined', () => {
-      const datasource = createMockDatasource('test');
-      const frame = mockFrame();
-      frame.datasourceLayers = { a: datasource.publicAPIMock };
-      datasource.publicAPIMock.getTableSpec.mockReturnValue([
-        { columnId: 'c', fields: [] },
-        { columnId: 'b', fields: [] },
-      ]);
-      datasource.publicAPIMock.getOperationForColumnId.mockReturnValue({
-        dataType: 'string',
-        isBucketed: false, // keep it a metric
-        label: 'label',
-        isStaticValue: false,
-        hasTimeShift: false,
-        hasReducedTimeRange: false,
-      });
-
-      const error = datatableVisualization.getErrorMessages({
-        layerId: 'a',
-        layerType: LayerTypes.DATA,
-        columns: [{ columnId: 'b' }, { columnId: 'c' }],
-      });
-
-      expect(error).toBeUndefined();
-    });
-  });
-
   describe('#onEditAction', () => {
     it('should add a sort column to the state', () => {
       const currentState: DatatableVisualizationState = {
diff --git a/x-pack/plugins/lens/public/visualizations/datatable/visualization.tsx b/x-pack/plugins/lens/public/visualizations/datatable/visualization.tsx
index 9e31b0bd0035ec..9b4865d597d888 100644
--- a/x-pack/plugins/lens/public/visualizations/datatable/visualization.tsx
+++ b/x-pack/plugins/lens/public/visualizations/datatable/visualization.tsx
@@ -499,10 +499,6 @@ export const getDatatableVisualization = ({
     };
   },
 
-  getErrorMessages(state) {
-    return undefined;
-  },
-
   getRenderEventCounters(state) {
     const events = {
       color_by_value: false,
diff --git a/x-pack/plugins/lens/public/visualizations/gauge/visualization.test.ts b/x-pack/plugins/lens/public/visualizations/gauge/visualization.test.ts
index 29e14c9412bd1c..9d90fac937bf30 100644
--- a/x-pack/plugins/lens/public/visualizations/gauge/visualization.test.ts
+++ b/x-pack/plugins/lens/public/visualizations/gauge/visualization.test.ts
@@ -345,107 +345,6 @@ describe('gauge', () => {
         ],
       });
     });
-
-    test('resolves configuration when with group error when max < minimum', () => {
-      const state: GaugeVisualizationState = {
-        ...exampleState(),
-        layerId: 'first',
-        metricAccessor: 'metric-accessor',
-        minAccessor: 'min-accessor',
-        maxAccessor: 'max-accessor',
-        goalAccessor: 'goal-accessor',
-      };
-      frame.activeData = {
-        first: {
-          type: 'datatable',
-          columns: [],
-          rows: [{ 'min-accessor': 10, 'max-accessor': 0 }],
-        },
-      };
-
-      expect(
-        getGaugeVisualization({
-          paletteService,
-          theme,
-        }).getConfiguration({ state, frame, layerId: 'first' })
-      ).toEqual({
-        groups: [
-          {
-            layerId: 'first',
-            paramEditorCustomProps: {
-              headingLabel: 'Value',
-            },
-            groupId: GROUP_ID.METRIC,
-            groupLabel: 'Metric',
-            isMetricDimension: true,
-            accessors: [{ columnId: 'metric-accessor', triggerIconType: 'none' }],
-            filterOperations: isNumericDynamicMetric,
-            supportsMoreColumns: false,
-            requiredMinDimensionCount: 1,
-            dataTestSubj: 'lnsGauge_metricDimensionPanel',
-            enableDimensionEditor: true,
-            enableFormatSelector: true,
-          },
-          {
-            layerId: 'first',
-            paramEditorCustomProps: {
-              headingLabel: 'Value',
-              labels: ['Minimum value'],
-            },
-            groupId: GROUP_ID.MIN,
-            groupLabel: 'Minimum value',
-            isMetricDimension: true,
-            accessors: [{ columnId: 'min-accessor' }],
-            filterOperations: isNumericMetric,
-            supportsMoreColumns: false,
-            dataTestSubj: 'lnsGauge_minDimensionPanel',
-            prioritizedOperation: 'min',
-            suggestedValue: expect.any(Function),
-            enableFormatSelector: false,
-            supportStaticValue: true,
-            invalid: true,
-            invalidMessage: 'Minimum value may not be greater than maximum value',
-          },
-          {
-            layerId: 'first',
-            paramEditorCustomProps: {
-              headingLabel: 'Value',
-              labels: ['Maximum value'],
-            },
-            groupId: GROUP_ID.MAX,
-            groupLabel: 'Maximum value',
-            isMetricDimension: true,
-            accessors: [{ columnId: 'max-accessor' }],
-            filterOperations: isNumericMetric,
-            supportsMoreColumns: false,
-            dataTestSubj: 'lnsGauge_maxDimensionPanel',
-            prioritizedOperation: 'max',
-            suggestedValue: expect.any(Function),
-            enableFormatSelector: false,
-            supportStaticValue: true,
-            invalid: true,
-            invalidMessage: 'Minimum value may not be greater than maximum value',
-          },
-          {
-            layerId: 'first',
-            paramEditorCustomProps: {
-              headingLabel: 'Value',
-              labels: ['Goal value'],
-            },
-            groupId: GROUP_ID.GOAL,
-            groupLabel: 'Goal value',
-            isMetricDimension: true,
-            accessors: [{ columnId: 'goal-accessor' }],
-            filterOperations: isNumericMetric,
-            supportsMoreColumns: false,
-            requiredMinDimensionCount: 0,
-            dataTestSubj: 'lnsGauge_goalDimensionPanel',
-            enableFormatSelector: false,
-            supportStaticValue: true,
-          },
-        ],
-      });
-    });
   });
 
   describe('#setDimension', () => {
@@ -607,17 +506,7 @@ describe('gauge', () => {
     });
   });
 
-  describe('#getErrorMessages', () => {
-    it('returns undefined if no error is raised', () => {
-      const error = getGaugeVisualization({
-        paletteService,
-        theme,
-      }).getErrorMessages(exampleState());
-      expect(error).not.toBeDefined();
-    });
-  });
-
-  describe('#getWarningMessages', () => {
+  describe('#getUserMessages', () => {
     beforeEach(() => {
       const mockDatasource = createMockDatasource('testDatasource');
       mockDatasource.publicAPIMock.getOperationForColumnId.mockReturnValue({
@@ -636,6 +525,51 @@ describe('gauge', () => {
       maxAccessor: 'max-accessor',
       goalAccessor: 'goal-accessor',
     };
+
+    it('should report error when max < minimum', () => {
+      const localState: GaugeVisualizationState = {
+        ...exampleState(),
+        layerId: 'first',
+        metricAccessor: 'metric-accessor',
+        minAccessor: 'min-accessor',
+        maxAccessor: 'max-accessor',
+        goalAccessor: 'goal-accessor',
+      };
+      frame.activeData = {
+        first: {
+          type: 'datatable',
+          columns: [],
+          rows: [{ 'min-accessor': 10, 'max-accessor': 0 }],
+        },
+      };
+
+      expect(
+        getGaugeVisualization({
+          paletteService,
+          theme,
+        }).getUserMessages!(localState, { frame })
+      ).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "displayLocations": Array [
+              Object {
+                "dimensionId": "min-accessor",
+                "id": "dimensionTrigger",
+              },
+              Object {
+                "dimensionId": "max-accessor",
+                "id": "dimensionTrigger",
+              },
+            ],
+            "fixableInEditor": true,
+            "longMessage": "",
+            "severity": "error",
+            "shortMessage": "Minimum value may not be greater than maximum value",
+          },
+        ]
+      `);
+    });
+
     it('should not warn for data in bounds', () => {
       frame.activeData = {
         first: {
@@ -656,7 +590,7 @@ describe('gauge', () => {
         getGaugeVisualization({
           paletteService,
           theme,
-        }).getWarningMessages!(state, frame)
+        }).getUserMessages!(state, { frame })
       ).toHaveLength(0);
     });
     it('should warn when minimum value is greater than metric value', () => {
@@ -679,7 +613,7 @@ describe('gauge', () => {
         getGaugeVisualization({
           paletteService,
           theme,
-        }).getWarningMessages!(state, frame)
+        }).getUserMessages!(state, { frame })
       ).toHaveLength(1);
     });
 
@@ -702,7 +636,7 @@ describe('gauge', () => {
         getGaugeVisualization({
           paletteService,
           theme,
-        }).getWarningMessages!(state, frame)
+        }).getUserMessages!(state, { frame })
       ).toHaveLength(1);
     });
     it('should warn when goal value is greater than maximum value', () => {
@@ -725,7 +659,7 @@ describe('gauge', () => {
         getGaugeVisualization({
           paletteService,
           theme,
-        }).getWarningMessages!(state, frame)
+        }).getUserMessages!(state, { frame })
       ).toHaveLength(1);
     });
     it('should warn when minimum value is greater than goal value', () => {
@@ -748,7 +682,7 @@ describe('gauge', () => {
         getGaugeVisualization({
           paletteService,
           theme,
-        }).getWarningMessages!(state, frame)
+        }).getUserMessages!(state, { frame })
       ).toHaveLength(1);
     });
   });
diff --git a/x-pack/plugins/lens/public/visualizations/gauge/visualization.tsx b/x-pack/plugins/lens/public/visualizations/gauge/visualization.tsx
index 26077fd45c566e..d0d999d444196b 100644
--- a/x-pack/plugins/lens/public/visualizations/gauge/visualization.tsx
+++ b/x-pack/plugins/lens/public/visualizations/gauge/visualization.tsx
@@ -25,7 +25,13 @@ import {
 import { IconChartHorizontalBullet, IconChartVerticalBullet } from '@kbn/chart-icons';
 import { LayerTypes } from '@kbn/expression-xy-plugin/public';
 import type { FormBasedPersistedState } from '../../datasources/form_based/types';
-import type { DatasourceLayers, OperationMetadata, Suggestion, Visualization } from '../../types';
+import type {
+  DatasourceLayers,
+  OperationMetadata,
+  Suggestion,
+  UserMessage,
+  Visualization,
+} from '../../types';
 import { getSuggestions } from './suggestions';
 import { GROUP_ID, LENS_GAUGE_ID, GaugeVisualizationState } from './constants';
 import { GaugeToolbar } from './toolbar_component';
@@ -76,35 +82,52 @@ function computePaletteParams(params: CustomPaletteParams) {
   };
 }
 
-const checkInvalidConfiguration = (row?: DatatableRow, state?: GaugeVisualizationState) => {
+const getErrorMessages = (row?: DatatableRow, state?: GaugeVisualizationState): UserMessage[] => {
   if (!row || !state) {
-    return;
+    return [];
   }
+
+  const errors: UserMessage[] = [];
+
   const minAccessor = state?.minAccessor;
   const maxAccessor = state?.maxAccessor;
   const minValue = minAccessor ? getValueFromAccessor(minAccessor, row) : undefined;
   const maxValue = maxAccessor ? getValueFromAccessor(maxAccessor, row) : undefined;
   if (maxValue !== null && maxValue !== undefined && minValue != null && minValue !== undefined) {
     if (maxValue < minValue) {
-      return {
-        invalid: true,
-        invalidMessage: i18n.translate(
+      errors.push({
+        severity: 'error',
+        displayLocations: [
+          { id: 'dimensionTrigger', dimensionId: minAccessor! },
+          { id: 'dimensionTrigger', dimensionId: maxAccessor! },
+        ],
+        fixableInEditor: true,
+        shortMessage: i18n.translate(
           'xpack.lens.guageVisualization.chartCannotRenderMinGreaterMax',
           {
             defaultMessage: 'Minimum value may not be greater than maximum value',
           }
         ),
-      };
+        longMessage: '',
+      });
     }
     if (maxValue === minValue) {
-      return {
-        invalid: true,
-        invalidMessage: i18n.translate('xpack.lens.guageVisualization.chartCannotRenderEqual', {
+      errors.push({
+        severity: 'error',
+        displayLocations: [
+          { id: 'dimensionTrigger', dimensionId: minAccessor! },
+          { id: 'dimensionTrigger', dimensionId: maxAccessor! },
+        ],
+        fixableInEditor: true,
+        shortMessage: i18n.translate('xpack.lens.guageVisualization.chartCannotRenderEqual', {
           defaultMessage: 'Minimum and maximum values may not be equal',
         }),
-      };
+        longMessage: '',
+      });
     }
   }
+
+  return errors;
 };
 
 const toExpression = (
@@ -228,7 +251,6 @@ export const getGaugeVisualization = ({
       const displayStops = applyPaletteParams(paletteService, state?.palette, currentMinMax);
       palette = displayStops.map(({ color }) => color);
     }
-    const invalidProps = checkInvalidConfiguration(row, state) || {};
 
     return {
       groups: [
@@ -290,7 +312,6 @@ export const getGaugeVisualization = ({
           dataTestSubj: 'lnsGauge_minDimensionPanel',
           prioritizedOperation: 'min',
           suggestedValue: () => (state.metricAccessor ? getMinValue(row, accessors) : undefined),
-          ...invalidProps,
         },
         {
           supportStaticValue: true,
@@ -317,7 +338,6 @@ export const getGaugeVisualization = ({
           dataTestSubj: 'lnsGauge_maxDimensionPanel',
           prioritizedOperation: 'max',
           suggestedValue: () => (state.metricAccessor ? getMaxValue(row, accessors) : undefined),
-          ...invalidProps,
         },
         {
           supportStaticValue: true,
@@ -466,67 +486,92 @@ export const getGaugeVisualization = ({
   toPreviewExpression: (state, datasourceLayers, datasourceExpressionsByLayers = {}) =>
     toExpression(paletteService, state, datasourceLayers, undefined, datasourceExpressionsByLayers),
 
-  getErrorMessages(state) {
-    // not possible to break it?
-    return undefined;
-  },
-
-  getWarningMessages(state, frame) {
+  getUserMessages(state, { frame }) {
     const { maxAccessor, minAccessor, goalAccessor, metricAccessor } = state;
     if (!maxAccessor && !minAccessor && !goalAccessor && !metricAccessor) {
       // nothing configured yet
-      return;
+      return [];
     }
     if (!metricAccessor) {
       return [];
     }
 
-    const row = frame?.activeData?.[state.layerId]?.rows?.[0];
-    if (!row || checkInvalidConfiguration(row, state)) {
+    const row = frame.activeData?.[state.layerId]?.rows?.[0];
+    if (!row) {
       return [];
     }
+
+    const errors = getErrorMessages(row, state);
+    if (errors.length) {
+      return errors;
+    }
+
     const metricValue = row[metricAccessor];
     const maxValue = maxAccessor && row[maxAccessor];
     const minValue = minAccessor && row[minAccessor];
     const goalValue = goalAccessor && row[goalAccessor];
 
-    const warnings = [];
+    const warnings: UserMessage[] = [];
     if (typeof minValue === 'number') {
       if (minValue > metricValue) {
-        warnings.push([
-          <FormattedMessage
-            id="xpack.lens.gaugeVisualization.minValueGreaterMetricShortMessage"
-            defaultMessage="Minimum value is greater than metric value."
-          />,
-        ]);
+        warnings.push({
+          severity: 'warning',
+          fixableInEditor: true,
+          displayLocations: [{ id: 'toolbar' }],
+          shortMessage: '',
+          longMessage: (
+            <FormattedMessage
+              id="xpack.lens.gaugeVisualization.minValueGreaterMetricShortMessage"
+              defaultMessage="Minimum value is greater than metric value."
+            />
+          ),
+        });
       }
       if (minValue > goalValue) {
-        warnings.push([
-          <FormattedMessage
-            id="xpack.lens.gaugeVisualization.minimumValueGreaterGoalShortMessage"
-            defaultMessage="Minimum value is greater than goal value."
-          />,
-        ]);
+        warnings.push({
+          severity: 'warning',
+          fixableInEditor: true,
+          displayLocations: [{ id: 'toolbar' }],
+          shortMessage: '',
+          longMessage: (
+            <FormattedMessage
+              id="xpack.lens.gaugeVisualization.minimumValueGreaterGoalShortMessage"
+              defaultMessage="Minimum value is greater than goal value."
+            />
+          ),
+        });
       }
     }
 
     if (typeof maxValue === 'number') {
       if (metricValue > maxValue) {
-        warnings.push([
-          <FormattedMessage
-            id="xpack.lens.gaugeVisualization.metricValueGreaterMaximumShortMessage"
-            defaultMessage="Metric value is greater than maximum value."
-          />,
-        ]);
+        warnings.push({
+          severity: 'warning',
+          fixableInEditor: true,
+          displayLocations: [{ id: 'toolbar' }],
+          shortMessage: '',
+          longMessage: (
+            <FormattedMessage
+              id="xpack.lens.gaugeVisualization.metricValueGreaterMaximumShortMessage"
+              defaultMessage="Metric value is greater than maximum value."
+            />
+          ),
+        });
       }
 
       if (typeof goalValue === 'number' && goalValue > maxValue) {
-        warnings.push([
-          <FormattedMessage
-            id="xpack.lens.gaugeVisualization.goalValueGreaterMaximumShortMessage"
-            defaultMessage="Goal value is greater than maximum value."
-          />,
-        ]);
+        warnings.push({
+          severity: 'warning',
+          fixableInEditor: true,
+          displayLocations: [{ id: 'toolbar' }],
+          shortMessage: '',
+          longMessage: (
+            <FormattedMessage
+              id="xpack.lens.gaugeVisualization.goalValueGreaterMaximumShortMessage"
+              defaultMessage="Goal value is greater than maximum value."
+            />
+          ),
+        });
       }
     }
 
diff --git a/x-pack/plugins/lens/public/visualizations/heatmap/visualization.test.ts b/x-pack/plugins/lens/public/visualizations/heatmap/visualization.test.ts
index 7f6a9caf506fd4..2cb28693396976 100644
--- a/x-pack/plugins/lens/public/visualizations/heatmap/visualization.test.ts
+++ b/x-pack/plugins/lens/public/visualizations/heatmap/visualization.test.ts
@@ -21,7 +21,12 @@ import {
 import { LayerTypes } from '@kbn/expression-xy-plugin/public';
 import { Position } from '@elastic/charts';
 import type { HeatmapVisualizationState } from './types';
-import type { DatasourceLayers, OperationDescriptor } from '../../types';
+import type {
+  DatasourceLayers,
+  FramePublicAPI,
+  OperationDescriptor,
+  UserMessage,
+} from '../../types';
 import { chartPluginMock } from '@kbn/charts-plugin/public/mocks';
 import { themeServiceMock } from '@kbn/core/public/mocks';
 
@@ -581,7 +586,7 @@ describe('heatmap', () => {
     });
   });
 
-  describe('#getErrorMessages', () => {
+  describe('#getUserMessages', () => {
     test('should not return an error when chart has empty configuration', () => {
       const mockState = {
         shape: CHART_SHAPES.HEATMAP,
@@ -590,8 +595,10 @@ describe('heatmap', () => {
         getHeatmapVisualization({
           paletteService,
           theme,
-        }).getErrorMessages(mockState)
-      ).toEqual(undefined);
+        }).getUserMessages!(mockState, {
+          frame: {} as FramePublicAPI,
+        })
+      ).toHaveLength(0);
     });
 
     test('should return an error when the X accessor is missing', () => {
@@ -603,88 +610,108 @@ describe('heatmap', () => {
         getHeatmapVisualization({
           paletteService,
           theme,
-        }).getErrorMessages(mockState)
-      ).toEqual([
-        {
-          longMessage: 'Configuration for the horizontal axis is missing.',
-          shortMessage: 'Missing Horizontal axis.',
-        },
-      ]);
+        }).getUserMessages!(mockState, {
+          frame: {} as FramePublicAPI,
+        })
+      ).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "displayLocations": Array [
+              Object {
+                "id": "visualization",
+              },
+            ],
+            "fixableInEditor": true,
+            "longMessage": "Configuration for the horizontal axis is missing.",
+            "severity": "error",
+            "shortMessage": "Missing Horizontal axis.",
+          },
+        ]
+      `);
     });
-  });
 
-  describe('#getWarningMessages', () => {
-    beforeEach(() => {
-      const mockDatasource = createMockDatasource('testDatasource');
+    describe('warnings', () => {
+      beforeEach(() => {
+        const mockDatasource = createMockDatasource('testDatasource');
 
-      mockDatasource.publicAPIMock.getOperationForColumnId.mockReturnValue({
-        dataType: 'string',
-        label: 'MyOperation',
-      } as OperationDescriptor);
+        mockDatasource.publicAPIMock.getOperationForColumnId.mockReturnValue({
+          dataType: 'string',
+          label: 'MyOperation',
+        } as OperationDescriptor);
 
-      frame.datasourceLayers = {
-        first: mockDatasource.publicAPIMock,
-      };
-    });
+        frame.datasourceLayers = {
+          first: mockDatasource.publicAPIMock,
+        };
+      });
 
-    test('should not return warning messages when the layer it not configured', () => {
-      const mockState = {
-        shape: CHART_SHAPES.HEATMAP,
-        valueAccessor: 'v-accessor',
-      } as HeatmapVisualizationState;
-      expect(
-        getHeatmapVisualization({
-          paletteService,
-          theme,
-        }).getWarningMessages!(mockState, frame)
-      ).toEqual(undefined);
-    });
+      const onlyWarnings = (messages: UserMessage[]) =>
+        messages.filter(({ severity }) => severity === 'warning');
+
+      test('should not return warning messages when the layer it not configured', () => {
+        const mockState = {
+          shape: CHART_SHAPES.HEATMAP,
+          valueAccessor: 'v-accessor',
+        } as HeatmapVisualizationState;
+        expect(
+          onlyWarnings(
+            getHeatmapVisualization({
+              paletteService,
+              theme,
+            }).getUserMessages!(mockState, { frame })
+          )
+        ).toHaveLength(0);
+      });
 
-    test('should not return warning messages when the data table is empty', () => {
-      frame.activeData = {
-        first: {
-          type: 'datatable',
-          rows: [],
-          columns: [],
-        },
-      };
-      const mockState = {
-        shape: CHART_SHAPES.HEATMAP,
-        valueAccessor: 'v-accessor',
-        layerId: 'first',
-      } as HeatmapVisualizationState;
-      expect(
-        getHeatmapVisualization({
-          paletteService,
-          theme,
-        }).getWarningMessages!(mockState, frame)
-      ).toEqual(undefined);
-    });
+      test('should not return warning messages when the data table is empty', () => {
+        frame.activeData = {
+          first: {
+            type: 'datatable',
+            rows: [],
+            columns: [],
+          },
+        };
+        const mockState = {
+          shape: CHART_SHAPES.HEATMAP,
+          valueAccessor: 'v-accessor',
+          layerId: 'first',
+        } as HeatmapVisualizationState;
+        expect(
+          onlyWarnings(
+            getHeatmapVisualization({
+              paletteService,
+              theme,
+            }).getUserMessages!(mockState, { frame })
+          )
+        ).toHaveLength(0);
+      });
 
-    test('should return a warning message when cell value data contains arrays', () => {
-      frame.activeData = {
-        first: {
-          type: 'datatable',
-          rows: [
-            {
-              'v-accessor': [1, 2, 3],
-            },
-          ],
-          columns: [],
-        },
-      };
+      test('should return a warning message when cell value data contains arrays', () => {
+        frame.activeData = {
+          first: {
+            type: 'datatable',
+            rows: [
+              {
+                'v-accessor': [1, 2, 3],
+              },
+            ],
+            columns: [],
+          },
+        };
 
-      const mockState = {
-        shape: CHART_SHAPES.HEATMAP,
-        valueAccessor: 'v-accessor',
-        layerId: 'first',
-      } as HeatmapVisualizationState;
-      expect(
-        getHeatmapVisualization({
-          paletteService,
-          theme,
-        }).getWarningMessages!(mockState, frame)
-      ).toHaveLength(1);
+        const mockState = {
+          shape: CHART_SHAPES.HEATMAP,
+          valueAccessor: 'v-accessor',
+          layerId: 'first',
+        } as HeatmapVisualizationState;
+        expect(
+          onlyWarnings(
+            getHeatmapVisualization({
+              paletteService,
+              theme,
+            }).getUserMessages!(mockState, { frame })
+          )
+        ).toHaveLength(1);
+      });
     });
   });
 });
diff --git a/x-pack/plugins/lens/public/visualizations/heatmap/visualization.tsx b/x-pack/plugins/lens/public/visualizations/heatmap/visualization.tsx
index 1db54423bf1a0f..4450ec558db8b5 100644
--- a/x-pack/plugins/lens/public/visualizations/heatmap/visualization.tsx
+++ b/x-pack/plugins/lens/public/visualizations/heatmap/visualization.tsx
@@ -24,7 +24,7 @@ import {
   HeatmapLegendExpressionFunctionDefinition,
 } from '@kbn/expression-heatmap-plugin/common';
 import { buildExpression, buildExpressionFunction } from '@kbn/expressions-plugin/common';
-import type { OperationMetadata, Suggestion, Visualization } from '../../types';
+import type { OperationMetadata, Suggestion, UserMessage, Visualization } from '../../types';
 import type { HeatmapVisualizationState } from './types';
 import { getSuggestions } from './suggestions';
 import {
@@ -433,16 +433,19 @@ export const getHeatmapVisualization = ({
     };
   },
 
-  getErrorMessages(state) {
+  getUserMessages(state, { frame }) {
     if (!state.yAccessor && !state.xAccessor && !state.valueAccessor) {
       // nothing configured yet
-      return;
+      return [];
     }
 
-    const errors: ReturnType<Visualization['getErrorMessages']> = [];
+    const errors: UserMessage[] = [];
 
     if (!state.xAccessor) {
       errors.push({
+        severity: 'error',
+        fixableInEditor: true,
+        displayLocations: [{ id: 'visualization' }],
         shortMessage: i18n.translate(
           'xpack.lens.heatmapVisualization.missingXAccessorShortMessage',
           {
@@ -455,33 +458,37 @@ export const getHeatmapVisualization = ({
       });
     }
 
-    return errors.length ? errors : undefined;
-  },
-
-  getWarningMessages(state, frame) {
-    if (!state?.layerId || !frame.activeData || !state.valueAccessor) {
-      return;
-    }
-
-    const rows = frame.activeData[state.layerId] && frame.activeData[state.layerId].rows;
-    if (!rows) {
-      return;
+    let warnings: UserMessage[] = [];
+
+    if (state?.layerId && frame.activeData && state.valueAccessor) {
+      const rows = frame.activeData[state.layerId] && frame.activeData[state.layerId].rows;
+      if (rows) {
+        const hasArrayValues = rows.some((row) => Array.isArray(row[state.valueAccessor!]));
+
+        const datasource = frame.datasourceLayers[state.layerId];
+        const operation = datasource?.getOperationForColumnId(state.valueAccessor);
+
+        warnings = hasArrayValues
+          ? [
+              {
+                severity: 'warning',
+                fixableInEditor: true,
+                displayLocations: [{ id: 'toolbar' }],
+                shortMessage: '',
+                longMessage: (
+                  <FormattedMessage
+                    id="xpack.lens.heatmapVisualization.arrayValuesWarningMessage"
+                    defaultMessage="{label} contains array values. Your visualization may not render as expected."
+                    values={{ label: <strong>{operation?.label}</strong> }}
+                  />
+                ),
+              },
+            ]
+          : [];
+      }
     }
 
-    const hasArrayValues = rows.some((row) => Array.isArray(row[state.valueAccessor!]));
-
-    const datasource = frame.datasourceLayers[state.layerId];
-    const operation = datasource?.getOperationForColumnId(state.valueAccessor);
-
-    return hasArrayValues
-      ? [
-          <FormattedMessage
-            id="xpack.lens.heatmapVisualization.arrayValuesWarningMessage"
-            defaultMessage="{label} contains array values. Your visualization may not render as expected."
-            values={{ label: <strong>{operation?.label}</strong> }}
-          />,
-        ]
-      : undefined;
+    return [...errors, ...warnings];
   },
 
   getSuggestionFromConvertToLensContext({ suggestions, context }) {
diff --git a/x-pack/plugins/lens/public/visualizations/legacy_metric/visualization.test.ts b/x-pack/plugins/lens/public/visualizations/legacy_metric/visualization.test.ts
index ebb84b8da1b715..d6a70ddbe71143 100644
--- a/x-pack/plugins/lens/public/visualizations/legacy_metric/visualization.test.ts
+++ b/x-pack/plugins/lens/public/visualizations/legacy_metric/visualization.test.ts
@@ -384,12 +384,4 @@ describe('metric_visualization', () => {
       `);
     });
   });
-
-  describe('#getErrorMessages', () => {
-    it('returns undefined if no error is raised', () => {
-      const error = metricVisualization.getErrorMessages(exampleState());
-
-      expect(error).not.toBeDefined();
-    });
-  });
 });
diff --git a/x-pack/plugins/lens/public/visualizations/legacy_metric/visualization.tsx b/x-pack/plugins/lens/public/visualizations/legacy_metric/visualization.tsx
index 499003dd87319c..957010b5b131ee 100644
--- a/x-pack/plugins/lens/public/visualizations/legacy_metric/visualization.tsx
+++ b/x-pack/plugins/lens/public/visualizations/legacy_metric/visualization.tsx
@@ -312,11 +312,6 @@ export const getLegacyMetricVisualization = ({
     );
   },
 
-  getErrorMessages(state) {
-    // Is it possible to break it?
-    return undefined;
-  },
-
   getVisualizationInfo(state: LegacyMetricState) {
     const dimensions = [];
     if (state.accessor) {
diff --git a/x-pack/plugins/lens/public/visualizations/metric/visualization.tsx b/x-pack/plugins/lens/public/visualizations/metric/visualization.tsx
index 2a77ce35be48c9..380c63975a977a 100644
--- a/x-pack/plugins/lens/public/visualizations/metric/visualization.tsx
+++ b/x-pack/plugins/lens/public/visualizations/metric/visualization.tsx
@@ -634,11 +634,6 @@ export const getMetricVisualization = ({
     );
   },
 
-  getErrorMessages(state) {
-    // Is it possible to break it?
-    return undefined;
-  },
-
   getDisplayOptions() {
     return {
       noPanelTitle: true,
diff --git a/x-pack/plugins/lens/public/visualizations/partition/visualization.test.ts b/x-pack/plugins/lens/public/visualizations/partition/visualization.test.ts
index 8617a2f0f76640..2bf830c0028cd8 100644
--- a/x-pack/plugins/lens/public/visualizations/partition/visualization.test.ts
+++ b/x-pack/plugins/lens/public/visualizations/partition/visualization.test.ts
@@ -72,7 +72,7 @@ function mockFrame(): FramePublicAPI {
 describe('pie_visualization', () => {
   beforeEach(() => jest.clearAllMocks());
 
-  describe('#getErrorMessages', () => {
+  describe('#getUserMessages', () => {
     describe('too many dimensions', () => {
       const state = { ...getExampleState(), shape: PieChartTypes.MOSAIC };
       const colIds = new Array(PartitionChartsMeta.mosaic.maxBuckets + 1)
@@ -83,7 +83,9 @@ describe('pie_visualization', () => {
       state.layers[0].secondaryGroups = colIds.slice(2);
 
       it('returns error', () => {
-        expect(pieVisualization.getErrorMessages(state)).toHaveLength(1);
+        expect(
+          pieVisualization.getUserMessages!(state, { frame: {} as FramePublicAPI })
+        ).toHaveLength(1);
       });
 
       it("doesn't count collapsed dimensions", () => {
@@ -92,17 +94,23 @@ describe('pie_visualization', () => {
           [colIds[0]]: 'some-fn' as CollapseFunction,
         };
 
-        expect(pieVisualization.getErrorMessages(localState)).toHaveLength(0);
+        expect(
+          pieVisualization.getUserMessages!(localState, { frame: {} as FramePublicAPI })
+        ).toHaveLength(0);
       });
 
       it('counts multiple metrics as an extra bucket dimension', () => {
         const localState = cloneDeep(state);
         localState.layers[0].primaryGroups.pop();
-        expect(pieVisualization.getErrorMessages(localState)).toHaveLength(0);
+        expect(
+          pieVisualization.getUserMessages!(localState, { frame: {} as FramePublicAPI })
+        ).toHaveLength(0);
 
         localState.layers[0].metrics.push('one-metric', 'another-metric');
 
-        expect(pieVisualization.getErrorMessages(localState)).toHaveLength(1);
+        expect(
+          pieVisualization.getUserMessages!(localState, { frame: {} as FramePublicAPI })
+        ).toHaveLength(1);
       });
     });
   });
diff --git a/x-pack/plugins/lens/public/visualizations/partition/visualization.tsx b/x-pack/plugins/lens/public/visualizations/partition/visualization.tsx
index 4c214de970e826..cedfb12f72df79 100644
--- a/x-pack/plugins/lens/public/visualizations/partition/visualization.tsx
+++ b/x-pack/plugins/lens/public/visualizations/partition/visualization.tsx
@@ -25,6 +25,7 @@ import type {
   Suggestion,
   VisualizeEditorContext,
   VisualizationInfo,
+  UserMessage,
 } from '../../types';
 import {
   getColumnToLabelMap,
@@ -508,66 +509,6 @@ export const getPieVisualization = ({
     );
   },
 
-  getWarningMessages(state, frame) {
-    if (state?.layers.length === 0 || !frame.activeData) {
-      return;
-    }
-    const warningMessages = [];
-
-    for (const layer of state.layers) {
-      const { layerId, metrics } = layer;
-      const rows = frame.activeData[layerId]?.rows;
-      const numericColumn = frame.activeData[layerId]?.columns.find(
-        ({ meta }) => meta?.type === 'number'
-      );
-
-      if (!rows || !metrics.length) {
-        break;
-      }
-
-      if (
-        numericColumn &&
-        state.shape === 'waffle' &&
-        layer.primaryGroups.length &&
-        checkTableForContainsSmallValues(frame.activeData[layerId], numericColumn.id, 1)
-      ) {
-        warningMessages.push(
-          <FormattedMessage
-            id="xpack.lens.pie.smallValuesWarningMessage"
-            defaultMessage="Waffle charts are unable to effectively display small field values. To display all field values, use the Data table or Treemap."
-          />
-        );
-      }
-
-      const metricsWithArrayValues = metrics
-        .map((metricColId) => {
-          if (rows.some((row) => Array.isArray(row[metricColId]))) {
-            return metricColId;
-          }
-        })
-        .filter(Boolean) as string[];
-
-      if (metricsWithArrayValues.length) {
-        const labels = metricsWithArrayValues.map(
-          (colId) => frame.datasourceLayers[layerId]?.getOperationForColumnId(colId)?.label || colId
-        );
-        warningMessages.push(
-          <FormattedMessage
-            key={labels.join(',')}
-            id="xpack.lens.pie.arrayValues"
-            defaultMessage="The following dimensions contain array values: {label}. Your visualization may not render as
-        expected."
-            values={{
-              label: <strong>{labels.join(', ')}</strong>,
-            }}
-          />
-        );
-      }
-    }
-
-    return warningMessages;
-  },
-
   getSuggestionFromConvertToLensContext(props) {
     const context = props.context;
     if (!isPartitionVisConfiguration(context)) {
@@ -592,7 +533,7 @@ export const getPieVisualization = ({
     return suggestion;
   },
 
-  getErrorMessages(state) {
+  getUserMessages(state, { frame }) {
     const hasTooManyBucketDimensions = state.layers
       .map((layer) => {
         const totalBucketDimensions =
@@ -605,9 +546,12 @@ export const getPieVisualization = ({
       })
       .some(Boolean);
 
-    return hasTooManyBucketDimensions
+    const errors: UserMessage[] = hasTooManyBucketDimensions
       ? [
           {
+            severity: 'error',
+            fixableInEditor: true,
+            displayLocations: [{ id: 'visualization' }],
             shortMessage: i18n.translate('xpack.lens.pie.tooManyDimensions', {
               defaultMessage: 'Your visualization has too many dimensions.',
             }),
@@ -626,6 +570,75 @@ export const getPieVisualization = ({
           },
         ]
       : [];
+
+    const warningMessages: UserMessage[] = [];
+    if (state?.layers.length > 0 && frame.activeData) {
+      for (const layer of state.layers) {
+        const { layerId, metrics } = layer;
+        const rows = frame.activeData[layerId]?.rows;
+        const numericColumn = frame.activeData[layerId]?.columns.find(
+          ({ meta }) => meta?.type === 'number'
+        );
+
+        if (!rows || !metrics.length) {
+          break;
+        }
+
+        if (
+          numericColumn &&
+          state.shape === 'waffle' &&
+          layer.primaryGroups.length &&
+          checkTableForContainsSmallValues(frame.activeData[layerId], numericColumn.id, 1)
+        ) {
+          warningMessages.push({
+            severity: 'warning',
+            fixableInEditor: true,
+            displayLocations: [{ id: 'toolbar' }],
+            shortMessage: '',
+            longMessage: (
+              <FormattedMessage
+                id="xpack.lens.pie.smallValuesWarningMessage"
+                defaultMessage="Waffle charts are unable to effectively display small field values. To display all field values, use the Data table or Treemap."
+              />
+            ),
+          });
+        }
+
+        const metricsWithArrayValues = metrics
+          .map((metricColId) => {
+            if (rows.some((row) => Array.isArray(row[metricColId]))) {
+              return metricColId;
+            }
+          })
+          .filter(Boolean) as string[];
+
+        if (metricsWithArrayValues.length) {
+          const labels = metricsWithArrayValues.map(
+            (colId) =>
+              frame.datasourceLayers[layerId]?.getOperationForColumnId(colId)?.label || colId
+          );
+          warningMessages.push({
+            severity: 'warning',
+            fixableInEditor: true,
+            displayLocations: [{ id: 'toolbar' }],
+            shortMessage: '',
+            longMessage: (
+              <FormattedMessage
+                key={labels.join(',')}
+                id="xpack.lens.pie.arrayValues"
+                defaultMessage="The following dimensions contain array values: {label}. Your visualization may not render as
+          expected."
+                values={{
+                  label: <strong>{labels.join(', ')}</strong>,
+                }}
+              />
+            ),
+          });
+        }
+      }
+    }
+
+    return [...errors, ...warningMessages];
   },
 
   getVisualizationInfo(state: PieVisualizationState) {
diff --git a/x-pack/plugins/lens/public/visualizations/xy/annotations/helpers.tsx b/x-pack/plugins/lens/public/visualizations/xy/annotations/helpers.tsx
index 9d1a7a33421e22..c63fc226907c5a 100644
--- a/x-pack/plugins/lens/public/visualizations/xy/annotations/helpers.tsx
+++ b/x-pack/plugins/lens/public/visualizations/xy/annotations/helpers.tsx
@@ -44,7 +44,7 @@ export const defaultRangeAnnotationLabel = i18n.translate(
   }
 );
 
-const isDateHistogram = (
+export const isDateHistogram = (
   dataLayers: XYDataLayerConfig[],
   frame?: Pick<FramePublicAPI, 'activeData' | 'datasourceLayers'> | undefined
 ) =>
@@ -475,8 +475,6 @@ export const getAnnotationsConfiguration = ({
   frame: Pick<FramePublicAPI, 'datasourceLayers'>;
   layer: XYAnnotationLayerConfig;
 }) => {
-  const hasDateHistogram = isDateHistogram(getDataLayers(state.layers), frame);
-
   const groupLabel = getAxisName('x', { isHorizontal: isHorizontalChart(state.layers) });
 
   const emptyButtonLabels = {
@@ -503,10 +501,6 @@ export const getAnnotationsConfiguration = ({
         ),
         accessors: getAnnotationsAccessorColorConfig(layer),
         dataTestSubj: 'lnsXY_xAnnotationsPanel',
-        invalid: !hasDateHistogram,
-        invalidMessage: i18n.translate('xpack.lens.xyChart.addAnnotationsLayerLabelDisabledHelp', {
-          defaultMessage: 'Annotations require a time based chart to work. Add a date histogram.',
-        }),
         requiredMinDimensionCount: 0,
         supportsMoreColumns: true,
         supportFieldFormat: false,
diff --git a/x-pack/plugins/lens/public/visualizations/xy/state_helpers.ts b/x-pack/plugins/lens/public/visualizations/xy/state_helpers.ts
index a84168b009f9e0..236cd25dd2e2db 100644
--- a/x-pack/plugins/lens/public/visualizations/xy/state_helpers.ts
+++ b/x-pack/plugins/lens/public/visualizations/xy/state_helpers.ts
@@ -12,12 +12,8 @@ import { isQueryAnnotationConfig } from '@kbn/event-annotation-plugin/public';
 import { i18n } from '@kbn/i18n';
 import { VisualizeFieldContext } from '@kbn/ui-actions-plugin/public';
 import { validateQuery } from '../../shared_components';
-import type {
-  FramePublicAPI,
-  DatasourcePublicAPI,
-  VisualizationDimensionGroupConfig,
-  VisualizeEditorContext,
-} from '../../types';
+import { DataViewsState } from '../../state_management';
+import type { FramePublicAPI, DatasourcePublicAPI, VisualizeEditorContext } from '../../types';
 import {
   visualizationTypes,
   XYLayerConfig,
@@ -27,7 +23,6 @@ import {
   YConfig,
   XYState,
   XYPersistedState,
-  State,
   XYAnnotationLayerConfig,
 } from './types';
 import { getDataLayers, isAnnotationsLayer, isDataLayer } from './visualization_helpers';
@@ -177,29 +172,18 @@ function getIndexPatternIdFromInitialContext(
   }
 }
 
-export function validateColumn(
-  state: State,
-  frame: Pick<FramePublicAPI, 'dataViews'>,
-  layerId: string,
+export function getAnnotationLayerErrors(
+  layer: XYAnnotationLayerConfig,
   columnId: string,
-  group?: VisualizationDimensionGroupConfig
-): { invalid: boolean; invalidMessages?: string[] } {
-  if (group?.invalid) {
-    return {
-      invalid: true,
-      invalidMessages: group.invalidMessage ? [group.invalidMessage] : undefined,
-    };
-  }
-  const validColumn = { invalid: false };
-  const layer = state.layers.find((l) => l.layerId === layerId);
-  if (!layer || !isAnnotationsLayer(layer)) {
-    return validColumn;
+  dataViews: DataViewsState
+): string[] {
+  if (!layer) {
+    return [];
   }
   const annotation = layer.annotations.find(({ id }) => id === columnId);
   if (!annotation || !isQueryAnnotationConfig(annotation)) {
-    return validColumn;
+    return [];
   }
-  const { dataViews } = frame || {};
   const layerDataView = dataViews.indexPatterns[layer.indexPatternId];
 
   const invalidMessages: string[] = [];
@@ -255,11 +239,5 @@ export function validateColumn(
     }
   }
 
-  if (!invalidMessages.length) {
-    return validColumn;
-  }
-  return {
-    invalid: true,
-    invalidMessages,
-  };
+  return invalidMessages;
 }
diff --git a/x-pack/plugins/lens/public/visualizations/xy/visualization.test.ts b/x-pack/plugins/lens/public/visualizations/xy/visualization.test.ts
index 2000f0714687f5..e7395bf08f81f5 100644
--- a/x-pack/plugins/lens/public/visualizations/xy/visualization.test.ts
+++ b/x-pack/plugins/lens/public/visualizations/xy/visualization.test.ts
@@ -7,7 +7,13 @@
 
 import { getXyVisualization } from './visualization';
 import { Position } from '@elastic/charts';
-import { Operation, OperationDescriptor, DatasourcePublicAPI } from '../../types';
+import {
+  Operation,
+  OperationDescriptor,
+  DatasourcePublicAPI,
+  FramePublicAPI,
+  UserMessage,
+} from '../../types';
 import type {
   State,
   XYState,
@@ -15,6 +21,7 @@ import type {
   XYDataLayerConfig,
   XYReferenceLineLayerConfig,
   SeriesType,
+  XYPersistedState,
 } from './types';
 import { createMockDatasource, createMockFramePublicAPI } from '../../mocks';
 import { IconChartBar, IconCircle } from '@kbn/chart-icons';
@@ -31,7 +38,7 @@ import { createMockedIndexPattern } from '../../datasources/form_based/mocks';
 import { createMockDataViewsState } from '../../data_views_service/mocks';
 import { unifiedSearchPluginMock } from '@kbn/unified-search-plugin/public/mocks';
 import { KEEP_GLOBAL_FILTERS_ACTION_ID } from './annotations/actions';
-import { layerTypes } from '../..';
+import { layerTypes, Visualization } from '../..';
 
 const exampleAnnotation: EventAnnotationConfig = {
   id: 'an1',
@@ -1990,18 +1997,6 @@ describe('xy_visualization', () => {
             triggerIconType: 'custom',
           },
         ]);
-        expect(config.groups[0].invalid).toEqual(false);
-      });
-
-      it('When data layer is empty, should return invalid state', () => {
-        const state = getStateWithAnnotationLayer();
-        (state.layers[0] as XYDataLayerConfig).xAccessor = undefined;
-        const config = xyVisualization.getConfiguration({
-          state,
-          frame,
-          layerId: 'annotations',
-        });
-        expect(config.groups[0].invalid).toEqual(true);
       });
     });
 
@@ -2170,544 +2165,640 @@ describe('xy_visualization', () => {
     });
   });
 
-  describe('#getErrorMessages', () => {
-    let mockDatasource: ReturnType<typeof createMockDatasource>;
-    let frame: ReturnType<typeof createMockFramePublicAPI>;
-
-    beforeEach(() => {
-      frame = createMockFramePublicAPI();
-      mockDatasource = createMockDatasource('testDatasource');
+  describe('#getUserMessages', () => {
+    describe('errors', () => {
+      let mockDatasource: ReturnType<typeof createMockDatasource>;
+      let frame: ReturnType<typeof createMockFramePublicAPI>;
 
-      mockDatasource.publicAPIMock.getOperationForColumnId.mockReturnValue({
-        dataType: 'string',
-        label: 'MyOperation',
-      } as OperationDescriptor);
+      beforeEach(() => {
+        frame = createMockFramePublicAPI();
+        mockDatasource = createMockDatasource('testDatasource');
 
-      frame.datasourceLayers = {
-        first: mockDatasource.publicAPIMock,
-      };
-    });
+        mockDatasource.publicAPIMock.getOperationForColumnId.mockReturnValue({
+          dataType: 'string',
+          label: 'MyOperation',
+        } as OperationDescriptor);
 
-    it("should not return an error when there's only one dimension (X or Y)", () => {
-      expect(
-        xyVisualization.getErrorMessages({
-          ...exampleState(),
-          layers: [
-            {
-              layerId: 'first',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: 'a',
-              accessors: [],
-            },
-          ],
-        })
-      ).not.toBeDefined();
-    });
-    it("should not return an error when there's only one dimension on multiple layers (same axis everywhere)", () => {
-      expect(
-        xyVisualization.getErrorMessages({
-          ...exampleState(),
-          layers: [
-            {
-              layerId: 'first',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: 'a',
-              accessors: [],
-            },
-            {
-              layerId: 'second',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: 'a',
-              accessors: [],
-            },
-          ],
-        })
-      ).not.toBeDefined();
-    });
-    it('should not return an error when mixing different valid configurations in multiple layers', () => {
-      expect(
-        xyVisualization.getErrorMessages({
-          ...exampleState(),
-          layers: [
-            {
-              layerId: 'first',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: 'a',
-              accessors: ['a'],
-            },
-            {
-              layerId: 'second',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: undefined,
-              accessors: ['a'],
-              splitAccessor: 'a',
-            },
-          ],
-        })
-      ).not.toBeDefined();
-    });
-    it("should not return an error when there's only one splitAccessor dimension configured", () => {
-      expect(
-        xyVisualization.getErrorMessages({
-          ...exampleState(),
-          layers: [
-            {
-              layerId: 'first',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: undefined,
-              accessors: [],
-              splitAccessor: 'a',
-            },
-          ],
-        })
-      ).not.toBeDefined();
+        frame.datasourceLayers = {
+          first: mockDatasource.publicAPIMock,
+        };
+      });
 
-      expect(
-        xyVisualization.getErrorMessages({
-          ...exampleState(),
-          layers: [
-            {
-              layerId: 'first',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: undefined,
-              accessors: [],
-              splitAccessor: 'a',
-            },
-            {
-              layerId: 'second',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: undefined,
-              accessors: [],
-              splitAccessor: 'a',
-            },
-          ],
-        })
-      ).not.toBeDefined();
-    });
-    it('should return an error when there are multiple layers, one axis configured for each layer (but different axis from each other)', () => {
-      expect(
-        xyVisualization.getErrorMessages({
-          ...exampleState(),
-          layers: [
-            {
-              layerId: 'first',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: 'a',
-              accessors: [],
-            },
-            {
-              layerId: 'second',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: undefined,
-              accessors: ['a'],
-            },
-          ],
-        })
-      ).toEqual([
-        {
-          shortMessage: 'Missing Vertical axis.',
-          longMessage: 'Layer 1 requires a field for the Vertical axis.',
-        },
-      ]);
-    });
-    it('should return an error with batched messages for the same error with multiple layers', () => {
-      expect(
-        xyVisualization.getErrorMessages({
-          ...exampleState(),
-          layers: [
-            {
-              layerId: 'first',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: 'a',
-              accessors: ['a'],
-            },
-            {
-              layerId: 'second',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: undefined,
-              accessors: [],
-              splitAccessor: 'a',
-            },
-            {
-              layerId: 'third',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: undefined,
-              accessors: [],
-              splitAccessor: 'a',
-            },
-          ],
-        })
-      ).toEqual([
-        {
-          shortMessage: 'Missing Vertical axis.',
-          longMessage: 'Layers 2, 3 require a field for the Vertical axis.',
-        },
-      ]);
-    });
-    it("should return an error when some layers are complete but other layers aren't", () => {
-      expect(
-        xyVisualization.getErrorMessages({
-          ...exampleState(),
-          layers: [
-            {
-              layerId: 'first',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: 'a',
-              accessors: [],
-            },
-            {
-              layerId: 'second',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: 'a',
-              accessors: ['a'],
-            },
-            {
-              layerId: 'third',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: 'a',
-              accessors: ['a'],
-            },
-          ],
-        })
-      ).toEqual([
-        {
-          shortMessage: 'Missing Vertical axis.',
-          longMessage: 'Layer 1 requires a field for the Vertical axis.',
-        },
-      ]);
-    });
+      const getErrorMessages = (
+        vis: Visualization<XYState, XYPersistedState>,
+        state: XYState,
+        frameMock = { datasourceLayers: {} } as Partial<FramePublicAPI>
+      ) =>
+        vis.getUserMessages!(state, { frame: frameMock as FramePublicAPI })
+          .filter(({ severity }) => severity === 'error')
+          .map((error) => ({ shortMessage: error.shortMessage, longMessage: error.longMessage }));
 
-    it('should return an error when accessor type is of the wrong type', () => {
-      expect(
-        xyVisualization.getErrorMessages(
-          {
+      it("should not return an error when there's only one dimension (X or Y)", () => {
+        expect(
+          getErrorMessages(xyVisualization, {
             ...exampleState(),
             layers: [
               {
                 layerId: 'first',
                 layerType: layerTypes.DATA,
                 seriesType: 'area',
-                splitAccessor: 'd',
                 xAccessor: 'a',
-                accessors: ['b'], // just use a single accessor to avoid too much noise
+                accessors: [],
               },
             ],
-          },
-          { datasourceLayers: frame.datasourceLayers, dataViews: {} as DataViewsState }
-        )
-      ).toEqual([
-        {
-          shortMessage: 'Wrong data type for Vertical axis.',
-          longMessage:
-            'The dimension MyOperation provided for the Vertical axis has the wrong data type. Expected number but have string',
-        },
-      ]);
-    });
-
-    it('should return an error if two incompatible xAccessors (multiple layers) are used', () => {
-      // current incompatibility is only for date and numeric histograms as xAccessors
-      const datasourceLayers = {
-        first: mockDatasource.publicAPIMock,
-        second: createMockDatasource('testDatasource').publicAPIMock,
-      };
-      datasourceLayers.first.getOperationForColumnId = jest.fn((id: string) =>
-        id === 'a'
-          ? ({
-              dataType: 'date',
-              scale: 'interval',
-            } as unknown as OperationDescriptor)
-          : null
-      );
-      datasourceLayers.second.getOperationForColumnId = jest.fn((id: string) =>
-        id === 'e'
-          ? ({
-              dataType: 'number',
-              scale: 'interval',
-            } as unknown as OperationDescriptor)
-          : null
-      );
-      expect(
-        xyVisualization.getErrorMessages(
-          {
+          })
+        ).toHaveLength(0);
+      });
+      it("should not return an error when there's only one dimension on multiple layers (same axis everywhere)", () => {
+        expect(
+          getErrorMessages(xyVisualization, {
             ...exampleState(),
             layers: [
               {
                 layerId: 'first',
                 layerType: layerTypes.DATA,
                 seriesType: 'area',
-                splitAccessor: 'd',
                 xAccessor: 'a',
-                accessors: ['b'],
+                accessors: [],
               },
               {
                 layerId: 'second',
                 layerType: layerTypes.DATA,
                 seriesType: 'area',
-                splitAccessor: 'd',
-                xAccessor: 'e',
-                accessors: ['b'],
+                xAccessor: 'a',
+                accessors: [],
               },
             ],
-          },
-          { datasourceLayers, dataViews: {} as DataViewsState }
-        )
-      ).toEqual([
-        {
-          shortMessage: 'Wrong data type for Horizontal axis.',
-          longMessage:
-            'The Horizontal axis data in layer 1 is incompatible with the data in layer 2. Select a new function for the Horizontal axis.',
-        },
-      ]);
-    });
-
-    it('should return an error if string and date histogram xAccessors (multiple layers) are used together', () => {
-      // current incompatibility is only for date and numeric histograms as xAccessors
-      const datasourceLayers = {
-        first: mockDatasource.publicAPIMock,
-        second: createMockDatasource('testDatasource').publicAPIMock,
-      };
-      datasourceLayers.first.getOperationForColumnId = jest.fn((id: string) =>
-        id === 'a'
-          ? ({
-              dataType: 'date',
-              scale: 'interval',
-            } as unknown as OperationDescriptor)
-          : null
-      );
-      datasourceLayers.second.getOperationForColumnId = jest.fn((id: string) =>
-        id === 'e'
-          ? ({
-              dataType: 'string',
-              scale: 'ordinal',
-            } as unknown as OperationDescriptor)
-          : null
-      );
-      expect(
-        xyVisualization.getErrorMessages(
-          {
+          })
+        ).toHaveLength(0);
+      });
+      it('should not return an error when mixing different valid configurations in multiple layers', () => {
+        expect(
+          getErrorMessages(xyVisualization, {
             ...exampleState(),
             layers: [
               {
                 layerId: 'first',
                 layerType: layerTypes.DATA,
                 seriesType: 'area',
-                splitAccessor: 'd',
                 xAccessor: 'a',
-                accessors: ['b'],
+                accessors: ['a'],
               },
               {
                 layerId: 'second',
                 layerType: layerTypes.DATA,
                 seriesType: 'area',
-                splitAccessor: 'd',
-                xAccessor: 'e',
-                accessors: ['b'],
+                xAccessor: undefined,
+                accessors: ['a'],
+                splitAccessor: 'a',
               },
             ],
-          },
-          { datasourceLayers, dataViews: {} as DataViewsState }
-        )
-      ).toEqual([
-        {
-          shortMessage: 'Wrong data type for Horizontal axis.',
-          longMessage:
-            'The Horizontal axis data in layer 1 is incompatible with the data in layer 2. Select a new function for the Horizontal axis.',
-        },
-      ]);
-    });
+          })
+        ).toHaveLength(0);
+      });
+      it("should not return an error when there's only one splitAccessor dimension configured", () => {
+        expect(
+          getErrorMessages(xyVisualization, {
+            ...exampleState(),
+            layers: [
+              {
+                layerId: 'first',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                xAccessor: undefined,
+                accessors: [],
+                splitAccessor: 'a',
+              },
+            ],
+          })
+        ).toHaveLength(0);
 
-    describe('Annotation layers', () => {
-      function createStateWithAnnotationProps(annotation: Partial<EventAnnotationConfig>) {
-        return {
-          layers: [
+        expect(
+          getErrorMessages(xyVisualization, {
+            ...exampleState(),
+            layers: [
+              {
+                layerId: 'first',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                xAccessor: undefined,
+                accessors: [],
+                splitAccessor: 'a',
+              },
+              {
+                layerId: 'second',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                xAccessor: undefined,
+                accessors: [],
+                splitAccessor: 'a',
+              },
+            ],
+          })
+        ).toHaveLength(0);
+      });
+      it('should return an error when there are multiple layers, one axis configured for each layer (but different axis from each other)', () => {
+        expect(
+          getErrorMessages(xyVisualization, {
+            ...exampleState(),
+            layers: [
+              {
+                layerId: 'first',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                xAccessor: 'a',
+                accessors: [],
+              },
+              {
+                layerId: 'second',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                xAccessor: undefined,
+                accessors: ['a'],
+              },
+            ],
+          })
+        ).toEqual([
+          {
+            shortMessage: 'Missing Vertical axis.',
+            longMessage: 'Layer 1 requires a field for the Vertical axis.',
+          },
+        ]);
+      });
+      it('should return an error with batched messages for the same error with multiple layers', () => {
+        expect(
+          getErrorMessages(xyVisualization, {
+            ...exampleState(),
+            layers: [
+              {
+                layerId: 'first',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                xAccessor: 'a',
+                accessors: ['a'],
+              },
+              {
+                layerId: 'second',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                xAccessor: undefined,
+                accessors: [],
+                splitAccessor: 'a',
+              },
+              {
+                layerId: 'third',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                xAccessor: undefined,
+                accessors: [],
+                splitAccessor: 'a',
+              },
+            ],
+          })
+        ).toEqual([
+          {
+            shortMessage: 'Missing Vertical axis.',
+            longMessage: 'Layers 2, 3 require a field for the Vertical axis.',
+          },
+        ]);
+      });
+      it("should return an error when some layers are complete but other layers aren't", () => {
+        expect(
+          getErrorMessages(xyVisualization, {
+            ...exampleState(),
+            layers: [
+              {
+                layerId: 'first',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                xAccessor: 'a',
+                accessors: [],
+              },
+              {
+                layerId: 'second',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                xAccessor: 'a',
+                accessors: ['a'],
+              },
+              {
+                layerId: 'third',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                xAccessor: 'a',
+                accessors: ['a'],
+              },
+            ],
+          })
+        ).toEqual([
+          {
+            shortMessage: 'Missing Vertical axis.',
+            longMessage: 'Layer 1 requires a field for the Vertical axis.',
+          },
+        ]);
+      });
+
+      it('should return an error when accessor type is of the wrong type', () => {
+        expect(
+          getErrorMessages(
+            xyVisualization,
             {
-              layerId: 'layerId',
-              layerType: 'annotations',
-              indexPatternId: 'first',
-              annotations: [
+              ...exampleState(),
+              layers: [
                 {
-                  label: 'Event',
-                  id: '1',
-                  type: 'query',
-                  timeField: 'start_date',
-                  ...annotation,
+                  layerId: 'first',
+                  layerType: layerTypes.DATA,
+                  seriesType: 'area',
+                  splitAccessor: 'd',
+                  xAccessor: 'a',
+                  accessors: ['b'], // just use a single accessor to avoid too much noise
                 },
               ],
             },
-          ],
-        } as XYState;
-      }
+            { datasourceLayers: frame.datasourceLayers, dataViews: {} as DataViewsState }
+          )
+        ).toEqual([
+          {
+            shortMessage: 'Wrong data type for Vertical axis.',
+            longMessage:
+              'The dimension MyOperation provided for the Vertical axis has the wrong data type. Expected number but have string',
+          },
+        ]);
+      });
 
-      function getFrameMock() {
-        return createMockFramePublicAPI({
-          datasourceLayers: { first: mockDatasource.publicAPIMock },
-          dataViews: createMockDataViewsState({
-            indexPatterns: { first: createMockedIndexPattern() },
-          }),
-        });
-      }
-      it('should return error if current annotation contains non-existent field as timeField', () => {
-        const xyState = createStateWithAnnotationProps({
-          timeField: 'non-existent',
-        });
-        const errors = xyVisualization.getErrorMessages(xyState, getFrameMock());
-        expect(errors).toHaveLength(1);
-        expect(errors![0]).toEqual(
-          expect.objectContaining({
-            shortMessage: 'Time field non-existent not found in data view my-fake-index-pattern',
-          })
+      it('should return an error if two incompatible xAccessors (multiple layers) are used', () => {
+        // current incompatibility is only for date and numeric histograms as xAccessors
+        const datasourceLayers = {
+          first: mockDatasource.publicAPIMock,
+          second: createMockDatasource('testDatasource').publicAPIMock,
+        };
+        datasourceLayers.first.getOperationForColumnId = jest.fn((id: string) =>
+          id === 'a'
+            ? ({
+                dataType: 'date',
+                scale: 'interval',
+              } as unknown as OperationDescriptor)
+            : null
         );
-      });
-      it('should return error if current annotation contains non existent field as textField', () => {
-        const xyState = createStateWithAnnotationProps({
-          textField: 'non-existent',
-        });
-        const errors = xyVisualization.getErrorMessages(xyState, getFrameMock());
-        expect(errors).toHaveLength(1);
-        expect(errors![0]).toEqual(
-          expect.objectContaining({
-            shortMessage: 'Text field non-existent not found in data view my-fake-index-pattern',
-          })
+        datasourceLayers.second.getOperationForColumnId = jest.fn((id: string) =>
+          id === 'e'
+            ? ({
+                dataType: 'number',
+                scale: 'interval',
+              } as unknown as OperationDescriptor)
+            : null
         );
+        expect(
+          getErrorMessages(
+            xyVisualization,
+            {
+              ...exampleState(),
+              layers: [
+                {
+                  layerId: 'first',
+                  layerType: layerTypes.DATA,
+                  seriesType: 'area',
+                  splitAccessor: 'd',
+                  xAccessor: 'a',
+                  accessors: ['b'],
+                },
+                {
+                  layerId: 'second',
+                  layerType: layerTypes.DATA,
+                  seriesType: 'area',
+                  splitAccessor: 'd',
+                  xAccessor: 'e',
+                  accessors: ['b'],
+                },
+              ],
+            },
+            { datasourceLayers, dataViews: {} as DataViewsState }
+          )
+        ).toEqual([
+          {
+            shortMessage: 'Wrong data type for Horizontal axis.',
+            longMessage:
+              'The Horizontal axis data in layer 1 is incompatible with the data in layer 2. Select a new function for the Horizontal axis.',
+          },
+        ]);
       });
-      it('should contain error if current annotation contains at least one non-existent field as tooltip field', () => {
-        const xyState = createStateWithAnnotationProps({
-          extraFields: ['bytes', 'memory', 'non-existent'],
-        });
-        const errors = xyVisualization.getErrorMessages(xyState, getFrameMock());
-        expect(errors).toHaveLength(1);
-        expect(errors![0]).toEqual(
-          expect.objectContaining({
-            shortMessage: 'Tooltip field non-existent not found in data view my-fake-index-pattern',
-          })
+
+      it('should return an error if string and date histogram xAccessors (multiple layers) are used together', () => {
+        // current incompatibility is only for date and numeric histograms as xAccessors
+        const datasourceLayers = {
+          first: mockDatasource.publicAPIMock,
+          second: createMockDatasource('testDatasource').publicAPIMock,
+        };
+        datasourceLayers.first.getOperationForColumnId = jest.fn((id: string) =>
+          id === 'a'
+            ? ({
+                dataType: 'date',
+                scale: 'interval',
+              } as unknown as OperationDescriptor)
+            : null
         );
-      });
-      it('should contain error if current annotation contains invalid query', () => {
-        const xyState = createStateWithAnnotationProps({
-          filter: { type: 'kibana_query', query: 'invalid: "', language: 'kuery' },
-        });
-        const errors = xyVisualization.getErrorMessages(xyState, getFrameMock());
-        expect(errors).toHaveLength(1);
-        expect(errors![0]).toEqual(
-          expect.objectContaining({
-            shortMessage: expect.stringContaining(
-              'Expected "(", "{", value, whitespace but """ found.'
-            ),
-          })
+        datasourceLayers.second.getOperationForColumnId = jest.fn((id: string) =>
+          id === 'e'
+            ? ({
+                dataType: 'string',
+                scale: 'ordinal',
+              } as unknown as OperationDescriptor)
+            : null
         );
+        expect(
+          getErrorMessages(
+            xyVisualization,
+            {
+              ...exampleState(),
+              layers: [
+                {
+                  layerId: 'first',
+                  layerType: layerTypes.DATA,
+                  seriesType: 'area',
+                  splitAccessor: 'd',
+                  xAccessor: 'a',
+                  accessors: ['b'],
+                },
+                {
+                  layerId: 'second',
+                  layerType: layerTypes.DATA,
+                  seriesType: 'area',
+                  splitAccessor: 'd',
+                  xAccessor: 'e',
+                  accessors: ['b'],
+                },
+              ],
+            },
+            { datasourceLayers, dataViews: {} as DataViewsState }
+          )
+        ).toEqual([
+          {
+            shortMessage: 'Wrong data type for Horizontal axis.',
+            longMessage:
+              'The Horizontal axis data in layer 1 is incompatible with the data in layer 2. Select a new function for the Horizontal axis.',
+          },
+        ]);
       });
-      it('should contain multiple errors if current annotation contains multiple non-existent fields', () => {
-        const xyState = createStateWithAnnotationProps({
-          timeField: 'non-existent',
-          textField: 'non-existent',
-          extraFields: ['bytes', 'memory', 'non-existent'],
-          filter: { type: 'kibana_query', query: 'invalid: "', language: 'kuery' },
+
+      describe('Annotation layers', () => {
+        const DATE_HISTORGRAM_COLUMN_ID = 'date_histogram_column';
+
+        function createStateWithAnnotationProps(annotation: Partial<EventAnnotationConfig>) {
+          return {
+            layers: [
+              {
+                layerId: 'first',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                splitAccessor: undefined,
+                xAccessor: DATE_HISTORGRAM_COLUMN_ID,
+                accessors: ['b'],
+              },
+              {
+                layerId: 'layerId',
+                layerType: 'annotations',
+                indexPatternId: 'first',
+                annotations: [
+                  {
+                    label: 'Event',
+                    id: '1',
+                    type: 'query',
+                    timeField: 'start_date',
+                    ...annotation,
+                  },
+                ],
+              },
+            ],
+          } as XYState;
+        }
+
+        function getFrameMock() {
+          const datasourceMock = createMockDatasource('testDatasource');
+          datasourceMock.publicAPIMock.getOperationForColumnId.mockImplementation((id) =>
+            id === DATE_HISTORGRAM_COLUMN_ID
+              ? ({
+                  label: DATE_HISTORGRAM_COLUMN_ID,
+                  dataType: 'date',
+                  scale: 'interval',
+                } as OperationDescriptor)
+              : ({
+                  dataType: 'number',
+                  label: 'MyOperation',
+                } as OperationDescriptor)
+          );
+
+          return createMockFramePublicAPI({
+            datasourceLayers: { first: datasourceMock.publicAPIMock },
+            dataViews: createMockDataViewsState({
+              indexPatterns: { first: createMockedIndexPattern() },
+            }),
+          });
+        }
+        test('When data layer is empty, should return error on dimension', () => {
+          const state: State = {
+            ...exampleState(),
+            layers: [
+              {
+                layerId: 'first',
+                layerType: layerTypes.DATA,
+                seriesType: 'area',
+                splitAccessor: undefined,
+                xAccessor: undefined, // important
+                accessors: ['b'],
+              },
+              {
+                layerId: 'annotations',
+                layerType: layerTypes.ANNOTATIONS,
+                indexPatternId: 'indexPattern1',
+                annotations: [exampleAnnotation],
+                ignoreGlobalFilters: true,
+              },
+            ],
+          };
+          expect(xyVisualization.getUserMessages!(state, { frame: getFrameMock() }))
+            .toMatchInlineSnapshot(`
+            Array [
+              Object {
+                "displayLocations": Array [
+                  Object {
+                    "dimensionId": "an1",
+                    "id": "dimensionTrigger",
+                  },
+                ],
+                "fixableInEditor": true,
+                "longMessage": "",
+                "severity": "error",
+                "shortMessage": "Annotations require a time based chart to work. Add a date histogram.",
+              },
+            ]
+          `);
         });
-        const errors = xyVisualization.getErrorMessages(xyState, getFrameMock());
-        expect(errors).toHaveLength(4);
-      });
-      it('should contain error if current annotation contains no time field set', () => {
-        const xyState = createStateWithAnnotationProps({
-          timeField: undefined,
+
+        it('should return error if current annotation contains non-existent field as timeField', () => {
+          const xyState = createStateWithAnnotationProps({
+            timeField: 'non-existent',
+          });
+          const errors = getErrorMessages(xyVisualization, xyState, getFrameMock());
+          expect(errors).toHaveLength(1);
+          expect(errors![0]).toEqual(
+            expect.objectContaining({
+              shortMessage: 'Time field non-existent not found in data view my-fake-index-pattern',
+            })
+          );
+        });
+        it('should return error if current annotation contains non existent field as textField', () => {
+          const xyState = createStateWithAnnotationProps({
+            textField: 'non-existent',
+          });
+          const errors = getErrorMessages(xyVisualization, xyState, getFrameMock());
+          expect(errors).toHaveLength(1);
+          expect(errors![0]).toEqual(
+            expect.objectContaining({
+              shortMessage: 'Text field non-existent not found in data view my-fake-index-pattern',
+            })
+          );
+        });
+        it('should contain error if current annotation contains at least one non-existent field as tooltip field', () => {
+          const xyState = createStateWithAnnotationProps({
+            extraFields: ['bytes', 'memory', 'non-existent'],
+          });
+          const errors = getErrorMessages(xyVisualization, xyState, getFrameMock());
+          expect(errors).toHaveLength(1);
+          expect(errors![0]).toEqual(
+            expect.objectContaining({
+              shortMessage:
+                'Tooltip field non-existent not found in data view my-fake-index-pattern',
+            })
+          );
+        });
+        it('should contain error if current annotation contains invalid query', () => {
+          const xyState = createStateWithAnnotationProps({
+            filter: { type: 'kibana_query', query: 'invalid: "', language: 'kuery' },
+          });
+          const errors = getErrorMessages(xyVisualization, xyState, getFrameMock());
+          expect(errors).toHaveLength(1);
+          expect(errors![0]).toEqual(
+            expect.objectContaining({
+              shortMessage: expect.stringContaining(
+                'Expected "(", "{", value, whitespace but """ found.'
+              ),
+            })
+          );
+        });
+        it('should contain multiple errors if current annotation contains multiple non-existent fields', () => {
+          const xyState = createStateWithAnnotationProps({
+            timeField: 'non-existent',
+            textField: 'non-existent',
+            extraFields: ['bytes', 'memory', 'non-existent'],
+            filter: { type: 'kibana_query', query: 'invalid: "', language: 'kuery' },
+          });
+          const errors = getErrorMessages(xyVisualization, xyState, getFrameMock());
+          expect(errors).toHaveLength(4);
+        });
+        it('should contain error if current annotation contains no time field set', () => {
+          const xyState = createStateWithAnnotationProps({
+            timeField: undefined,
+          });
+          const errors = getErrorMessages(xyVisualization, xyState, getFrameMock());
+          expect(errors).toHaveLength(1);
+          expect(errors![0]).toEqual(
+            expect.objectContaining({
+              shortMessage: expect.stringContaining('Time field is missing'),
+            })
+          );
         });
-        const errors = xyVisualization.getErrorMessages(xyState, getFrameMock());
-        expect(errors).toHaveLength(1);
-        expect(errors![0]).toEqual(
-          expect.objectContaining({
-            shortMessage: expect.stringContaining('Time field is missing'),
-          })
-        );
       });
     });
-  });
 
-  describe('#getWarningMessages', () => {
-    let mockDatasource: ReturnType<typeof createMockDatasource>;
-    let frame: ReturnType<typeof createMockFramePublicAPI>;
+    describe('warnings', () => {
+      let mockDatasource: ReturnType<typeof createMockDatasource>;
+      let frame: ReturnType<typeof createMockFramePublicAPI>;
 
-    beforeEach(() => {
-      frame = createMockFramePublicAPI();
-      mockDatasource = createMockDatasource('testDatasource');
+      beforeEach(() => {
+        frame = createMockFramePublicAPI();
+        mockDatasource = createMockDatasource('testDatasource');
 
-      mockDatasource.publicAPIMock.getTableSpec.mockReturnValue([
-        { columnId: 'd', fields: [] },
-        { columnId: 'a', fields: [] },
-        { columnId: 'b', fields: [] },
-        { columnId: 'c', fields: [] },
-      ]);
+        mockDatasource.publicAPIMock.getTableSpec.mockReturnValue([
+          { columnId: 'd', fields: [] },
+          { columnId: 'a', fields: [] },
+          { columnId: 'b', fields: [] },
+          { columnId: 'c', fields: [] },
+        ]);
 
-      frame.datasourceLayers = {
-        first: mockDatasource.publicAPIMock,
-      };
+        frame.datasourceLayers = {
+          first: mockDatasource.publicAPIMock,
+        };
 
-      frame.activeData = {
-        first: {
-          type: 'datatable',
-          columns: [
-            { id: 'a', name: 'A', meta: { type: 'number' } },
-            { id: 'b', name: 'B', meta: { type: 'number' } },
-          ],
-          rows: [
-            { a: 1, b: [2, 0] },
-            { a: 3, b: 4 },
-            { a: 5, b: 6 },
-            { a: 7, b: 8 },
-          ],
-        },
-      };
-    });
-    it('should return a warning when numeric accessors contain array', () => {
-      const datasourceLayers = frame.datasourceLayers as Record<string, DatasourcePublicAPI>;
-      (datasourceLayers.first.getOperationForColumnId as jest.Mock).mockReturnValue({
-        label: 'Label B',
+        frame.activeData = {
+          first: {
+            type: 'datatable',
+            columns: [
+              { id: 'a', name: 'A', meta: { type: 'number' } },
+              { id: 'b', name: 'B', meta: { type: 'number' } },
+            ],
+            rows: [
+              { a: 1, b: [2, 0] },
+              { a: 3, b: 4 },
+              { a: 5, b: 6 },
+              { a: 7, b: 8 },
+            ],
+          },
+        };
       });
-      const warningMessages = xyVisualization.getWarningMessages!(
-        {
-          ...exampleState(),
-          layers: [
+
+      const onlyWarnings = (messages: UserMessage[]) =>
+        messages.filter(({ severity }) => severity === 'warning');
+
+      it('should return a warning when numeric accessors contain array', () => {
+        const datasourceLayers = frame.datasourceLayers as Record<string, DatasourcePublicAPI>;
+        (datasourceLayers.first.getOperationForColumnId as jest.Mock).mockReturnValue({
+          label: 'Label B',
+        });
+        const warningMessages = onlyWarnings(
+          xyVisualization.getUserMessages!(
             {
-              layerId: 'first',
-              layerType: layerTypes.DATA,
-              seriesType: 'area',
-              xAccessor: 'a',
-              accessors: ['b'],
+              ...exampleState(),
+              layers: [
+                {
+                  layerId: 'first',
+                  layerType: layerTypes.DATA,
+                  seriesType: 'area',
+                  xAccessor: 'a',
+                  accessors: ['b'],
+                },
+              ],
             },
-          ],
-        },
-        frame
-      );
-      expect(warningMessages).toHaveLength(1);
-      expect(warningMessages && warningMessages[0]).toMatchInlineSnapshot(`
-        <FormattedMessage
-          defaultMessage="{label} contains array values. Your visualization may not render as expected."
-          id="xpack.lens.xyVisualization.arrayValues"
-          values={
-            Object {
-              "label": <strong>
-                Label B
-              </strong>,
-            }
+            { frame }
+          )
+        );
+        expect(warningMessages).toHaveLength(1);
+        expect(warningMessages && warningMessages[0]).toMatchInlineSnapshot(`
+          Object {
+            "displayLocations": Array [
+              Object {
+                "id": "toolbar",
+              },
+            ],
+            "fixableInEditor": true,
+            "longMessage": <FormattedMessage
+              defaultMessage="{label} contains array values. Your visualization may not render as expected."
+              id="xpack.lens.xyVisualization.arrayValues"
+              values={
+                Object {
+                  "label": <strong>
+                    Label B
+                  </strong>,
+                }
+              }
+            />,
+            "severity": "warning",
+            "shortMessage": "",
           }
-        />
-      `);
+        `);
+      });
     });
   });
+
   describe('#getUniqueLabels', () => {
     it('creates unique labels for single annotations layer with repeating labels', async () => {
       const xyState = {
diff --git a/x-pack/plugins/lens/public/visualizations/xy/visualization.tsx b/x-pack/plugins/lens/public/visualizations/xy/visualization.tsx
index 9ee9572a0c35f6..78e2637cedc316 100644
--- a/x-pack/plugins/lens/public/visualizations/xy/visualization.tsx
+++ b/x-pack/plugins/lens/public/visualizations/xy/visualization.tsx
@@ -35,7 +35,13 @@ import {
   DimensionEditor,
 } from './xy_config_panel/dimension_editor';
 import { LayerHeader, LayerHeaderContent } from './xy_config_panel/layer_header';
-import type { Visualization, AccessorConfig, FramePublicAPI, Suggestion } from '../../types';
+import type {
+  Visualization,
+  AccessorConfig,
+  FramePublicAPI,
+  Suggestion,
+  UserMessage,
+} from '../../types';
 import type { FormBasedPersistedState } from '../../datasources/form_based/types';
 import {
   type State,
@@ -48,9 +54,9 @@ import {
 } from './types';
 import {
   extractReferences,
+  getAnnotationLayerErrors,
   injectReferences,
   isHorizontalChart,
-  validateColumn,
 } from './state_helpers';
 import { toExpression, toPreviewExpression, getSortedAccessors } from './to_expression';
 import { getAccessorColorConfigs, getColorAssignments } from './color_assignment';
@@ -67,6 +73,7 @@ import {
   setAnnotationsDimension,
   getUniqueLabels,
   onAnnotationDrop,
+  isDateHistogram,
 } from './annotations/helpers';
 import {
   checkXAccessorCompatibility,
@@ -692,52 +699,58 @@ export const getXyVisualization = ({
       eventAnnotationService
     ),
 
-  validateColumn(state, frame, layerId, columnId, group) {
-    const { invalid, invalidMessages } = validateColumn(state, frame, layerId, columnId, group);
-    if (!invalid) {
-      return { invalid };
-    }
-    return { invalid, invalidMessage: invalidMessages![0] };
-  },
-
-  getErrorMessages(state, frame) {
-    const { datasourceLayers, dataViews } = frame || {};
-    const errors: Array<{
-      shortMessage: string;
-      longMessage: React.ReactNode;
-    }> = [];
-
+  getUserMessages(state, { frame }) {
+    const { datasourceLayers, dataViews, activeData } = frame;
     const annotationLayers = getAnnotationsLayers(state.layers);
+    const errors: UserMessage[] = [];
+
+    const hasDateHistogram = isDateHistogram(getDataLayers(state.layers), frame);
+
+    annotationLayers.forEach((layer) => {
+      layer.annotations.forEach((annotation) => {
+        if (!hasDateHistogram) {
+          errors.push({
+            severity: 'error',
+            fixableInEditor: true,
+            displayLocations: [{ id: 'dimensionTrigger', dimensionId: annotation.id }],
+            shortMessage: i18n.translate(
+              'xpack.lens.xyChart.addAnnotationsLayerLabelDisabledHelp',
+              {
+                defaultMessage:
+                  'Annotations require a time based chart to work. Add a date histogram.',
+              }
+            ),
+            longMessage: '',
+          });
+        }
 
-    if (dataViews) {
-      annotationLayers.forEach((layer) => {
-        layer.annotations.forEach((annotation) => {
-          const validatedColumn = validateColumn(
-            state,
-            { dataViews },
-            layer.layerId,
-            annotation.id
-          );
-          if (validatedColumn?.invalid && validatedColumn.invalidMessages?.length) {
-            errors.push(
-              ...validatedColumn.invalidMessages.map((invalidMessage) => ({
-                shortMessage: invalidMessage,
-                longMessage: (
-                  <FormattedMessage
-                    id="xpack.lens.xyChart.annotationError"
-                    defaultMessage="Annotation {annotationName} has an error: {errorMessage}"
-                    values={{
-                      annotationName: annotation.label,
-                      errorMessage: invalidMessage,
-                    }}
-                  />
-                ),
-              }))
-            );
-          }
-        });
+        const errorMessages = getAnnotationLayerErrors(layer, annotation.id, dataViews);
+        errors.push(
+          ...errorMessages.map((errorMessage) => {
+            const message: UserMessage = {
+              severity: 'error',
+              fixableInEditor: true,
+              displayLocations: [
+                { id: 'visualization' },
+                { id: 'dimensionTrigger', dimensionId: annotation.id },
+              ],
+              shortMessage: errorMessage,
+              longMessage: (
+                <FormattedMessage
+                  id="xpack.lens.xyChart.annotationError"
+                  defaultMessage="Annotation {annotationName} has an error: {errorMessage}"
+                  values={{
+                    annotationName: annotation.label,
+                    errorMessage,
+                  }}
+                />
+              ),
+            };
+            return message;
+          })
+        );
       });
-    }
+    });
 
     // Data error handling below here
     const hasNoAccessors = ({ accessors }: XYDataLayerConfig) =>
@@ -763,84 +776,108 @@ export const getXyVisualization = ({
       for (const [dimension, criteria] of checks) {
         const result = validateLayersForDimension(dimension, filteredLayers, criteria);
         if (!result.valid) {
-          errors.push(result.payload);
+          errors.push({
+            severity: 'error',
+            fixableInEditor: true,
+            displayLocations: [{ id: 'visualization' }],
+            shortMessage: result.payload.shortMessage,
+            longMessage: result.payload.longMessage,
+          });
         }
       }
     }
+    // temporary fix for #87068
+    errors.push(
+      ...checkXAccessorCompatibility(state, datasourceLayers).map(
+        ({ shortMessage, longMessage }) =>
+          ({
+            severity: 'error',
+            fixableInEditor: true,
+            displayLocations: [{ id: 'visualization' }],
+            shortMessage,
+            longMessage,
+          } as UserMessage)
+      )
+    );
 
-    if (datasourceLayers && state) {
-      // temporary fix for #87068
-      errors.push(...checkXAccessorCompatibility(state, datasourceLayers));
-
-      for (const layer of getDataLayers(state.layers)) {
-        const datasourceAPI = datasourceLayers[layer.layerId];
-        if (datasourceAPI) {
-          for (const accessor of layer.accessors) {
-            const operation = datasourceAPI.getOperationForColumnId(accessor);
-            if (operation && operation.dataType !== 'number') {
-              errors.push({
-                shortMessage: i18n.translate('xpack.lens.xyVisualization.dataTypeFailureYShort', {
-                  defaultMessage: `Wrong data type for {axis}.`,
-                  values: {
-                    axis: getAxisName('y', { isHorizontal: isHorizontalChart(state.layers) }),
-                  },
-                }),
-                longMessage: i18n.translate('xpack.lens.xyVisualization.dataTypeFailureYLong', {
-                  defaultMessage: `The dimension {label} provided for the {axis} has the wrong data type. Expected number but have {dataType}`,
-                  values: {
-                    label: operation.label,
-                    dataType: operation.dataType,
-                    axis: getAxisName('y', { isHorizontal: isHorizontalChart(state.layers) }),
-                  },
-                }),
-              });
-            }
+    for (const layer of getDataLayers(state.layers)) {
+      const datasourceAPI = datasourceLayers[layer.layerId];
+      if (datasourceAPI) {
+        for (const accessor of layer.accessors) {
+          const operation = datasourceAPI.getOperationForColumnId(accessor);
+          if (operation && operation.dataType !== 'number') {
+            errors.push({
+              severity: 'error',
+              fixableInEditor: true,
+              displayLocations: [{ id: 'visualization' }],
+              shortMessage: i18n.translate('xpack.lens.xyVisualization.dataTypeFailureYShort', {
+                defaultMessage: `Wrong data type for {axis}.`,
+                values: {
+                  axis: getAxisName('y', { isHorizontal: isHorizontalChart(state.layers) }),
+                },
+              }),
+              longMessage: i18n.translate('xpack.lens.xyVisualization.dataTypeFailureYLong', {
+                defaultMessage: `The dimension {label} provided for the {axis} has the wrong data type. Expected number but have {dataType}`,
+                values: {
+                  label: operation.label,
+                  dataType: operation.dataType,
+                  axis: getAxisName('y', { isHorizontal: isHorizontalChart(state.layers) }),
+                },
+              }),
+            });
           }
         }
       }
     }
 
-    return errors.length ? errors : undefined;
-  },
-
-  getWarningMessages(state, frame) {
-    if (state?.layers.length === 0 || !frame.activeData) {
-      return;
-    }
+    const warnings: UserMessage[] = [];
 
-    const filteredLayers = [
-      ...getDataLayers(state.layers),
-      ...getReferenceLayers(state.layers),
-    ].filter(({ accessors }) => accessors.length > 0);
+    if (state?.layers.length > 0 && activeData) {
+      const filteredLayers = [
+        ...getDataLayers(state.layers),
+        ...getReferenceLayers(state.layers),
+      ].filter(({ accessors }) => accessors.length > 0);
 
-    const accessorsWithArrayValues = [];
+      const accessorsWithArrayValues = [];
 
-    for (const layer of filteredLayers) {
-      const { layerId, accessors } = layer;
-      const rows = frame.activeData?.[layerId] && frame.activeData[layerId].rows;
-      if (!rows) {
-        break;
-      }
-      const columnToLabel = getColumnToLabelMap(layer, frame.datasourceLayers[layerId]);
-      for (const accessor of accessors) {
-        const hasArrayValues = rows.some((row) => Array.isArray(row[accessor]));
-        if (hasArrayValues) {
-          accessorsWithArrayValues.push(columnToLabel[accessor]);
+      for (const layer of filteredLayers) {
+        const { layerId, accessors } = layer;
+        const rows = activeData?.[layerId] && activeData[layerId].rows;
+        if (!rows) {
+          break;
+        }
+        const columnToLabel = getColumnToLabelMap(layer, datasourceLayers[layerId]);
+        for (const accessor of accessors) {
+          const hasArrayValues = rows.some((row) => Array.isArray(row[accessor]));
+          if (hasArrayValues) {
+            accessorsWithArrayValues.push(columnToLabel[accessor]);
+          }
         }
       }
+
+      accessorsWithArrayValues.forEach((label) =>
+        warnings.push({
+          severity: 'warning',
+          fixableInEditor: true,
+          displayLocations: [{ id: 'toolbar' }],
+          shortMessage: '',
+          longMessage: (
+            <FormattedMessage
+              key={label}
+              id="xpack.lens.xyVisualization.arrayValues"
+              defaultMessage="{label} contains array values. Your visualization may not render as expected."
+              values={{
+                label: <strong>{label}</strong>,
+              }}
+            />
+          ),
+        })
+      );
     }
 
-    return accessorsWithArrayValues.map((label) => (
-      <FormattedMessage
-        key={label}
-        id="xpack.lens.xyVisualization.arrayValues"
-        defaultMessage="{label} contains array values. Your visualization may not render as expected."
-        values={{
-          label: <strong>{label}</strong>,
-        }}
-      />
-    ));
+    return [...errors, ...warnings];
   },
+
   getUniqueLabels(state) {
     return getUniqueLabels(state.layers);
   },
@@ -852,19 +889,7 @@ export const getXyVisualization = ({
       state?.layers.filter(isAnnotationsLayer).map(({ indexPatternId }) => indexPatternId) ?? []
     );
   },
-  renderDimensionTrigger({
-    columnId,
-    label,
-    hideTooltip,
-    invalid,
-    invalidMessage,
-  }: {
-    columnId: string;
-    label?: string;
-    hideTooltip?: boolean;
-    invalid?: boolean;
-    invalidMessage?: string;
-  }) {
+  renderDimensionTrigger({ columnId, label, hideTooltip, invalid, invalidMessage }) {
     if (label) {
       return (
         <DimensionTrigger
diff --git a/x-pack/plugins/maps/public/lens/choropleth_chart/visualization.tsx b/x-pack/plugins/maps/public/lens/choropleth_chart/visualization.tsx
index b6e22ce3cb6358..5018863acbc8d7 100644
--- a/x-pack/plugins/maps/public/lens/choropleth_chart/visualization.tsx
+++ b/x-pack/plugins/maps/public/lens/choropleth_chart/visualization.tsx
@@ -211,8 +211,4 @@ export const getVisualization = ({
       );
     }
   },
-
-  getErrorMessages(state) {
-    return undefined;
-  },
 });
diff --git a/x-pack/test/functional/apps/lens/group1/smokescreen.ts b/x-pack/test/functional/apps/lens/group1/smokescreen.ts
index 5470b99bcd8f22..9d89c91d2dc4c6 100644
--- a/x-pack/test/functional/apps/lens/group1/smokescreen.ts
+++ b/x-pack/test/functional/apps/lens/group1/smokescreen.ts
@@ -540,16 +540,16 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         dimension: 'lnsXY_yDimensionPanel > lns-empty-dimension',
         operation: 'cumulative_sum',
       });
-      expect(await PageObjects.lens.getErrorCount()).to.eql(1);
+      expect(await PageObjects.lens.getWorkspaceErrorCount()).to.eql(1);
 
       await PageObjects.lens.removeDimension('lnsXY_xDimensionPanel');
-      expect(await PageObjects.lens.getErrorCount()).to.eql(2);
+      expect(await PageObjects.lens.getWorkspaceErrorCount()).to.eql(2);
 
       await PageObjects.lens.dragFieldToDimensionTrigger(
         '@timestamp',
         'lnsXY_xDimensionPanel > lns-empty-dimension'
       );
-      expect(await PageObjects.lens.getErrorCount()).to.eql(1);
+      expect(await PageObjects.lens.getWorkspaceErrorCount()).to.eql(1);
 
       expect(await PageObjects.lens.hasChartSwitchWarning('lnsDatatable')).to.eql(false);
       await PageObjects.lens.switchToVisualization('lnsDatatable');
diff --git a/x-pack/test/functional/apps/lens/group3/formula.ts b/x-pack/test/functional/apps/lens/group3/formula.ts
index 2df2af2950909a..d5e1c9e38b00f3 100644
--- a/x-pack/test/functional/apps/lens/group3/formula.ts
+++ b/x-pack/test/functional/apps/lens/group3/formula.ts
@@ -136,7 +136,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         formula: `asdf`,
       });
 
-      expect(await PageObjects.lens.getErrorCount()).to.eql(1);
+      expect(await PageObjects.lens.getWorkspaceErrorCount()).to.eql(1);
     });
 
     it('should keep the formula when entering expanded mode', async () => {
@@ -175,7 +175,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       });
 
       await PageObjects.lens.waitForVisualization('legacyMtrVis');
-      expect(await PageObjects.lens.getErrorCount()).to.eql(0);
+      expect(await PageObjects.lens.getWorkspaceErrorCount()).to.eql(0);
     });
 
     it('should duplicate a moving average formula and be a valid table with conditional coloring', async () => {
diff --git a/x-pack/test/functional/page_objects/lens_page.ts b/x-pack/test/functional/page_objects/lens_page.ts
index 10deb555fa3597..9da4bd778e45f3 100644
--- a/x-pack/test/functional/page_objects/lens_page.ts
+++ b/x-pack/test/functional/page_objects/lens_page.ts
@@ -840,17 +840,16 @@ export function LensPageProvider({ getService, getPageObjects }: FtrProviderCont
     },
 
     /** Counts the visible warnings in the config panel */
-    async getErrorCount() {
-      const moreButton = await testSubjects.exists('configuration-failure-more-errors');
+    async getWorkspaceErrorCount() {
+      const moreButton = await testSubjects.exists('workspace-more-errors-button');
       if (moreButton) {
         await retry.try(async () => {
-          await testSubjects.click('configuration-failure-more-errors');
-          await testSubjects.missingOrFail('configuration-failure-more-errors');
+          await testSubjects.click('workspace-more-errors-button');
+          await testSubjects.missingOrFail('workspace-more-errors-button');
         });
       }
-      const errors = await testSubjects.findAll('configuration-failure-error');
-      const expressionErrors = await testSubjects.findAll('expression-failure');
-      return (errors?.length ?? 0) + (expressionErrors?.length ?? 0);
+      const errors = await testSubjects.findAll('workspace-error-message');
+      return errors?.length ?? 0;
     },
 
     async searchOnChartSwitch(subVisualizationId: string, searchTerm?: string) {

From d3f71be69b10b9fe3f4494b832e01a88bb81238d Mon Sep 17 00:00:00 2001
From: Nathan Reese <reese.nathan@elastic.co>
Date: Mon, 23 Jan 2023 14:07:03 -0700
Subject: [PATCH 22/54] [Maps][ML] fix Typical to actual connector lines in
 AnomalyLayer have dot halfway (#149270)

Fixes https://github.com/elastic/kibana/issues/148694

PR updates `AnomalySource.isMvt` to return false since the source is not
a vector tile source. See
https://github.com/elastic/kibana/issues/148694#issuecomment-1397691081
for details

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 x-pack/plugins/ml/public/maps/anomaly_source.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/ml/public/maps/anomaly_source.tsx b/x-pack/plugins/ml/public/maps/anomaly_source.tsx
index 41bf7fedfabade..7601eaae110b41 100644
--- a/x-pack/plugins/ml/public/maps/anomaly_source.tsx
+++ b/x-pack/plugins/ml/public/maps/anomaly_source.tsx
@@ -174,7 +174,7 @@ export class AnomalySource implements IVectorSource {
   }
 
   isMvt() {
-    return true;
+    return false;
   }
 
   showJoinEditor(): boolean {

From 62e7fd110e0dd550dd2fb255f81a09521e073b01 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Mon, 23 Jan 2023 16:41:02 -0500
Subject: [PATCH 23/54] skip failing test suite (#137408)

---
 x-pack/test/functional/apps/maps/group4/discover.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/x-pack/test/functional/apps/maps/group4/discover.js b/x-pack/test/functional/apps/maps/group4/discover.js
index b1a0e4677ce32b..d693c79bdb926f 100644
--- a/x-pack/test/functional/apps/maps/group4/discover.js
+++ b/x-pack/test/functional/apps/maps/group4/discover.js
@@ -14,7 +14,8 @@ export default function ({ getService, getPageObjects }) {
   const from = 'Sep 22, 2015 @ 00:00:00.000';
   const to = 'Sep 22, 2015 @ 04:00:00.000';
 
-  describe('discover visualize button', () => {
+  // Failing: See https://github.com/elastic/kibana/issues/137408
+  describe.skip('discover visualize button', () => {
     beforeEach(async () => {
       await security.testUser.setRoles([
         'test_logstash_reader',

From 2dd13289e39d19555b764489d5df066efd47462b Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Mon, 23 Jan 2023 16:57:28 -0500
Subject: [PATCH 24/54] skip failing test suite (#149358)

---
 x-pack/test/functional/apps/maps/group4/discover.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/x-pack/test/functional/apps/maps/group4/discover.js b/x-pack/test/functional/apps/maps/group4/discover.js
index d693c79bdb926f..fe0143911768d6 100644
--- a/x-pack/test/functional/apps/maps/group4/discover.js
+++ b/x-pack/test/functional/apps/maps/group4/discover.js
@@ -15,6 +15,7 @@ export default function ({ getService, getPageObjects }) {
   const to = 'Sep 22, 2015 @ 04:00:00.000';
 
   // Failing: See https://github.com/elastic/kibana/issues/137408
+  // Failing: See https://github.com/elastic/kibana/issues/149358
   describe.skip('discover visualize button', () => {
     beforeEach(async () => {
       await security.testUser.setRoles([

From f7b25f5e46babdff3fad84ccca0967658625c0a9 Mon Sep 17 00:00:00 2001
From: "Christiane (Tina) Heiligers" <christiane.heiligers@elastic.co>
Date: Mon, 23 Jan 2023 15:04:24 -0700
Subject: [PATCH 25/54] [Saved Objects] Provide ability to remove SO type from
 global SO HTTP API without hiding from the client (#149166)

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
resolves https://github.com/elastic/kibana/issues/147150
---
 dev_docs/tutorials/saved_objects.mdx          |   36 +
 .../core/saved-objects-service.asciidoc       |   39 +
 .../src/saved_objects_type_registry.test.ts   |   77 +
 .../src/saved_objects_type_registry.ts        |   18 +-
 .../src/saved_objects_type_registry.mock.ts   |    4 +
 .../src/routes/bulk_create.ts                 |    5 +-
 .../src/routes/bulk_delete.ts                 |    5 +-
 .../src/routes/bulk_get.ts                    |    5 +-
 .../src/routes/bulk_resolve.ts                |    4 +-
 .../src/routes/bulk_update.ts                 |    6 +-
 .../src/routes/create.ts                      |    7 +-
 .../src/routes/delete.ts                      |    5 +-
 .../src/routes/find.ts                        |   21 +-
 .../src/routes/get.ts                         |    4 +-
 .../src/routes/resolve.ts                     |    3 +
 .../src/routes/update.ts                      |    6 +-
 .../src/routes/utils.test.ts                  |  107 +-
 .../src/routes/utils.ts                       |   72 +-
 .../tsconfig.json                             |    1 +
 .../src/saved_objects_type.ts                 |    8 +
 .../src/type_registry.ts                      |   12 +
 .../core-test-helpers-test-utils/index.ts     |    1 +
 .../src/create_hidden_type_variants.ts        |   25 +
 .../saved_objects/routes/bulk_create.test.ts  |   32 +-
 .../saved_objects/routes/bulk_delete.test.ts  |   41 +-
 .../saved_objects/routes/bulk_get.test.ts     |   26 +-
 .../saved_objects/routes/bulk_resolve.test.ts |   27 +-
 .../saved_objects/routes/bulk_update.test.ts  |   32 +-
 .../saved_objects/routes/create.test.ts       |   26 +-
 .../saved_objects/routes/delete.test.ts       |   28 +-
 .../saved_objects/routes/find.test.ts         |   45 +-
 .../saved_objects/routes/get.test.ts          |   20 +
 .../saved_objects/routes/resolve.test.ts      |   21 +
 .../saved_objects/routes/update.test.ts       |   24 +-
 .../hidden_from_http_apis/data.json           |   27 +
 .../hidden_from_http_apis/mappings.json       | 3886 +++++++++++++++++
 .../hidden_from_http_apis.json                |   39 +
 .../kibana.json                               |   12 +
 .../package.json                              |   14 +
 .../server/index.ts                           |   11 +
 .../server/plugin.ts                          |   48 +
 .../tsconfig.json                             |   17 +
 .../_import_hidden_from_http_apis.ndjson      |    2 +
 .../hidden_from_http_apis.ts                  |  209 +
 .../saved_objects_management/index.ts         |    1 +
 .../usage_collection/usage_counters.ts        |    2 +-
 tsconfig.base.json                            |    2 +
 47 files changed, 5035 insertions(+), 28 deletions(-)
 create mode 100644 packages/core/test-helpers/core-test-helpers-test-utils/src/create_hidden_type_variants.ts
 create mode 100644 test/functional/fixtures/es_archiver/saved_objects_management/hidden_from_http_apis/data.json
 create mode 100644 test/functional/fixtures/es_archiver/saved_objects_management/hidden_from_http_apis/mappings.json
 create mode 100644 test/functional/fixtures/kbn_archiver/saved_objects_management/hidden_from_http_apis.json
 create mode 100644 test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/kibana.json
 create mode 100644 test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/package.json
 create mode 100644 test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/index.ts
 create mode 100644 test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/plugin.ts
 create mode 100644 test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/tsconfig.json
 create mode 100644 test/plugin_functional/test_suites/saved_objects_management/exports/_import_hidden_from_http_apis.ndjson
 create mode 100644 test/plugin_functional/test_suites/saved_objects_management/hidden_from_http_apis.ts

diff --git a/dev_docs/tutorials/saved_objects.mdx b/dev_docs/tutorials/saved_objects.mdx
index 3ee9ca63e279d7..299b668a471756 100644
--- a/dev_docs/tutorials/saved_objects.mdx
+++ b/dev_docs/tutorials/saved_objects.mdx
@@ -257,3 +257,39 @@ the error should be verbose and informative so that the corrupt document can be
 ### Testing Migrations
 
 Bugs in a migration function cause downtime for our users and therefore have a very high impact. Follow the <DocLink id="kibDevTutorialTestingPlugins" section="saved-objects-migrations" text="Saved Object migrations section in the plugin testing guide"/>.
+
+### How to opt-out of the global savedObjects APIs?
+
+There are 2 options, depending on the amount of flexibility you need:
+For complete control over your HTTP APIs and custom handling, declare your type as `hidden`, as shown in the example. 
+The other option that allows you to build your own HTTP APIs and still use the client as-is is to declare your type as hidden from the global saved objects HTTP APIs as `hiddenFromHttpApis: true`
+
+```ts
+import { SavedObjectsType } from 'src/core/server';
+
+export const foo: SavedObjectsType = {
+  name: 'foo',
+  hidden: false, [1]
+  hiddenFromHttpApis: true, [2]
+  namespaceType: 'multiple-isolated',
+  mappings: {
+    dynamic: false,
+    properties: {
+      description: {
+        type: 'text',
+      },
+      hits: {
+        type: 'integer',
+      },
+    },
+  },
+  migrations: {
+    '1.0.0': migratedashboardVisualizationToV1,
+    '2.0.0': migratedashboardVisualizationToV2,
+  },
+};
+```
+
+[1] Needs to be `false` to use the `hiddenFromHttpApis` option
+
+[2] Set this to `true` to build your own HTTP API and have complete control over the route handler.
diff --git a/docs/developer/architecture/core/saved-objects-service.asciidoc b/docs/developer/architecture/core/saved-objects-service.asciidoc
index c866d111bd1b69..eb9f1c7fd45162 100644
--- a/docs/developer/architecture/core/saved-objects-service.asciidoc
+++ b/docs/developer/architecture/core/saved-objects-service.asciidoc
@@ -271,6 +271,11 @@ in this code, there's really no reason not to aim for 100% test code coverage.
 ==== Type visibility
 It is recommended that plugins only expose Saved Object types that are necessary.
 That is so to provide better backward compatibility.
+
+There are two options to register a type: either as completely unexposed to the global Saved Objects HTTP APIs and client or to only expose it to the client but not to the APIs.
+
+===== Hidden types
+
 In case when the type is not hidden, it will be exposed via the global Saved Objects HTTP API.
 That brings the limitation of introducing backward incompatible changes as there might be a service consuming the API.
 
@@ -302,6 +307,40 @@ class SomePlugin implements Plugin {
 }
 ----
 
+===== Hidden from the HTTP APIs 
+
+When a saved object is registered as hidden from the HTTP APIs, it will remain exposed to the global Saved Objects client:
+
+[source,typescript]
+----
+import { SavedObjectsType } from 'src/core/server';
+
+export const myCustomVisualization: SavedObjectsType = {
+  name: 'my_custom_visualization', // <1>
+  hidden: false,
+  hiddenFromHttpApis: true, // <2>
+  namespaceType: 'multiple-isolated',
+  mappings: {
+    dynamic: false,
+    properties: {
+      description: {
+        type: 'text',
+      },
+      hits: {
+        type: 'integer',
+      },
+    },
+  },
+  migrations: {
+    '1.0.0': migrateMyCustomVisualizationToV1,
+    '2.0.0': migrateMyCustomVisualizationToV2,
+  },
+};
+----
+
+<1> MyCustomVisualization types have their own domain-specific HTTP API's that leverage the global Saved Objects client
+<2> This field determines "hidden from http apis" behavior -- any attempts to use the global Saved Objects HTTP APIs will throw errors
+
 === Client side usage
 
 ==== References
diff --git a/packages/core/saved-objects/core-saved-objects-base-server-internal/src/saved_objects_type_registry.test.ts b/packages/core/saved-objects/core-saved-objects-base-server-internal/src/saved_objects_type_registry.test.ts
index b7c4a0102ffd59..fe22c5aa9414f9 100644
--- a/packages/core/saved-objects/core-saved-objects-base-server-internal/src/saved_objects_type_registry.test.ts
+++ b/packages/core/saved-objects/core-saved-objects-base-server-internal/src/saved_objects_type_registry.test.ts
@@ -139,6 +139,67 @@ describe('SavedObjectTypeRegistry', () => {
       }).not.toThrow();
     });
 
+    it('throws when `hidden` is true and `hiddenFromHttpApis` is false', () => {
+      expect(() => {
+        registry.registerType(
+          createType({
+            name: 'typeHiddenA',
+            hidden: true,
+            hiddenFromHttpApis: false,
+          })
+        );
+      }).toThrowErrorMatchingInlineSnapshot(
+        `"Type typeHiddenA: 'hiddenFromHttpApis' cannot be 'false' when specifying 'hidden' as 'true'"`
+      );
+
+      expect(() => {
+        registry.registerType(
+          createType({
+            name: 'typeHiddenA',
+            hidden: true,
+            hiddenFromHttpApis: true,
+          })
+        );
+      }).not.toThrow();
+
+      expect(() => {
+        registry.registerType(
+          createType({
+            name: 'typeHiddenA2',
+            hidden: true,
+          })
+        );
+      }).not.toThrow();
+
+      expect(() => {
+        registry.registerType(
+          createType({
+            name: 'typeVisibleA',
+            hidden: false,
+          })
+        );
+      }).not.toThrow();
+
+      expect(() => {
+        registry.registerType(
+          createType({
+            name: 'typeVisibleA1',
+            hidden: false,
+            hiddenFromHttpApis: false,
+          })
+        );
+      }).not.toThrow();
+
+      expect(() => {
+        registry.registerType(
+          createType({
+            name: 'typeVisibleA2',
+            hidden: false,
+            hiddenFromHttpApis: true,
+          })
+        );
+      }).not.toThrow();
+    });
     // TODO: same test with 'onImport'
   });
 
@@ -383,6 +444,22 @@ describe('SavedObjectTypeRegistry', () => {
     });
   });
 
+  describe('#isHiddenFromHttpApis', () => {
+    it('returns correct value for the type', () => {
+      registry.registerType(createType({ name: 'typeA', hiddenFromHttpApis: true }));
+      registry.registerType(createType({ name: 'typeB', hiddenFromHttpApis: false }));
+
+      expect(registry.isHiddenFromHttpApis('typeA')).toEqual(true);
+      expect(registry.isHiddenFromHttpApis('typeB')).toEqual(false);
+    });
+    it('returns true when the type is not registered', () => {
+      registry.registerType(createType({ name: 'typeA', hiddenFromHttpApis: false }));
+      registry.registerType(createType({ name: 'typeB', hiddenFromHttpApis: true }));
+
+      expect(registry.isHiddenFromHttpApis('unknownType')).toEqual(false);
+    });
+  });
+
   describe('#getIndex', () => {
     it('returns correct value for the type', () => {
       registry.registerType(createType({ name: 'typeA', indexPattern: '.custom-index' }));
diff --git a/packages/core/saved-objects/core-saved-objects-base-server-internal/src/saved_objects_type_registry.ts b/packages/core/saved-objects/core-saved-objects-base-server-internal/src/saved_objects_type_registry.ts
index 277050b7a6d6d8..3f6c2f7a8fb380 100644
--- a/packages/core/saved-objects/core-saved-objects-base-server-internal/src/saved_objects_type_registry.ts
+++ b/packages/core/saved-objects/core-saved-objects-base-server-internal/src/saved_objects_type_registry.ts
@@ -41,6 +41,11 @@ export class SavedObjectTypeRegistry implements ISavedObjectTypeRegistry {
     return [...this.types.values()].filter((type) => !this.isHidden(type.name));
   }
 
+  /** {@inheritDoc ISavedObjectTypeRegistry.getVisibleToHttpApisTypes}  */
+  public getVisibleToHttpApisTypes() {
+    return [...this.types.values()].filter((type) => !this.isHiddenFromHttpApis(type.name));
+  }
+
   /** {@inheritDoc ISavedObjectTypeRegistry.getAllTypes} */
   public getAllTypes() {
     return [...this.types.values()];
@@ -78,6 +83,11 @@ export class SavedObjectTypeRegistry implements ISavedObjectTypeRegistry {
     return this.types.get(type)?.hidden ?? false;
   }
 
+  /** {@inheritDoc ISavedObjectTypeRegistry.isHiddenFromHttpApi} */
+  public isHiddenFromHttpApis(type: string) {
+    return !!this.types.get(type)?.hiddenFromHttpApis;
+  }
+
   /** {@inheritDoc ISavedObjectTypeRegistry.getType} */
   public getIndex(type: string) {
     return this.types.get(type)?.indexPattern;
@@ -89,7 +99,7 @@ export class SavedObjectTypeRegistry implements ISavedObjectTypeRegistry {
   }
 }
 
-const validateType = ({ name, management }: SavedObjectsType) => {
+const validateType = ({ name, management, hidden, hiddenFromHttpApis }: SavedObjectsType) => {
   if (management) {
     if (management.onExport && !management.importableAndExportable) {
       throw new Error(
@@ -102,4 +112,10 @@ const validateType = ({ name, management }: SavedObjectsType) => {
       );
     }
   }
+  // throw error if a type is registered as `hidden:true` and `hiddenFromHttpApis:false` explicitly
+  if (hidden === true && hiddenFromHttpApis === false) {
+    throw new Error(
+      `Type ${name}: 'hiddenFromHttpApis' cannot be 'false' when specifying 'hidden' as 'true'`
+    );
+  }
 };
diff --git a/packages/core/saved-objects/core-saved-objects-base-server-mocks/src/saved_objects_type_registry.mock.ts b/packages/core/saved-objects/core-saved-objects-base-server-mocks/src/saved_objects_type_registry.mock.ts
index 8f792f177b5fc6..477d170e562409 100644
--- a/packages/core/saved-objects/core-saved-objects-base-server-mocks/src/saved_objects_type_registry.mock.ts
+++ b/packages/core/saved-objects/core-saved-objects-base-server-mocks/src/saved_objects_type_registry.mock.ts
@@ -16,6 +16,7 @@ const createRegistryMock = (): jest.Mocked<
     registerType: jest.fn(),
     getType: jest.fn(),
     getVisibleTypes: jest.fn(),
+    getVisibleToHttpApisTypes: jest.fn(),
     getAllTypes: jest.fn(),
     getImportableAndExportableTypes: jest.fn(),
     isNamespaceAgnostic: jest.fn(),
@@ -23,6 +24,7 @@ const createRegistryMock = (): jest.Mocked<
     isMultiNamespace: jest.fn(),
     isShareable: jest.fn(),
     isHidden: jest.fn(),
+    isHiddenFromHttpApis: jest.fn(),
     getIndex: jest.fn(),
     isImportableAndExportable: jest.fn(),
   };
@@ -33,6 +35,7 @@ const createRegistryMock = (): jest.Mocked<
   mock.getIndex.mockReturnValue('.kibana-test');
   mock.getIndex.mockReturnValue('.kibana-test');
   mock.isHidden.mockReturnValue(false);
+  mock.isHiddenFromHttpApis.mockReturnValue(false);
   mock.isNamespaceAgnostic.mockImplementation((type: string) => type === 'global');
   mock.isSingleNamespace.mockImplementation(
     (type: string) => type !== 'global' && type !== 'shared'
@@ -40,6 +43,7 @@ const createRegistryMock = (): jest.Mocked<
   mock.isMultiNamespace.mockImplementation((type: string) => type === 'shared');
   mock.isShareable.mockImplementation((type: string) => type === 'shared');
   mock.isImportableAndExportable.mockReturnValue(true);
+  mock.getVisibleToHttpApisTypes.mockReturnValue(false);
 
   return mock;
 };
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_create.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_create.ts
index 4192e800e51d23..fd32068d79ebff 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_create.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_create.ts
@@ -9,7 +9,7 @@
 import { schema } from '@kbn/config-schema';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { InternalSavedObjectRouter } from '../internal_types';
-import { catchAndReturnBoomErrors } from './utils';
+import { catchAndReturnBoomErrors, throwIfAnyTypeNotVisibleByAPI } from './utils';
 
 interface RouteDependencies {
   coreUsageData: InternalCoreUsageDataSetup;
@@ -55,6 +55,9 @@ export const registerBulkCreateRoute = (
       usageStatsClient.incrementSavedObjectsBulkCreate({ request: req }).catch(() => {});
 
       const { savedObjects } = await context.core;
+
+      const typesToCheck = [...new Set(req.body.map(({ type }) => type))];
+      throwIfAnyTypeNotVisibleByAPI(typesToCheck, savedObjects.typeRegistry);
       const result = await savedObjects.client.bulkCreate(req.body, { overwrite });
       return res.ok({ body: result });
     })
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_delete.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_delete.ts
index f435eadebd0669..720bd6ecdb7e1a 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_delete.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_delete.ts
@@ -9,7 +9,7 @@
 import { schema } from '@kbn/config-schema';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { InternalSavedObjectRouter } from '../internal_types';
-import { catchAndReturnBoomErrors } from './utils';
+import { catchAndReturnBoomErrors, throwIfAnyTypeNotVisibleByAPI } from './utils';
 
 interface RouteDependencies {
   coreUsageData: InternalCoreUsageDataSetup;
@@ -41,6 +41,9 @@ export const registerBulkDeleteRoute = (
 
       const { savedObjects } = await context.core;
 
+      const typesToCheck = [...new Set(req.body.map(({ type }) => type))];
+      throwIfAnyTypeNotVisibleByAPI(typesToCheck, savedObjects.typeRegistry);
+
       const statuses = await savedObjects.client.bulkDelete(req.body, { force });
       return res.ok({ body: statuses });
     })
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_get.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_get.ts
index ec8d7a1c842056..30a9a1625c39dd 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_get.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_get.ts
@@ -9,7 +9,7 @@
 import { schema } from '@kbn/config-schema';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { InternalSavedObjectRouter } from '../internal_types';
-import { catchAndReturnBoomErrors } from './utils';
+import { catchAndReturnBoomErrors, throwIfAnyTypeNotVisibleByAPI } from './utils';
 
 interface RouteDependencies {
   coreUsageData: InternalCoreUsageDataSetup;
@@ -38,6 +38,9 @@ export const registerBulkGetRoute = (
       usageStatsClient.incrementSavedObjectsBulkGet({ request: req }).catch(() => {});
 
       const { savedObjects } = await context.core;
+      const typesToCheck = [...new Set(req.body.map(({ type }) => type))];
+      throwIfAnyTypeNotVisibleByAPI(typesToCheck, savedObjects.typeRegistry);
+
       const result = await savedObjects.client.bulkGet(req.body);
       return res.ok({ body: result });
     })
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_resolve.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_resolve.ts
index 8947719bd2ab57..77f3d480bcdefa 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_resolve.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_resolve.ts
@@ -9,7 +9,7 @@
 import { schema } from '@kbn/config-schema';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { InternalSavedObjectRouter } from '../internal_types';
-import { catchAndReturnBoomErrors } from './utils';
+import { catchAndReturnBoomErrors, throwIfAnyTypeNotVisibleByAPI } from './utils';
 
 interface RouteDependencies {
   coreUsageData: InternalCoreUsageDataSetup;
@@ -36,6 +36,8 @@ export const registerBulkResolveRoute = (
       usageStatsClient.incrementSavedObjectsBulkResolve({ request: req }).catch(() => {});
 
       const { savedObjects } = await context.core;
+      const typesToCheck = [...new Set(req.body.map(({ type }) => type))];
+      throwIfAnyTypeNotVisibleByAPI(typesToCheck, savedObjects.typeRegistry);
       const result = await savedObjects.client.bulkResolve(req.body);
       return res.ok({ body: result });
     })
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_update.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_update.ts
index dbe60203afddfb..b198ef2ad5fecf 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_update.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/bulk_update.ts
@@ -9,7 +9,7 @@
 import { schema } from '@kbn/config-schema';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { InternalSavedObjectRouter } from '../internal_types';
-import { catchAndReturnBoomErrors } from './utils';
+import { catchAndReturnBoomErrors, throwIfAnyTypeNotVisibleByAPI } from './utils';
 
 interface RouteDependencies {
   coreUsageData: InternalCoreUsageDataSetup;
@@ -48,6 +48,10 @@ export const registerBulkUpdateRoute = (
       usageStatsClient.incrementSavedObjectsBulkUpdate({ request: req }).catch(() => {});
 
       const { savedObjects } = await context.core;
+
+      const typesToCheck = [...new Set(req.body.map(({ type }) => type))];
+      throwIfAnyTypeNotVisibleByAPI(typesToCheck, savedObjects.typeRegistry);
+
       const savedObject = await savedObjects.client.bulkUpdate(req.body);
       return res.ok({ body: savedObject });
     })
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/create.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/create.ts
index 2ef810ebebed73..fcdb1fef13889a 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/create.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/create.ts
@@ -9,7 +9,7 @@
 import { schema } from '@kbn/config-schema';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { InternalSavedObjectRouter } from '../internal_types';
-import { catchAndReturnBoomErrors } from './utils';
+import { catchAndReturnBoomErrors, throwIfTypeNotVisibleByAPI } from './utils';
 
 interface RouteDependencies {
   coreUsageData: InternalCoreUsageDataSetup;
@@ -56,6 +56,10 @@ export const registerCreateRoute = (
       const usageStatsClient = coreUsageData.getClient();
       usageStatsClient.incrementSavedObjectsCreate({ request: req }).catch(() => {});
 
+      const { savedObjects } = await context.core;
+
+      throwIfTypeNotVisibleByAPI(type, savedObjects.typeRegistry);
+
       const options = {
         id,
         overwrite,
@@ -64,7 +68,6 @@ export const registerCreateRoute = (
         references,
         initialNamespaces,
       };
-      const { savedObjects } = await context.core;
       const result = await savedObjects.client.create(type, attributes, options);
       return res.ok({ body: result });
     })
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/delete.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/delete.ts
index bfef6deb885efc..eea862e64008b9 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/delete.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/delete.ts
@@ -9,7 +9,7 @@
 import { schema } from '@kbn/config-schema';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { InternalSavedObjectRouter } from '../internal_types';
-import { catchAndReturnBoomErrors } from './utils';
+import { catchAndReturnBoomErrors, throwIfTypeNotVisibleByAPI } from './utils';
 
 interface RouteDependencies {
   coreUsageData: InternalCoreUsageDataSetup;
@@ -35,10 +35,11 @@ export const registerDeleteRoute = (
     catchAndReturnBoomErrors(async (context, req, res) => {
       const { type, id } = req.params;
       const { force } = req.query;
-      const { getClient } = (await context.core).savedObjects;
+      const { getClient, typeRegistry } = (await context.core).savedObjects;
 
       const usageStatsClient = coreUsageData.getClient();
       usageStatsClient.incrementSavedObjectsDelete({ request: req }).catch(() => {});
+      throwIfTypeNotVisibleByAPI(type, typeRegistry);
 
       const client = getClient();
       const result = await client.delete(type, id, { force });
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/find.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/find.ts
index 983b31caf7a2b0..a2d4497dd5f6e4 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/find.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/find.ts
@@ -9,7 +9,7 @@
 import { schema } from '@kbn/config-schema';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { InternalSavedObjectRouter } from '../internal_types';
-import { catchAndReturnBoomErrors } from './utils';
+import { catchAndReturnBoomErrors, throwOnHttpHiddenTypes } from './utils';
 
 interface RouteDependencies {
   coreUsageData: InternalCoreUsageDataSetup;
@@ -67,7 +67,7 @@ export const registerFindRoute = (
       const usageStatsClient = coreUsageData.getClient();
       usageStatsClient.incrementSavedObjectsFind({ request: req }).catch(() => {});
 
-      // manually validation to avoid using JSON.parse twice
+      // manually validate to avoid using JSON.parse twice
       let aggs;
       if (query.aggs) {
         try {
@@ -81,10 +81,25 @@ export const registerFindRoute = (
         }
       }
       const { savedObjects } = await context.core;
+
+      // check if registered type(s)are exposed to the global SO Http API's.
+      const findForTypes = Array.isArray(query.type) ? query.type : [query.type];
+
+      const unsupportedTypes = [...new Set(findForTypes)].filter((tname) => {
+        const fullType = savedObjects.typeRegistry.getType(tname);
+        // pass unknown types through to the registry to handle
+        if (!fullType?.hidden && fullType?.hiddenFromHttpApis) {
+          return fullType.name;
+        }
+      });
+      if (unsupportedTypes.length > 0) {
+        throwOnHttpHiddenTypes(unsupportedTypes);
+      }
+
       const result = await savedObjects.client.find({
         perPage: query.per_page,
         page: query.page,
-        type: Array.isArray(query.type) ? query.type : [query.type],
+        type: findForTypes,
         search: query.search,
         defaultSearchOperator: query.default_search_operator,
         searchFields:
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/get.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/get.ts
index dbe2c1a4d9d8d6..b8c1ab5614b7a3 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/get.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/get.ts
@@ -9,7 +9,7 @@
 import { schema } from '@kbn/config-schema';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { InternalSavedObjectRouter } from '../internal_types';
-import { catchAndReturnBoomErrors } from './utils';
+import { catchAndReturnBoomErrors, throwIfTypeNotVisibleByAPI } from './utils';
 
 interface RouteDependencies {
   coreUsageData: InternalCoreUsageDataSetup;
@@ -36,6 +36,8 @@ export const registerGetRoute = (
       usageStatsClient.incrementSavedObjectsGet({ request: req }).catch(() => {});
 
       const { savedObjects } = await context.core;
+      throwIfTypeNotVisibleByAPI(type, savedObjects.typeRegistry);
+
       const object = await savedObjects.client.get(type, id);
       return res.ok({ body: object });
     })
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/resolve.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/resolve.ts
index a1804c1fa31767..ac8d4fdcc5ba7e 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/resolve.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/resolve.ts
@@ -9,6 +9,7 @@
 import { schema } from '@kbn/config-schema';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { InternalSavedObjectRouter } from '../internal_types';
+import { throwIfTypeNotVisibleByAPI } from './utils';
 
 interface RouteDependencies {
   coreUsageData: InternalCoreUsageDataSetup;
@@ -35,6 +36,8 @@ export const registerResolveRoute = (
       const usageStatsClient = coreUsageData.getClient();
       usageStatsClient.incrementSavedObjectsResolve({ request: req }).catch(() => {});
 
+      throwIfTypeNotVisibleByAPI(type, savedObjects.typeRegistry);
+
       const result = await savedObjects.client.resolve(type, id);
       return res.ok({ body: result });
     })
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/update.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/update.ts
index 463b5465b53a01..491add9a182ca9 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/update.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/update.ts
@@ -10,7 +10,7 @@ import { schema } from '@kbn/config-schema';
 import type { SavedObjectsUpdateOptions } from '@kbn/core-saved-objects-api-server';
 import type { InternalCoreUsageDataSetup } from '@kbn/core-usage-data-base-server-internal';
 import type { InternalSavedObjectRouter } from '../internal_types';
-import { catchAndReturnBoomErrors } from './utils';
+import { catchAndReturnBoomErrors, throwIfTypeNotVisibleByAPI } from './utils';
 
 interface RouteDependencies {
   coreUsageData: InternalCoreUsageDataSetup;
@@ -51,8 +51,10 @@ export const registerUpdateRoute = (
 
       const usageStatsClient = coreUsageData.getClient();
       usageStatsClient.incrementSavedObjectsUpdate({ request: req }).catch(() => {});
-
       const { savedObjects } = await context.core;
+
+      throwIfTypeNotVisibleByAPI(type, savedObjects.typeRegistry);
+
       const result = await savedObjects.client.update(type, id, attributes, options);
       return res.ok({ body: result });
     })
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.test.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.test.ts
index ddeff043f2bbab..6d0b78c58837ef 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.test.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.test.ts
@@ -6,7 +6,15 @@
  * Side Public License, v 1.
  */
 
-import { createSavedObjectsStreamFromNdJson, validateTypes, validateObjects } from './utils';
+import {
+  createSavedObjectsStreamFromNdJson,
+  validateTypes,
+  validateObjects,
+  throwOnHttpHiddenTypes,
+  throwOnGloballyHiddenTypes,
+  throwIfTypeNotVisibleByAPI,
+  throwIfAnyTypeNotVisibleByAPI,
+} from './utils';
 import { Readable } from 'stream';
 import { createPromiseFromStreams, createConcatStream } from '@kbn/utils';
 import { catchAndReturnBoomErrors } from './utils';
@@ -18,6 +26,7 @@ import type {
   KibanaResponseFactory,
 } from '@kbn/core-http-server';
 import { kibanaResponseFactory } from '@kbn/core-http-router-server-internal';
+import { typeRegistryInstanceMock } from '../saved_objects_service.test.mocks';
 
 async function readStreamToCompletion(stream: Readable) {
   return createPromiseFromStreams([stream, createConcatStream([])]);
@@ -236,3 +245,99 @@ describe('catchAndReturnBoomErrors', () => {
     );
   });
 });
+
+describe('throwOnHttpHiddenTypes', () => {
+  it('should throw on types hidden from the HTTP Apis', () => {
+    expect(() => {
+      throwOnHttpHiddenTypes(['not-allowed-type']);
+    }).toThrowErrorMatchingInlineSnapshot(
+      `"Unsupported saved object type(s): not-allowed-type: Bad Request"`
+    );
+    expect(() => {
+      throwOnHttpHiddenTypes(['index-pattern', 'not-allowed-type', 'not-allowed-type-2']);
+    }).toThrowErrorMatchingInlineSnapshot(
+      `"Unsupported saved object type(s): index-pattern, not-allowed-type, not-allowed-type-2: Bad Request"`
+    );
+  });
+  it("returns if there aren't any types provided to check", () => {
+    expect(() => {
+      throwOnHttpHiddenTypes([]);
+    }).not.toThrowError();
+  });
+});
+
+describe('throwOnGloballyHiddenTypes', () => {
+  const httpVisibleTypes = ['config', 'index-pattern', 'dashboard'];
+
+  it('throws if some objects are not globally visible', () => {
+    expect(() => {
+      throwOnGloballyHiddenTypes(httpVisibleTypes, ['not-allowed-type']);
+    }).toThrowErrorMatchingInlineSnapshot(
+      `"Unsupported saved object type(s): not-allowed-type: Bad Request"`
+    );
+  });
+
+  it("returns if there aren't any types provided to check", () => {
+    expect(() => {
+      throwOnGloballyHiddenTypes(httpVisibleTypes, []);
+    }).not.toThrowError();
+  });
+});
+
+describe('throwIfTypeNotVisibleByAPI', () => {
+  const registry = typeRegistryInstanceMock;
+  registry.getType.mockImplementation((name: string) => {
+    return {
+      name,
+      hidden: name === 'hidden' ? true : false,
+      hiddenFromHttpApis: name === 'hiddenFromHttpApis' ? true : false,
+      namespaceType: 'multiple-isolated',
+      mappings: { properties: {} },
+    };
+  });
+
+  it('throws if a type is not visible by to the HTTP APIs', () => {
+    expect(() =>
+      throwIfTypeNotVisibleByAPI('hiddenFromHttpApis', registry)
+    ).toThrowErrorMatchingInlineSnapshot(
+      `"Unsupported saved object type: 'hiddenFromHttpApis': Bad Request"`
+    );
+  });
+
+  it('does not throw when a type is not hidden from the HTTP APIS', () => {
+    expect(() => throwIfTypeNotVisibleByAPI('hidden', registry)).not.toThrowError();
+  });
+
+  it('does not throw on visible types', () => {
+    expect(() => throwIfTypeNotVisibleByAPI('config', registry)).not.toThrowError();
+  });
+});
+
+describe('throwIfAnyTypeNotVisibleByAPI', () => {
+  const registry = typeRegistryInstanceMock;
+  registry.getType.mockImplementation((name: string) => {
+    return {
+      name,
+      hidden: name === 'hidden' ? true : false,
+      hiddenFromHttpApis: name === 'hiddenFromHttpApis' ? true : false,
+      namespaceType: 'multiple-isolated',
+      mappings: { properties: {} },
+    };
+  });
+
+  it('throws if the provided types contains any that are not visible by to the HTTP APIs', () => {
+    expect(() =>
+      throwIfAnyTypeNotVisibleByAPI(['hiddenFromHttpApis'], registry)
+    ).toThrowErrorMatchingInlineSnapshot(
+      `"Unsupported saved object type(s): hiddenFromHttpApis: Bad Request"`
+    );
+  });
+
+  it('does not throw when a type is not hidden from the HTTP APIS', () => {
+    expect(() => throwIfAnyTypeNotVisibleByAPI(['hidden'], registry)).not.toThrowError();
+  });
+
+  it('does not throw on visible types', () => {
+    expect(() => throwIfAnyTypeNotVisibleByAPI(['config'], registry)).not.toThrowError();
+  });
+});
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts
index 463d59baf62072..47579b949aced5 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts
@@ -18,7 +18,11 @@ import {
 import Boom from '@hapi/boom';
 import type { RequestHandlerWrapper } from '@kbn/core-http-server';
 import type { SavedObject } from '@kbn/core-saved-objects-common';
-import type { SavedObjectsExportResultDetails } from '@kbn/core-saved-objects-server';
+import type {
+  ISavedObjectTypeRegistry,
+  SavedObjectsExportResultDetails,
+} from '@kbn/core-saved-objects-server';
+import { SavedObjectsErrorHelpers } from '@kbn/core-saved-objects-utils-server';
 
 export async function createSavedObjectsStreamFromNdJson(ndJsonStream: Readable) {
   const savedObjects = await createPromiseFromStreams([
@@ -82,3 +86,69 @@ export const catchAndReturnBoomErrors: RequestHandlerWrapper = (handler) => {
     }
   };
 };
+
+/**
+ *
+ * @param {string[]} exposedVisibleTypes all registered types with hidden:false and hiddenFromHttpApis:false|undefined
+ * @param {string[]} typesToCheck saved object types provided to the httpApi request
+ */
+export function throwOnGloballyHiddenTypes(
+  allHttpApisVisibleTypes: string[],
+  typesToCheck: string[]
+) {
+  if (!typesToCheck.length) {
+    return;
+  }
+  const denyRequestForTypes = typesToCheck.filter(
+    (type: string) => !allHttpApisVisibleTypes.includes(type)
+  );
+  if (denyRequestForTypes.length > 0) {
+    throw SavedObjectsErrorHelpers.createBadRequestError(
+      `Unsupported saved object type(s): ${denyRequestForTypes.join(', ')}`
+    );
+  }
+}
+/**
+ * @param {string[]} unsupportedTypes saved object types registered with hidden=false and hiddenFromHttpApis=true
+ */
+
+export function throwOnHttpHiddenTypes(unsupportedTypes: string[]) {
+  if (unsupportedTypes.length > 0) {
+    throw SavedObjectsErrorHelpers.createBadRequestError(
+      `Unsupported saved object type(s): ${unsupportedTypes.join(', ')}`
+    );
+  }
+}
+/**
+ * @param {string[]} type saved object type
+ * @param {ISavedObjectTypeRegistry} registry the saved object type registry
+ */
+
+export function throwIfTypeNotVisibleByAPI(type: string, registry: ISavedObjectTypeRegistry) {
+  if (!type) return;
+  const fullType = registry.getType(type);
+  if (!fullType?.hidden && fullType?.hiddenFromHttpApis) {
+    throw SavedObjectsErrorHelpers.createUnsupportedTypeError(type);
+  }
+}
+
+export function throwIfAnyTypeNotVisibleByAPI(
+  typesToCheck: string[],
+  registry: ISavedObjectTypeRegistry
+) {
+  const unsupportedTypes = typesToCheck.filter((tname) => {
+    const fullType = registry.getType(tname);
+    if (!fullType?.hidden && fullType?.hiddenFromHttpApis) {
+      return fullType.name;
+    }
+  });
+  if (unsupportedTypes.length > 0) {
+    throwOnHttpHiddenTypes(unsupportedTypes);
+  }
+}
+export interface BulkGetItem {
+  type: string;
+  id: string;
+  fields?: string[];
+  namespaces?: string[];
+}
diff --git a/packages/core/saved-objects/core-saved-objects-server-internal/tsconfig.json b/packages/core/saved-objects/core-saved-objects-server-internal/tsconfig.json
index 4d43cd2ea06b3d..f2db7db82446df 100644
--- a/packages/core/saved-objects/core-saved-objects-server-internal/tsconfig.json
+++ b/packages/core/saved-objects/core-saved-objects-server-internal/tsconfig.json
@@ -46,6 +46,7 @@
     "@kbn/core-elasticsearch-server-mocks",
     "@kbn/utils",
     "@kbn/core-http-router-server-internal",
+    "@kbn/core-saved-objects-utils-server",
   ],
   "exclude": [
     "target/**/*",
diff --git a/packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts b/packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts
index 8c5ff2b9fa5422..9dee63c3556769 100644
--- a/packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts
+++ b/packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts
@@ -33,6 +33,14 @@ export interface SavedObjectsType<Attributes = any> {
    * See {@link SavedObjectsServiceStart.createInternalRepository | createInternalRepository}.
    */
   hidden: boolean;
+  /**
+   * Is the type hidden from the http APIs. If `hiddenFromHttpApis:true`, repositories will have access to the type but the type is not exposed via the HTTP APIs.
+   * It is recommended to hide types registered with 'hidden=false' from the httpApis for backward compatibility in the HTTP layer.
+   *
+   * @remarks Setting this property for hidden types is not recommended and will fail validation if set to `false`.
+   * @internalRemarks Using 'hiddenFromHttpApis' is an alternative to registering types as `hidden:true` to hide a type from the HTTP APIs without effecting repositories access.
+   */
+  hiddenFromHttpApis?: boolean;
   /**
    * The {@link SavedObjectsNamespaceType | namespace type} for the type.
    */
diff --git a/packages/core/saved-objects/core-saved-objects-server/src/type_registry.ts b/packages/core/saved-objects/core-saved-objects-server/src/type_registry.ts
index ac3647da81f7fe..4f85771325ea75 100644
--- a/packages/core/saved-objects/core-saved-objects-server/src/type_registry.ts
+++ b/packages/core/saved-objects/core-saved-objects-server/src/type_registry.ts
@@ -24,6 +24,13 @@ export interface ISavedObjectTypeRegistry {
    */
   getVisibleTypes(): SavedObjectsType[];
 
+  /**
+   * Returns all visible {@link SavedObjectsType | types} exposed to the global SO HTTP APIs
+   *
+   * A visibleToHttpApis type is a type that doesn't explicitly define `hidden=true` nor `hiddenFromHttpApis=true` during registration.
+   */
+  getVisibleToHttpApisTypes(): SavedObjectsType[];
+
   /**
    * Return all {@link SavedObjectsType | types} currently registered, including the hidden ones.
    *
@@ -66,6 +73,11 @@ export interface ISavedObjectTypeRegistry {
    */
   isHidden(type: string): boolean;
 
+  /**
+   * Returns the `hiddenFromHttpApis` property for a given type, or `false` if
+   * the type is not registered
+   */
+  isHiddenFromHttpApis(type: string): boolean;
   /**
    * Returns the `indexPattern` property for given type, or `undefined` if
    * the type is not registered.
diff --git a/packages/core/test-helpers/core-test-helpers-test-utils/index.ts b/packages/core/test-helpers/core-test-helpers-test-utils/index.ts
index 1ffa5814389be0..27288dede02a65 100644
--- a/packages/core/test-helpers/core-test-helpers-test-utils/index.ts
+++ b/packages/core/test-helpers/core-test-helpers-test-utils/index.ts
@@ -8,3 +8,4 @@
 
 export { setupServer } from './src/setup_server';
 export { createExportableType } from './src/create_exportable_type';
+export { createHiddenTypeVariants } from './src/create_hidden_type_variants';
diff --git a/packages/core/test-helpers/core-test-helpers-test-utils/src/create_hidden_type_variants.ts b/packages/core/test-helpers/core-test-helpers-test-utils/src/create_hidden_type_variants.ts
new file mode 100644
index 00000000000000..933e616c9ab7f5
--- /dev/null
+++ b/packages/core/test-helpers/core-test-helpers-test-utils/src/create_hidden_type_variants.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { SavedObjectsType } from '@kbn/core-saved-objects-server';
+
+export const createHiddenTypeVariants = (createOptions: {
+  name: string;
+  hide?: boolean;
+  hideFromHttpApis?: boolean;
+}): SavedObjectsType => {
+  return {
+    name: createOptions.name,
+    hidden: createOptions.hide ?? false,
+    hiddenFromHttpApis: createOptions.hideFromHttpApis ?? undefined,
+    namespaceType: createOptions.name === 'index-pattern' ? 'multiple' : 'single',
+    mappings: {
+      properties: {},
+    },
+  };
+};
diff --git a/src/core/server/integration_tests/saved_objects/routes/bulk_create.test.ts b/src/core/server/integration_tests/saved_objects/routes/bulk_create.test.ts
index 073025be64bcec..aba1f322f3bd2c 100644
--- a/src/core/server/integration_tests/saved_objects/routes/bulk_create.test.ts
+++ b/src/core/server/integration_tests/saved_objects/routes/bulk_create.test.ts
@@ -18,10 +18,15 @@ import {
   registerBulkCreateRoute,
   type InternalSavedObjectsRequestHandlerContext,
 } from '@kbn/core-saved-objects-server-internal';
-import { setupServer } from '@kbn/core-test-helpers-test-utils';
+import { createHiddenTypeVariants, setupServer } from '@kbn/core-test-helpers-test-utils';
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
 
+const testTypes = [
+  { name: 'index-pattern', hide: false },
+  { name: 'hidden-from-http', hide: false, hideFromHttpApis: true },
+];
+
 describe('POST /api/saved_objects/_bulk_create', () => {
   let server: SetupServerReturn['server'];
   let httpSetup: SetupServerReturn['httpSetup'];
@@ -34,6 +39,12 @@ describe('POST /api/saved_objects/_bulk_create', () => {
     savedObjectsClient = handlerContext.savedObjects.client;
     savedObjectsClient.bulkCreate.mockResolvedValue({ saved_objects: [] });
 
+    handlerContext.savedObjects.typeRegistry.getType.mockImplementation((typename: string) => {
+      return testTypes
+        .map((typeDesc) => createHiddenTypeVariants(typeDesc))
+        .find((fullTest) => fullTest.name === typename);
+    });
+
     const router =
       httpSetup.createRouter<InternalSavedObjectsRequestHandlerContext>('/api/saved_objects/');
     coreUsageStatsClient = coreUsageStatsClientMock.create();
@@ -131,4 +142,23 @@ describe('POST /api/saved_objects/_bulk_create', () => {
     const args = savedObjectsClient.bulkCreate.mock.calls[0];
     expect(args[1]).toEqual({ overwrite: true });
   });
+
+  it('returns with status 400 when a type is hidden from the HTTP APIs', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .post('/api/saved_objects/_bulk_create')
+      .send([
+        {
+          id: 'hiddenID',
+          type: 'hidden-from-http',
+          attributes: {
+            title: 'bar',
+          },
+          references: [],
+        },
+      ])
+      .expect(400);
+    expect(result.body.message).toContain(
+      'Unsupported saved object type(s): hidden-from-http: Bad Request'
+    );
+  });
 });
diff --git a/src/core/server/integration_tests/saved_objects/routes/bulk_delete.test.ts b/src/core/server/integration_tests/saved_objects/routes/bulk_delete.test.ts
index 5b6aae242da883..f05780cc0fd659 100644
--- a/src/core/server/integration_tests/saved_objects/routes/bulk_delete.test.ts
+++ b/src/core/server/integration_tests/saved_objects/routes/bulk_delete.test.ts
@@ -13,7 +13,7 @@ import {
   coreUsageStatsClientMock,
   coreUsageDataServiceMock,
 } from '@kbn/core-usage-data-server-mocks';
-import { setupServer } from '@kbn/core-test-helpers-test-utils';
+import { createHiddenTypeVariants, setupServer } from '@kbn/core-test-helpers-test-utils';
 import {
   registerBulkDeleteRoute,
   type InternalSavedObjectsRequestHandlerContext,
@@ -21,6 +21,11 @@ import {
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
 
+const testTypes = [
+  { name: 'index-pattern', hide: false },
+  { name: 'hidden-from-http', hide: false, hideFromHttpApis: true },
+];
+
 describe('POST /api/saved_objects/_bulk_delete', () => {
   let server: SetupServerReturn['server'];
   let httpSetup: SetupServerReturn['httpSetup'];
@@ -35,6 +40,13 @@ describe('POST /api/saved_objects/_bulk_delete', () => {
     savedObjectsClient.bulkDelete.mockResolvedValue({
       statuses: [],
     });
+
+    handlerContext.savedObjects.typeRegistry.getType.mockImplementation((typename: string) => {
+      return testTypes
+        .map((typeDesc) => createHiddenTypeVariants(typeDesc))
+        .find((fullTest) => fullTest.name === typename);
+    });
+
     const router =
       httpSetup.createRouter<InternalSavedObjectsRequestHandlerContext>('/api/saved_objects/');
     coreUsageStatsClient = coreUsageStatsClientMock.create();
@@ -94,4 +106,31 @@ describe('POST /api/saved_objects/_bulk_delete', () => {
     expect(savedObjectsClient.bulkDelete).toHaveBeenCalledTimes(1);
     expect(savedObjectsClient.bulkDelete).toHaveBeenCalledWith(docs, { force: true });
   });
+
+  it('returns with status 400 when a type is hidden from the HTTP APIs', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .post('/api/saved_objects/_bulk_delete')
+      .send([
+        {
+          id: 'hiddenID',
+          type: 'hidden-from-http',
+        },
+      ])
+      .expect(400);
+    expect(result.body.message).toContain('Unsupported saved object type(s):');
+  });
+
+  it('returns with status 400 with `force` when a type is hidden from the HTTP APIs', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .post('/api/saved_objects/_bulk_delete')
+      .send([
+        {
+          id: 'hiddenID',
+          type: 'hidden-from-http',
+        },
+      ])
+      .query({ force: true })
+      .expect(400);
+    expect(result.body.message).toContain('Unsupported saved object type(s):');
+  });
 });
diff --git a/src/core/server/integration_tests/saved_objects/routes/bulk_get.test.ts b/src/core/server/integration_tests/saved_objects/routes/bulk_get.test.ts
index 80a2480a31773c..fdd23217891c4c 100644
--- a/src/core/server/integration_tests/saved_objects/routes/bulk_get.test.ts
+++ b/src/core/server/integration_tests/saved_objects/routes/bulk_get.test.ts
@@ -13,7 +13,7 @@ import {
   coreUsageStatsClientMock,
   coreUsageDataServiceMock,
 } from '@kbn/core-usage-data-server-mocks';
-import { setupServer } from '@kbn/core-test-helpers-test-utils';
+import { createHiddenTypeVariants, setupServer } from '@kbn/core-test-helpers-test-utils';
 import {
   registerBulkGetRoute,
   type InternalSavedObjectsRequestHandlerContext,
@@ -21,6 +21,11 @@ import {
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
 
+const testTypes = [
+  { name: 'index-pattern', hide: false },
+  { name: 'hidden-from-http', hide: false, hideFromHttpApis: true },
+];
+
 describe('POST /api/saved_objects/_bulk_get', () => {
   let server: SetupServerReturn['server'];
   let httpSetup: SetupServerReturn['httpSetup'];
@@ -35,6 +40,12 @@ describe('POST /api/saved_objects/_bulk_get', () => {
     savedObjectsClient.bulkGet.mockResolvedValue({
       saved_objects: [],
     });
+
+    handlerContext.savedObjects.typeRegistry.getType.mockImplementation((typename: string) => {
+      return testTypes
+        .map((typeDesc) => createHiddenTypeVariants(typeDesc))
+        .find((fullTest) => fullTest.name === typename);
+    });
     const router =
       httpSetup.createRouter<InternalSavedObjectsRequestHandlerContext>('/api/saved_objects/');
     coreUsageStatsClient = coreUsageStatsClientMock.create();
@@ -96,4 +107,17 @@ describe('POST /api/saved_objects/_bulk_get', () => {
     expect(savedObjectsClient.bulkGet).toHaveBeenCalledTimes(1);
     expect(savedObjectsClient.bulkGet).toHaveBeenCalledWith(docs);
   });
+
+  it('returns with status 400 when a type is hidden from the HTTP APIs', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .post('/api/saved_objects/_bulk_get')
+      .send([
+        {
+          id: 'hiddenID',
+          type: 'hidden-from-http',
+        },
+      ])
+      .expect(400);
+    expect(result.body.message).toContain('Unsupported saved object type(s):');
+  });
 });
diff --git a/src/core/server/integration_tests/saved_objects/routes/bulk_resolve.test.ts b/src/core/server/integration_tests/saved_objects/routes/bulk_resolve.test.ts
index d284f2d937ad0d..3ea1e0c9580ac4 100644
--- a/src/core/server/integration_tests/saved_objects/routes/bulk_resolve.test.ts
+++ b/src/core/server/integration_tests/saved_objects/routes/bulk_resolve.test.ts
@@ -13,7 +13,7 @@ import {
   coreUsageStatsClientMock,
   coreUsageDataServiceMock,
 } from '@kbn/core-usage-data-server-mocks';
-import { setupServer } from '@kbn/core-test-helpers-test-utils';
+import { createHiddenTypeVariants, setupServer } from '@kbn/core-test-helpers-test-utils';
 import {
   registerBulkResolveRoute,
   type InternalSavedObjectsRequestHandlerContext,
@@ -21,6 +21,11 @@ import {
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
 
+const testTypes = [
+  { name: 'index-pattern', hide: false },
+  { name: 'hidden-from-http', hide: false, hideFromHttpApis: true },
+];
+
 describe('POST /api/saved_objects/_bulk_resolve', () => {
   let server: SetupServerReturn['server'];
   let httpSetup: SetupServerReturn['httpSetup'];
@@ -35,6 +40,13 @@ describe('POST /api/saved_objects/_bulk_resolve', () => {
     savedObjectsClient.bulkResolve.mockResolvedValue({
       resolved_objects: [],
     });
+
+    handlerContext.savedObjects.typeRegistry.getType.mockImplementation((typename: string) => {
+      return testTypes
+        .map((typeDesc) => createHiddenTypeVariants(typeDesc))
+        .find((fullTest) => fullTest.name === typename);
+    });
+
     const router =
       httpSetup.createRouter<InternalSavedObjectsRequestHandlerContext>('/api/saved_objects/');
     coreUsageStatsClient = coreUsageStatsClientMock.create();
@@ -99,4 +111,17 @@ describe('POST /api/saved_objects/_bulk_resolve', () => {
     expect(savedObjectsClient.bulkResolve).toHaveBeenCalledTimes(1);
     expect(savedObjectsClient.bulkResolve).toHaveBeenCalledWith(docs);
   });
+
+  it('returns with status 400 when a type is hidden from the HTTP APIs', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .post('/api/saved_objects/_bulk_resolve')
+      .send([
+        {
+          id: 'hiddenID',
+          type: 'hidden-from-http',
+        },
+      ])
+      .expect(400);
+    expect(result.body.message).toContain('Unsupported saved object type(s):');
+  });
 });
diff --git a/src/core/server/integration_tests/saved_objects/routes/bulk_update.test.ts b/src/core/server/integration_tests/saved_objects/routes/bulk_update.test.ts
index 36129d4c505512..04ad9dcd40592c 100644
--- a/src/core/server/integration_tests/saved_objects/routes/bulk_update.test.ts
+++ b/src/core/server/integration_tests/saved_objects/routes/bulk_update.test.ts
@@ -13,7 +13,7 @@ import {
   coreUsageStatsClientMock,
   coreUsageDataServiceMock,
 } from '@kbn/core-usage-data-server-mocks';
-import { setupServer } from '@kbn/core-test-helpers-test-utils';
+import { createHiddenTypeVariants, setupServer } from '@kbn/core-test-helpers-test-utils';
 import {
   registerBulkUpdateRoute,
   type InternalSavedObjectsRequestHandlerContext,
@@ -21,6 +21,13 @@ import {
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
 
+const testTypes = [
+  { name: 'visualization', hide: false },
+  { name: 'dashboard', hide: false },
+  { name: 'index-pattern', hide: false },
+  { name: 'hidden-from-http', hide: false, hideFromHttpApis: true },
+];
+
 describe('PUT /api/saved_objects/_bulk_update', () => {
   let server: SetupServerReturn['server'];
   let httpSetup: SetupServerReturn['httpSetup'];
@@ -30,8 +37,15 @@ describe('PUT /api/saved_objects/_bulk_update', () => {
 
   beforeEach(async () => {
     ({ server, httpSetup, handlerContext } = await setupServer());
+
     savedObjectsClient = handlerContext.savedObjects.client;
 
+    handlerContext.savedObjects.typeRegistry.getType.mockImplementation((typename: string) => {
+      return testTypes
+        .map((typeDesc) => createHiddenTypeVariants(typeDesc))
+        .find((fullTest) => fullTest.name === typename);
+    });
+
     const router =
       httpSetup.createRouter<InternalSavedObjectsRequestHandlerContext>('/api/saved_objects/');
     coreUsageStatsClient = coreUsageStatsClientMock.create();
@@ -139,4 +153,20 @@ describe('PUT /api/saved_objects/_bulk_update', () => {
       },
     ]);
   });
+
+  it('returns with status 400 when a type is hidden from the HTTP APIs', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .put('/api/saved_objects/_bulk_update')
+      .send([
+        {
+          type: 'hidden-from-http',
+          id: 'hiddenID',
+          attributes: {
+            title: 'bar',
+          },
+        },
+      ])
+      .expect(400);
+    expect(result.body.message).toContain('Unsupported saved object type(s):');
+  });
 });
diff --git a/src/core/server/integration_tests/saved_objects/routes/create.test.ts b/src/core/server/integration_tests/saved_objects/routes/create.test.ts
index 8bc97b44591a95..50791be209547e 100644
--- a/src/core/server/integration_tests/saved_objects/routes/create.test.ts
+++ b/src/core/server/integration_tests/saved_objects/routes/create.test.ts
@@ -13,7 +13,7 @@ import {
   coreUsageStatsClientMock,
   coreUsageDataServiceMock,
 } from '@kbn/core-usage-data-server-mocks';
-import { setupServer } from '@kbn/core-test-helpers-test-utils';
+import { setupServer, createHiddenTypeVariants } from '@kbn/core-test-helpers-test-utils';
 import {
   registerCreateRoute,
   type InternalSavedObjectsRequestHandlerContext,
@@ -21,6 +21,11 @@ import {
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
 
+const testTypes = [
+  { name: 'index-pattern', hide: false },
+  { name: 'hidden-type', hide: true },
+  { name: 'hidden-from-http', hide: false, hideFromHttpApis: true },
+];
 describe('POST /api/saved_objects/{type}', () => {
   let server: SetupServerReturn['server'];
   let httpSetup: SetupServerReturn['httpSetup'];
@@ -49,6 +54,12 @@ describe('POST /api/saved_objects/{type}', () => {
     const coreUsageData = coreUsageDataServiceMock.createSetupContract(coreUsageStatsClient);
     registerCreateRoute(router, { coreUsageData });
 
+    handlerContext.savedObjects.typeRegistry.getType.mockImplementation((typename: string) => {
+      return testTypes
+        .map((typeDesc) => createHiddenTypeVariants(typeDesc))
+        .find((fullTest) => fullTest.name === typename);
+    });
+
     await server.start();
   });
 
@@ -121,4 +132,17 @@ describe('POST /api/saved_objects/{type}', () => {
       { overwrite: false, id: 'logstash-*' },
     ]);
   });
+
+  it('returns with status 400 if the type is hidden from the HTTP APIs', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .post('/api/saved_objects/hidden-from-http')
+      .send({
+        attributes: {
+          properties: {},
+        },
+      })
+      .expect(400);
+
+    expect(result.body.message).toContain("Unsupported saved object type: 'hidden-from-http'");
+  });
 });
diff --git a/src/core/server/integration_tests/saved_objects/routes/delete.test.ts b/src/core/server/integration_tests/saved_objects/routes/delete.test.ts
index 372d9997614b87..42c97c0c565da8 100644
--- a/src/core/server/integration_tests/saved_objects/routes/delete.test.ts
+++ b/src/core/server/integration_tests/saved_objects/routes/delete.test.ts
@@ -13,7 +13,7 @@ import {
   coreUsageStatsClientMock,
   coreUsageDataServiceMock,
 } from '@kbn/core-usage-data-server-mocks';
-import { setupServer } from '@kbn/core-test-helpers-test-utils';
+import { createHiddenTypeVariants, setupServer } from '@kbn/core-test-helpers-test-utils';
 import {
   registerDeleteRoute,
   type InternalSavedObjectsRequestHandlerContext,
@@ -21,6 +21,12 @@ import {
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
 
+const testTypes = [
+  { name: 'index-pattern', hide: false },
+  { name: 'hidden-type', hide: true },
+  { name: 'hidden-from-http', hide: false, hideFromHttpApis: true },
+];
+
 describe('DELETE /api/saved_objects/{type}/{id}', () => {
   let server: SetupServerReturn['server'];
   let httpSetup: SetupServerReturn['httpSetup'];
@@ -32,6 +38,11 @@ describe('DELETE /api/saved_objects/{type}/{id}', () => {
     ({ server, httpSetup, handlerContext } = await setupServer());
     savedObjectsClient = handlerContext.savedObjects.getClient();
     handlerContext.savedObjects.getClient = jest.fn().mockImplementation(() => savedObjectsClient);
+    handlerContext.savedObjects.typeRegistry.getType.mockImplementation((typename: string) => {
+      return testTypes
+        .map((typeDesc) => createHiddenTypeVariants(typeDesc))
+        .find((fullTest) => fullTest.name === typename);
+    });
 
     const router =
       httpSetup.createRouter<InternalSavedObjectsRequestHandlerContext>('/api/saved_objects/');
@@ -78,4 +89,19 @@ describe('DELETE /api/saved_objects/{type}/{id}', () => {
       force: true,
     });
   });
+
+  it('returns with status 400 if a type is hidden from the HTTP APIs', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .delete('/api/saved_objects/hidden-from-http/hiddenId')
+      .expect(400);
+    expect(result.body.message).toContain("Unsupported saved object type: 'hidden-from-http'");
+  });
+
+  it('returns with status 400 if a type is hidden from the HTTP APIs with `force` option', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .delete('/api/saved_objects/hidden-from-http/hiddenId')
+      .query({ force: true })
+      .expect(400);
+    expect(result.body.message).toContain("Unsupported saved object type: 'hidden-from-http'");
+  });
 });
diff --git a/src/core/server/integration_tests/saved_objects/routes/find.test.ts b/src/core/server/integration_tests/saved_objects/routes/find.test.ts
index e35432d07353b0..2185edd9f5e195 100644
--- a/src/core/server/integration_tests/saved_objects/routes/find.test.ts
+++ b/src/core/server/integration_tests/saved_objects/routes/find.test.ts
@@ -15,7 +15,7 @@ import {
   coreUsageStatsClientMock,
   coreUsageDataServiceMock,
 } from '@kbn/core-usage-data-server-mocks';
-import { setupServer } from '@kbn/core-test-helpers-test-utils';
+import { createHiddenTypeVariants, setupServer } from '@kbn/core-test-helpers-test-utils';
 import {
   registerFindRoute,
   type InternalSavedObjectsRequestHandlerContext,
@@ -23,6 +23,15 @@ import {
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
 
+const testTypes = [
+  { name: 'index-pattern', hide: false },
+  { name: 'visualization', hide: false },
+  { name: 'dashboard', hide: false },
+  { name: 'foo', hide: false },
+  { name: 'bar', hide: false },
+  { name: 'hidden-type', hide: true },
+  { name: 'hidden-from-http', hide: false, hideFromHttpApis: true },
+];
 describe('GET /api/saved_objects/_find', () => {
   let server: SetupServerReturn['server'];
   let httpSetup: SetupServerReturn['httpSetup'];
@@ -39,6 +48,13 @@ describe('GET /api/saved_objects/_find', () => {
 
   beforeEach(async () => {
     ({ server, httpSetup, handlerContext } = await setupServer());
+
+    handlerContext.savedObjects.typeRegistry.getType.mockImplementation((typename: string) => {
+      return testTypes
+        .map((typeDesc) => createHiddenTypeVariants(typeDesc))
+        .find((fullTest) => fullTest.name === typename);
+    });
+
     savedObjectsClient = handlerContext.savedObjects.client;
 
     savedObjectsClient.find.mockResolvedValue(clientResponse);
@@ -67,6 +83,33 @@ describe('GET /api/saved_objects/_find', () => {
     );
   });
 
+  it('returns with status 400 when type is hidden from the HTTP APIs', async () => {
+    const findResponse = {
+      error: 'Bad Request',
+      message: 'Unsupported saved object type(s): hidden-from-http: Bad Request',
+      statusCode: 400,
+    };
+    const result = await supertest(httpSetup.server.listener)
+      .get('/api/saved_objects/_find?type=hidden-from-http')
+      .expect(400);
+
+    expect(result.body).toEqual(findResponse);
+  });
+
+  it('returns with status 200 when type is hidden', async () => {
+    const findResponse = {
+      total: 0,
+      per_page: 0,
+      page: 0,
+      saved_objects: [],
+    };
+    const result = await supertest(httpSetup.server.listener)
+      .get('/api/saved_objects/_find?type=hidden-type')
+      .expect(200);
+
+    expect(result.body).toEqual(findResponse);
+  });
+
   it('formats successful response and records usage stats', async () => {
     const findResponse = {
       total: 2,
diff --git a/src/core/server/integration_tests/saved_objects/routes/get.test.ts b/src/core/server/integration_tests/saved_objects/routes/get.test.ts
index df0e37979dacb8..efd7f259385927 100644
--- a/src/core/server/integration_tests/saved_objects/routes/get.test.ts
+++ b/src/core/server/integration_tests/saved_objects/routes/get.test.ts
@@ -22,9 +22,16 @@ import {
   registerGetRoute,
   type InternalSavedObjectsRequestHandlerContext,
 } from '@kbn/core-saved-objects-server-internal';
+import { createHiddenTypeVariants } from '@kbn/core-test-helpers-test-utils';
 
 const coreId = Symbol('core');
 
+const testTypes = [
+  { name: 'index-pattern', hide: false },
+  { name: 'hidden-type', hide: true },
+  { name: 'hidden-from-http', hide: false, hideFromHttpApis: true },
+];
+
 describe('GET /api/saved_objects/{type}/{id}', () => {
   let server: HttpService;
   let httpSetup: InternalHttpServiceSetup;
@@ -44,6 +51,12 @@ describe('GET /api/saved_objects/{type}/{id}', () => {
     });
 
     handlerContext = coreMock.createRequestHandlerContext();
+    handlerContext.savedObjects.typeRegistry.getType.mockImplementation((typename: string) => {
+      return testTypes
+        .map((typeDesc) => createHiddenTypeVariants(typeDesc))
+        .find((fullTest) => fullTest.name === typename);
+    });
+
     savedObjectsClient = handlerContext.savedObjects.client;
 
     httpSetup.registerRouteHandlerContext<InternalSavedObjectsRequestHandlerContext, 'core'>(
@@ -101,4 +114,11 @@ describe('GET /api/saved_objects/{type}/{id}', () => {
     const args = savedObjectsClient.get.mock.calls[0];
     expect(args).toEqual(['index-pattern', 'logstash-*']);
   });
+
+  it('returns with status 400 when a type is hidden from the http APIs', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .get('/api/saved_objects/hidden-from-http/hiddenId')
+      .expect(400);
+    expect(result.body.message).toContain("Unsupported saved object type: 'hidden-from-http'");
+  });
 });
diff --git a/src/core/server/integration_tests/saved_objects/routes/resolve.test.ts b/src/core/server/integration_tests/saved_objects/routes/resolve.test.ts
index baf0d1c96f9695..6f58e313347646 100644
--- a/src/core/server/integration_tests/saved_objects/routes/resolve.test.ts
+++ b/src/core/server/integration_tests/saved_objects/routes/resolve.test.ts
@@ -22,9 +22,16 @@ import {
   registerResolveRoute,
   type InternalSavedObjectsRequestHandlerContext,
 } from '@kbn/core-saved-objects-server-internal';
+import { createHiddenTypeVariants } from '@kbn/core-test-helpers-test-utils';
 
 const coreId = Symbol('core');
 
+const testTypes = [
+  { name: 'index-pattern', hide: false },
+  { name: 'hidden-type', hide: true },
+  { name: 'hidden-from-http', hide: false, hideFromHttpApis: true },
+];
+
 describe('GET /api/saved_objects/resolve/{type}/{id}', () => {
   let server: HttpService;
   let httpSetup: InternalHttpServiceSetup;
@@ -44,6 +51,13 @@ describe('GET /api/saved_objects/resolve/{type}/{id}', () => {
     });
 
     handlerContext = coreMock.createRequestHandlerContext();
+
+    handlerContext.savedObjects.typeRegistry.getType.mockImplementation((typename: string) => {
+      return testTypes
+        .map((typeDesc) => createHiddenTypeVariants(typeDesc))
+        .find((fullTest) => fullTest.name === typename);
+    });
+
     savedObjectsClient = handlerContext.savedObjects.client;
 
     httpSetup.registerRouteHandlerContext<InternalSavedObjectsRequestHandlerContext, 'core'>(
@@ -101,4 +115,11 @@ describe('GET /api/saved_objects/resolve/{type}/{id}', () => {
     const args = savedObjectsClient.resolve.mock.calls[0];
     expect(args).toEqual(['index-pattern', 'logstash-*']);
   });
+
+  it('returns with status 400 is a type is hidden from the HTTP APIs', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .get('/api/saved_objects/resolve/hidden-from-http/hiddenId')
+      .expect(400);
+    expect(result.body.message).toContain("Unsupported saved object type: 'hidden-from-http'");
+  });
 });
diff --git a/src/core/server/integration_tests/saved_objects/routes/update.test.ts b/src/core/server/integration_tests/saved_objects/routes/update.test.ts
index 0b03b1ceffdb08..639f503d050d7e 100644
--- a/src/core/server/integration_tests/saved_objects/routes/update.test.ts
+++ b/src/core/server/integration_tests/saved_objects/routes/update.test.ts
@@ -13,7 +13,7 @@ import {
   coreUsageStatsClientMock,
   coreUsageDataServiceMock,
 } from '@kbn/core-usage-data-server-mocks';
-import { setupServer } from '@kbn/core-test-helpers-test-utils';
+import { createHiddenTypeVariants, setupServer } from '@kbn/core-test-helpers-test-utils';
 import {
   registerUpdateRoute,
   type InternalSavedObjectsRequestHandlerContext,
@@ -21,6 +21,12 @@ import {
 
 type SetupServerReturn = Awaited<ReturnType<typeof setupServer>>;
 
+const testTypes = [
+  { name: 'index-pattern', hide: false },
+  { name: 'hidden-type', hide: true },
+  { name: 'hidden-from-http', hide: false, hideFromHttpApis: true },
+];
+
 describe('PUT /api/saved_objects/{type}/{id?}', () => {
   let server: SetupServerReturn['server'];
   let httpSetup: SetupServerReturn['httpSetup'];
@@ -43,6 +49,12 @@ describe('PUT /api/saved_objects/{type}/{id?}', () => {
     savedObjectsClient = handlerContext.savedObjects.client;
     savedObjectsClient.update.mockResolvedValue(clientResponse);
 
+    handlerContext.savedObjects.typeRegistry.getType.mockImplementation((typename: string) => {
+      return testTypes
+        .map((typeDesc) => createHiddenTypeVariants(typeDesc))
+        .find((fullTest) => fullTest.name === typename);
+    });
+
     const router =
       httpSetup.createRouter<InternalSavedObjectsRequestHandlerContext>('/api/saved_objects/');
     coreUsageStatsClient = coreUsageStatsClientMock.create();
@@ -101,4 +113,14 @@ describe('PUT /api/saved_objects/{type}/{id?}', () => {
       { version: 'foo' }
     );
   });
+
+  it('returns with status 400 for types hidden from the HTTP APIs', async () => {
+    const result = await supertest(httpSetup.server.listener)
+      .put('/api/saved_objects/hidden-from-http/hiddenId')
+      .send({
+        attributes: { title: 'does not matter' },
+      })
+      .expect(400);
+    expect(result.body.message).toContain("Unsupported saved object type: 'hidden-from-http'");
+  });
 });
diff --git a/test/functional/fixtures/es_archiver/saved_objects_management/hidden_from_http_apis/data.json b/test/functional/fixtures/es_archiver/saved_objects_management/hidden_from_http_apis/data.json
new file mode 100644
index 00000000000000..8a6367d8f7659f
--- /dev/null
+++ b/test/functional/fixtures/es_archiver/saved_objects_management/hidden_from_http_apis/data.json
@@ -0,0 +1,27 @@
+{
+  "type": "doc",
+  "value": {
+    "id": "test-hidden-from-http-apis-importable-exportable:hidden-from-http-apis-1",
+    "index": ".kibana_1",
+    "source": {
+      "test-hidden-from-http-apis-importable-exportable": {
+        "title": "I am hidden from http apis but the client can still see me"
+      },
+      "type": "test-hidden-from-http-apis-importable-exportable"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "test-not-hidden-from-http-apis-importable-exportable:not-hidden-from-http-apis-1",
+    "index": ".kibana_1",
+    "source": {
+      "test-not-hidden-from-http-apis-importable-exportable": {
+        "title": "I am not hidden from http apis"
+      },
+      "type": "test-not-hidden-from-http-apis-importable-exportable"
+    }
+  }
+}
diff --git a/test/functional/fixtures/es_archiver/saved_objects_management/hidden_from_http_apis/mappings.json b/test/functional/fixtures/es_archiver/saved_objects_management/hidden_from_http_apis/mappings.json
new file mode 100644
index 00000000000000..3614080e5f5842
--- /dev/null
+++ b/test/functional/fixtures/es_archiver/saved_objects_management/hidden_from_http_apis/mappings.json
@@ -0,0 +1,3886 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".kibana": {
+        "is_hidden": true
+      },
+      ".kibana_8.7.0": {
+        "is_hidden": true
+      }
+    },
+    "index": ".kibana_1",
+    "mappings": {
+      "_meta": {
+        "migrationMappingPropertyHashes": {
+          "action": "38c91d092e0790ecd9ebe58e82145280",
+          "action_task_params": "d43ed71d8608a6406977fe093a9fbe74",
+          "alert": "bc1c55763564c3ebb167da6d324a0a05",
+          "api_key_pending_invalidation": "16f515278a295f6245149ad7c5ddedb7",
+          "apm-indices": "3d1b76c39bfb2cc8296b024d73854724",
+          "apm-server-schema": "b1d71908f324c17bf744ac72af5038fb",
+          "apm-service-group": "2af509c6506f29a858e5a0950577d9fa",
+          "apm-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "app_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_daily": "43b8830d5d0df85a6823d290885fc9fd",
+          "application_usage_totals": "3d1b76c39bfb2cc8296b024d73854724",
+          "canvas-element": "7390014e1091044523666d97247392fc",
+          "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "canvas-workpad-template": "ae2673f678281e2c055d764b153e9715",
+          "cases": "fa60347cb6869de399b5b0e6ef49538f",
+          "cases-comments": "2ef945f765cefb6421548c1dc227ab49",
+          "cases-configure": "f32095d284444601d7b39a314751832c",
+          "cases-connector-mappings": "17d2e9e0e170a21a471285a5d845353c",
+          "cases-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "cases-user-actions": "4d3f0799ea1a3c48e0015da327e46848",
+          "config": "c63748b75f39d0c54de12d12c1ccbc20",
+          "config-global": "c63748b75f39d0c54de12d12c1ccbc20",
+          "connector_token": "53e34e65945ca21461be85f868495da5",
+          "core-usage-stats": "3d1b76c39bfb2cc8296b024d73854724",
+          "coreMigrationVersion": "2f4316de49999235636386fe51dc06c1",
+          "created_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "csp-rule-template": "8b03466c92eddc1458758ca6827eb540",
+          "csp_rule": "e962ddf765c0380b0fd57711e4684d4e",
+          "dashboard": "bc881edf161013a17165a244e0812e9f",
+          "endpoint:user-artifact": "4a11183eee21e6fbad864f7a30b39ad0",
+          "endpoint:user-artifact-manifest": "a0d7b04ad405eed54d76e279c3727862",
+          "enterprise_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "epm-packages": "77c148aa49f233d2a6554f513862bd38",
+          "epm-packages-assets": "44621b2f6052ef966da47b7c3a00f33b",
+          "event_loop_delays_daily": "5df7e292ddd5028e07c1482e130e6654",
+          "exception-list": "baf108c9934dda844921f692a513adae",
+          "exception-list-agnostic": "baf108c9934dda844921f692a513adae",
+          "file": "c38faa34f21af9cef4301a687de5dce0",
+          "file-upload-usage-collection-telemetry": "a34fbb8e3263d105044869264860c697",
+          "fileShare": "aa8f7ac2ddf8ab1a91bd34e347046caa",
+          "fleet-fleet-server-host": "434168167d1a1fd82fe92584ab9845c2",
+          "fleet-preconfiguration-deletion-record": "4c36f199189a367e43541f236141204c",
+          "fleet-proxy": "05b7a22977de25ce67a77e44dd8e6c33",
+          "graph-workspace": "27a94b2edcb0610c6aea54a7c56d7752",
+          "guided-onboarding-guide-state": "a3db59c45a3fd2730816d4f53c35c7d9",
+          "guided-onboarding-plugin-state": "3d1b76c39bfb2cc8296b024d73854724",
+          "index-pattern": "83c02d842fe2a94d14dfa13f7dcd6e87",
+          "infrastructure-monitoring-log-view": "c50526fc6040c5355ed027d34d05b35c",
+          "infrastructure-ui-source": "3d1b76c39bfb2cc8296b024d73854724",
+          "ingest-agent-policies": "6892b04ed54b03bceb7b99d204e9f719",
+          "ingest-download-sources": "5d602f6594f3b589dc9a8e3a44031522",
+          "ingest-outputs": "e2347e19e5c2a7448529d77abbf27f30",
+          "ingest-package-policies": "c9f0cc1a2ed81041e29b69f1f1f79b68",
+          "ingest_manager_settings": "a9f356eec1c40d030f433bbf47c2b479",
+          "inventory-view": "3d1b76c39bfb2cc8296b024d73854724",
+          "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
+          "legacy-url-alias": "0750774cf16475f88f2361e99cc5c8f0",
+          "lens": "52346cfec69ff7b47d5f0c12361a2797",
+          "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
+          "map": "9134b47593116d7953f6adba096fc463",
+          "maps-telemetry": "5ef305b18111b77789afefbd36b66171",
+          "metrics-explorer-view": "3d1b76c39bfb2cc8296b024d73854724",
+          "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
+          "ml-job": "3bb64c31915acf93fc724af137a0891b",
+          "ml-module": "46ef4f0d6682636f0fff9799d6a2d7ac",
+          "ml-trained-model": "d2f03c1a5dd038fa58af14a56944312b",
+          "monitoring-telemetry": "2669d5ec15e82391cf58df4294ee9c68",
+          "namespace": "2f4316de49999235636386fe51dc06c1",
+          "namespaces": "2f4316de49999235636386fe51dc06c1",
+          "originId": "2f4316de49999235636386fe51dc06c1",
+          "osquery-manager-usage-metric": "4dc4f647d27247c002f56f22742175fe",
+          "osquery-pack": "37af487fae033ccd92295fd20d1952f0",
+          "osquery-pack-asset": "989d30eeccb25d62980739dc7790a875",
+          "osquery-saved-query": "6bf77cfe41a55adb3a00d58e96d72ce9",
+          "query": "11aaeb7f5f7fa5bb43f25e18ce26e7d9",
+          "references": "7997cf5a56cc02bdc9c93361bde732b0",
+          "sample-data-telemetry": "7d3cfeb915303c9641c59681967ffeb4",
+          "search": "f8d7012ea128c1f7eee2524e4ea346a6",
+          "search-session": "daa126fce3214044789ffe971a365145",
+          "search-telemetry": "3d1b76c39bfb2cc8296b024d73854724",
+          "security-rule": "8ae39a88fc70af3375b7050e8d8d5cc7",
+          "security-solution-signals-migration": "72761fd374ca11122ac8025a92b84fca",
+          "siem-detection-engine-rule-actions": "ec8a5cc503fc8cd151a2463190e4e425",
+          "siem-detection-engine-rule-execution-info": "f28f675a06fe27d22dc3be04005ac987",
+          "siem-ui-timeline": "0f4cc81427182c41cebd7d9c640ec253",
+          "siem-ui-timeline-note": "28393dfdeb4e4413393eb5f7ec8c5436",
+          "siem-ui-timeline-pinned-event": "293fce142548281599060e07ad2c9ddb",
+          "space": "c5ca8acafa0beaa4d08d014a97b6bc6b",
+          "spaces-usage-stats": "3d1b76c39bfb2cc8296b024d73854724",
+          "synthetics-monitor": "b7d62441939ad093caa011c7082a2af4",
+          "synthetics-param": "3d1b76c39bfb2cc8296b024d73854724",
+          "synthetics-privates-locations": "3d1b76c39bfb2cc8296b024d73854724",
+          "tag": "83d55da58f6530f7055415717ec06474",
+          "telemetry": "36a616f7026dfa617d6655df850fe16d",
+          "test-actions-export-hidden": "8b555f1f2684de2490682d4ac5dfbd2e",
+          "test-deprecations-plugin": "8e3906e5ac842a30d0de07848b59f6cb",
+          "test-export-add": "8e3906e5ac842a30d0de07848b59f6cb",
+          "test-export-add-dep": "8e3906e5ac842a30d0de07848b59f6cb",
+          "test-export-invalid-transform": "8e3906e5ac842a30d0de07848b59f6cb",
+          "test-export-transform": "8b555f1f2684de2490682d4ac5dfbd2e",
+          "test-export-transform-error": "8e3906e5ac842a30d0de07848b59f6cb",
+          "test-hidden-from-http-apis-importable-exportable": "8e3906e5ac842a30d0de07848b59f6cb",
+          "test-hidden-importable-exportable": "8e3906e5ac842a30d0de07848b59f6cb",
+          "test-hidden-non-importable-exportable": "8e3906e5ac842a30d0de07848b59f6cb",
+          "test-is-exportable": "8b555f1f2684de2490682d4ac5dfbd2e",
+          "test-not-hidden-from-http-apis-importable-exportable": "8e3906e5ac842a30d0de07848b59f6cb",
+          "test-not-visible-in-management": "8b555f1f2684de2490682d4ac5dfbd2e",
+          "test-visible-in-management": "8b555f1f2684de2490682d4ac5dfbd2e",
+          "test-with-display-name": "8b555f1f2684de2490682d4ac5dfbd2e",
+          "test_import_warning_1": "8e3906e5ac842a30d0de07848b59f6cb",
+          "test_import_warning_2": "8e3906e5ac842a30d0de07848b59f6cb",
+          "type": "2f4316de49999235636386fe51dc06c1",
+          "ui-metric": "0d409297dc5ebe1e3a1da691c6ee32e3",
+          "updated_at": "00da57df13e94e9d98437d13ace4bfe0",
+          "upgrade-assistant-ml-upgrade-operation": "ece1011519ca8fd057364605744d75ac",
+          "upgrade-assistant-reindex-operation": "215107c281839ea9b3ad5f6419819763",
+          "upgrade-assistant-telemetry": "7443e25d76c53f49aaf2daac37d4d1f8",
+          "uptime-dynamic-settings": "3d1b76c39bfb2cc8296b024d73854724",
+          "uptime-synthetics-api-key": "c3178f0fde61e18d3530ba9a70bc278a",
+          "url": "dde920c35ebae1bf43731d19f7b2194d",
+          "usage-counters": "8cc260bdceffec4ffc3ad165c97dc1b4",
+          "visualization": "f819cf6636b75c9e76ba733a0c6ef355",
+          "workplace_search_telemetry": "3d1b76c39bfb2cc8296b024d73854724"
+        }
+      },
+      "dynamic": "strict",
+      "properties": {
+        "action": {
+          "properties": {
+            "actionTypeId": {
+              "type": "keyword"
+            },
+            "config": {
+              "enabled": false,
+              "type": "object"
+            },
+            "isMissingSecrets": {
+              "type": "boolean"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "secrets": {
+              "type": "binary"
+            }
+          }
+        },
+        "action_task_params": {
+          "properties": {
+            "actionId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "consumer": {
+              "type": "keyword"
+            },
+            "executionId": {
+              "type": "keyword"
+            },
+            "params": {
+              "enabled": false,
+              "type": "object"
+            },
+            "relatedSavedObjects": {
+              "enabled": false,
+              "type": "object"
+            }
+          }
+        },
+        "alert": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "actionRef": {
+                  "type": "keyword"
+                },
+                "actionTypeId": {
+                  "type": "keyword"
+                },
+                "frequency": {
+                  "properties": {
+                    "notifyWhen": {
+                      "index": false,
+                      "type": "keyword"
+                    },
+                    "summary": {
+                      "index": false,
+                      "type": "boolean"
+                    },
+                    "throttle": {
+                      "index": false,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              },
+              "type": "nested"
+            },
+            "alertTypeId": {
+              "type": "keyword"
+            },
+            "apiKey": {
+              "type": "binary"
+            },
+            "apiKeyOwner": {
+              "type": "keyword"
+            },
+            "consumer": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "executionStatus": {
+              "properties": {
+                "error": {
+                  "properties": {
+                    "message": {
+                      "type": "keyword"
+                    },
+                    "reason": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "lastDuration": {
+                  "type": "long"
+                },
+                "lastExecutionDate": {
+                  "type": "date"
+                },
+                "numberOfTriggeredActions": {
+                  "type": "long"
+                },
+                "status": {
+                  "type": "keyword"
+                },
+                "warning": {
+                  "properties": {
+                    "message": {
+                      "type": "keyword"
+                    },
+                    "reason": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "lastRun": {
+              "properties": {
+                "alertsCount": {
+                  "properties": {
+                    "active": {
+                      "type": "float"
+                    },
+                    "ignored": {
+                      "type": "float"
+                    },
+                    "new": {
+                      "type": "float"
+                    },
+                    "recovered": {
+                      "type": "float"
+                    }
+                  }
+                },
+                "outcome": {
+                  "type": "keyword"
+                },
+                "outcomeMsg": {
+                  "type": "text"
+                },
+                "outcomeOrder": {
+                  "type": "float"
+                },
+                "warning": {
+                  "type": "text"
+                }
+              }
+            },
+            "legacyId": {
+              "type": "keyword"
+            },
+            "mapped_params": {
+              "properties": {
+                "risk_score": {
+                  "type": "float"
+                },
+                "severity": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "meta": {
+              "properties": {
+                "versionApiKeyLastmodified": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "monitoring": {
+              "properties": {
+                "run": {
+                  "properties": {
+                    "calculated_metrics": {
+                      "properties": {
+                        "p50": {
+                          "type": "long"
+                        },
+                        "p95": {
+                          "type": "long"
+                        },
+                        "p99": {
+                          "type": "long"
+                        },
+                        "success_ratio": {
+                          "type": "float"
+                        }
+                      }
+                    },
+                    "history": {
+                      "properties": {
+                        "duration": {
+                          "type": "long"
+                        },
+                        "outcome": {
+                          "type": "keyword"
+                        },
+                        "success": {
+                          "type": "boolean"
+                        },
+                        "timestamp": {
+                          "type": "date"
+                        }
+                      }
+                    },
+                    "last_run": {
+                      "properties": {
+                        "metrics": {
+                          "properties": {
+                            "duration": {
+                              "type": "long"
+                            },
+                            "gap_duration_s": {
+                              "type": "float"
+                            },
+                            "total_alerts_created": {
+                              "type": "float"
+                            },
+                            "total_alerts_detected": {
+                              "type": "float"
+                            },
+                            "total_indexing_duration_ms": {
+                              "type": "long"
+                            },
+                            "total_search_duration_ms": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "timestamp": {
+                          "type": "date"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            },
+            "muteAll": {
+              "type": "boolean"
+            },
+            "mutedInstanceIds": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "normalizer": "lowercase",
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "nextRun": {
+              "type": "date"
+            },
+            "notifyWhen": {
+              "type": "keyword"
+            },
+            "params": {
+              "ignore_above": 4096,
+              "type": "flattened"
+            },
+            "running": {
+              "type": "boolean"
+            },
+            "schedule": {
+              "properties": {
+                "interval": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "scheduledTaskId": {
+              "type": "keyword"
+            },
+            "snoozeSchedule": {
+              "properties": {
+                "duration": {
+                  "type": "long"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "rRule": {
+                  "properties": {
+                    "byhour": {
+                      "type": "long"
+                    },
+                    "byminute": {
+                      "type": "long"
+                    },
+                    "bymonth": {
+                      "type": "short"
+                    },
+                    "bymonthday": {
+                      "type": "short"
+                    },
+                    "bysecond": {
+                      "type": "long"
+                    },
+                    "bysetpos": {
+                      "type": "long"
+                    },
+                    "byweekday": {
+                      "type": "keyword"
+                    },
+                    "byweekno": {
+                      "type": "short"
+                    },
+                    "byyearday": {
+                      "type": "short"
+                    },
+                    "count": {
+                      "type": "long"
+                    },
+                    "dtstart": {
+                      "format": "strict_date_time",
+                      "type": "date"
+                    },
+                    "freq": {
+                      "type": "keyword"
+                    },
+                    "interval": {
+                      "type": "long"
+                    },
+                    "tzid": {
+                      "type": "keyword"
+                    },
+                    "until": {
+                      "format": "strict_date_time",
+                      "type": "date"
+                    },
+                    "wkst": {
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "skipRecurrences": {
+                  "format": "strict_date_time",
+                  "type": "date"
+                }
+              },
+              "type": "nested"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "throttle": {
+              "type": "keyword"
+            },
+            "updatedAt": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "keyword"
+            }
+          }
+        },
+        "api_key_pending_invalidation": {
+          "properties": {
+            "apiKeyId": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            }
+          }
+        },
+        "apm-indices": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "apm-server-schema": {
+          "properties": {
+            "schemaJson": {
+              "index": false,
+              "type": "text"
+            }
+          }
+        },
+        "apm-service-group": {
+          "properties": {
+            "color": {
+              "type": "text"
+            },
+            "description": {
+              "type": "text"
+            },
+            "groupName": {
+              "type": "keyword"
+            },
+            "kuery": {
+              "type": "text"
+            }
+          }
+        },
+        "apm-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "app_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "application_usage_daily": {
+          "dynamic": "false",
+          "properties": {
+            "timestamp": {
+              "type": "date"
+            }
+          }
+        },
+        "application_usage_totals": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "canvas-element": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "content": {
+              "type": "text"
+            },
+            "help": {
+              "type": "text"
+            },
+            "image": {
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad": {
+          "dynamic": "false",
+          "properties": {
+            "@created": {
+              "type": "date"
+            },
+            "@timestamp": {
+              "type": "date"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "canvas-workpad-template": {
+          "dynamic": "false",
+          "properties": {
+            "help": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "tags": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "template_key": {
+              "type": "keyword"
+            }
+          }
+        },
+        "cases": {
+          "properties": {
+            "assignees": {
+              "properties": {
+                "uid": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "closed_at": {
+              "type": "date"
+            },
+            "closed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "profile_uid": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "connector": {
+              "properties": {
+                "fields": {
+                  "properties": {
+                    "key": {
+                      "type": "text"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "name": {
+                  "type": "text"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "profile_uid": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "duration": {
+              "type": "unsigned_long"
+            },
+            "external_service": {
+              "properties": {
+                "connector_name": {
+                  "type": "keyword"
+                },
+                "external_id": {
+                  "type": "keyword"
+                },
+                "external_title": {
+                  "type": "text"
+                },
+                "external_url": {
+                  "type": "text"
+                },
+                "pushed_at": {
+                  "type": "date"
+                },
+                "pushed_by": {
+                  "properties": {
+                    "email": {
+                      "type": "keyword"
+                    },
+                    "full_name": {
+                      "type": "keyword"
+                    },
+                    "profile_uid": {
+                      "type": "keyword"
+                    },
+                    "username": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "owner": {
+              "type": "keyword"
+            },
+            "settings": {
+              "properties": {
+                "syncAlerts": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "severity": {
+              "type": "short"
+            },
+            "status": {
+              "type": "short"
+            },
+            "tags": {
+              "type": "keyword"
+            },
+            "title": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "total_alerts": {
+              "type": "integer"
+            },
+            "total_comments": {
+              "type": "integer"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "profile_uid": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-comments": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "targets": {
+                  "properties": {
+                    "endpointId": {
+                      "type": "keyword"
+                    },
+                    "hostname": {
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "alertId": {
+              "type": "keyword"
+            },
+            "comment": {
+              "type": "text"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "profile_uid": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "externalReferenceAttachmentTypeId": {
+              "type": "keyword"
+            },
+            "externalReferenceId": {
+              "type": "keyword"
+            },
+            "externalReferenceMetadata": {
+              "dynamic": "false",
+              "enabled": false,
+              "type": "object"
+            },
+            "externalReferenceStorage": {
+              "dynamic": "false",
+              "properties": {
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "index": {
+              "type": "keyword"
+            },
+            "owner": {
+              "type": "keyword"
+            },
+            "persistableStateAttachmentState": {
+              "dynamic": "false",
+              "enabled": false,
+              "type": "object"
+            },
+            "persistableStateAttachmentTypeId": {
+              "type": "keyword"
+            },
+            "pushed_at": {
+              "type": "date"
+            },
+            "pushed_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "profile_uid": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "rule": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "name": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "profile_uid": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-configure": {
+          "properties": {
+            "closure_type": {
+              "type": "keyword"
+            },
+            "connector": {
+              "properties": {
+                "fields": {
+                  "properties": {
+                    "key": {
+                      "type": "text"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "name": {
+                  "type": "text"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "profile_uid": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "owner": {
+              "type": "keyword"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "profile_uid": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cases-connector-mappings": {
+          "properties": {
+            "mappings": {
+              "properties": {
+                "action_type": {
+                  "type": "keyword"
+                },
+                "source": {
+                  "type": "keyword"
+                },
+                "target": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "owner": {
+              "type": "keyword"
+            }
+          }
+        },
+        "cases-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "cases-user-actions": {
+          "properties": {
+            "action": {
+              "type": "keyword"
+            },
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "properties": {
+                "email": {
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "type": "keyword"
+                },
+                "profile_uid": {
+                  "type": "keyword"
+                },
+                "username": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "owner": {
+              "type": "keyword"
+            },
+            "payload": {
+              "dynamic": "false",
+              "properties": {
+                "connector": {
+                  "properties": {
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "config": {
+          "dynamic": "false",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "config-global": {
+          "dynamic": "false",
+          "properties": {
+            "buildNum": {
+              "type": "keyword"
+            }
+          }
+        },
+        "connector_token": {
+          "properties": {
+            "connectorId": {
+              "type": "keyword"
+            },
+            "createdAt": {
+              "type": "date"
+            },
+            "expiresAt": {
+              "type": "date"
+            },
+            "token": {
+              "type": "binary"
+            },
+            "tokenType": {
+              "type": "keyword"
+            },
+            "updatedAt": {
+              "type": "date"
+            }
+          }
+        },
+        "core-usage-stats": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "coreMigrationVersion": {
+          "type": "keyword"
+        },
+        "created_at": {
+          "type": "date"
+        },
+        "csp-rule-template": {
+          "dynamic": "false",
+          "properties": {
+            "metadata": {
+              "properties": {
+                "benchmark": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "csp_rule": {
+          "dynamic": "false",
+          "properties": {
+            "enabled": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "boolean"
+            },
+            "metadata": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "package_policy_id": {
+              "type": "keyword"
+            },
+            "policy_id": {
+              "type": "keyword"
+            }
+          }
+        },
+        "dashboard": {
+          "properties": {
+            "controlGroupInput": {
+              "properties": {
+                "chainingSystem": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "keyword"
+                },
+                "controlStyle": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "keyword"
+                },
+                "ignoreParentSettingsJSON": {
+                  "index": false,
+                  "type": "text"
+                },
+                "panelsJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "hits": {
+              "doc_values": false,
+              "index": false,
+              "type": "integer"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "optionsJSON": {
+              "index": false,
+              "type": "text"
+            },
+            "panelsJSON": {
+              "index": false,
+              "type": "text"
+            },
+            "refreshInterval": {
+              "properties": {
+                "display": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "keyword"
+                },
+                "pause": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "boolean"
+                },
+                "section": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "integer"
+                },
+                "value": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "integer"
+                }
+              }
+            },
+            "timeFrom": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "timeRestore": {
+              "doc_values": false,
+              "index": false,
+              "type": "boolean"
+            },
+            "timeTo": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "endpoint:user-artifact": {
+          "properties": {
+            "body": {
+              "type": "binary"
+            },
+            "compressionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "decodedSha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "decodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encodedSha256": {
+              "type": "keyword"
+            },
+            "encodedSize": {
+              "index": false,
+              "type": "long"
+            },
+            "encryptionAlgorithm": {
+              "index": false,
+              "type": "keyword"
+            },
+            "identifier": {
+              "type": "keyword"
+            }
+          }
+        },
+        "endpoint:user-artifact-manifest": {
+          "properties": {
+            "artifacts": {
+              "properties": {
+                "artifactId": {
+                  "index": false,
+                  "type": "keyword"
+                },
+                "policyId": {
+                  "index": false,
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "schemaVersion": {
+              "type": "keyword"
+            },
+            "semanticVersion": {
+              "index": false,
+              "type": "keyword"
+            }
+          }
+        },
+        "enterprise_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "epm-packages": {
+          "properties": {
+            "es_index_patterns": {
+              "enabled": false,
+              "type": "object"
+            },
+            "experimental_data_stream_features": {
+              "properties": {
+                "data_stream": {
+                  "type": "keyword"
+                },
+                "features": {
+                  "properties": {
+                    "synthetic_source": {
+                      "type": "boolean"
+                    },
+                    "tsdb": {
+                      "type": "boolean"
+                    }
+                  },
+                  "type": "nested"
+                }
+              },
+              "type": "nested"
+            },
+            "install_format_schema_version": {
+              "type": "version"
+            },
+            "install_source": {
+              "type": "keyword"
+            },
+            "install_started_at": {
+              "type": "date"
+            },
+            "install_status": {
+              "type": "keyword"
+            },
+            "install_version": {
+              "type": "keyword"
+            },
+            "installed_es": {
+              "properties": {
+                "id": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              },
+              "type": "nested"
+            },
+            "installed_kibana": {
+              "enabled": false,
+              "type": "object"
+            },
+            "installed_kibana_space_id": {
+              "type": "keyword"
+            },
+            "internal": {
+              "type": "boolean"
+            },
+            "keep_policies_up_to_date": {
+              "index": false,
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "package_assets": {
+              "enabled": false,
+              "type": "object"
+            },
+            "verification_key_id": {
+              "type": "keyword"
+            },
+            "verification_status": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "epm-packages-assets": {
+          "properties": {
+            "asset_path": {
+              "type": "keyword"
+            },
+            "data_base64": {
+              "type": "binary"
+            },
+            "data_utf8": {
+              "index": false,
+              "type": "text"
+            },
+            "install_source": {
+              "type": "keyword"
+            },
+            "media_type": {
+              "type": "keyword"
+            },
+            "package_name": {
+              "type": "keyword"
+            },
+            "package_version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "event_loop_delays_daily": {
+          "dynamic": "false",
+          "properties": {
+            "lastUpdatedAt": {
+              "type": "date"
+            }
+          }
+        },
+        "exception-list": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "type": "text"
+                }
+              },
+              "type": "keyword"
+            },
+            "os_types": {
+              "type": "keyword"
+            },
+            "tags": {
+              "fields": {
+                "text": {
+                  "type": "text"
+                }
+              },
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "exception-list-agnostic": {
+          "properties": {
+            "_tags": {
+              "type": "keyword"
+            },
+            "comments": {
+              "properties": {
+                "comment": {
+                  "type": "keyword"
+                },
+                "created_at": {
+                  "type": "keyword"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "keyword"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created_at": {
+              "type": "keyword"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "keyword"
+            },
+            "entries": {
+              "properties": {
+                "entries": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "fields": {
+                        "text": {
+                          "type": "text"
+                        }
+                      },
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "field": {
+                  "type": "keyword"
+                },
+                "list": {
+                  "properties": {
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "operator": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "value": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "type": "keyword"
+                }
+              }
+            },
+            "immutable": {
+              "type": "boolean"
+            },
+            "item_id": {
+              "type": "keyword"
+            },
+            "list_id": {
+              "type": "keyword"
+            },
+            "list_type": {
+              "type": "keyword"
+            },
+            "meta": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "type": "text"
+                }
+              },
+              "type": "keyword"
+            },
+            "os_types": {
+              "type": "keyword"
+            },
+            "tags": {
+              "fields": {
+                "text": {
+                  "type": "text"
+                }
+              },
+              "type": "keyword"
+            },
+            "tie_breaker_id": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "file": {
+          "dynamic": "false",
+          "properties": {
+            "FileKind": {
+              "type": "keyword"
+            },
+            "Meta": {
+              "type": "flattened"
+            },
+            "Status": {
+              "type": "keyword"
+            },
+            "Updated": {
+              "type": "date"
+            },
+            "created": {
+              "type": "date"
+            },
+            "extension": {
+              "type": "keyword"
+            },
+            "mime_type": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "text"
+            },
+            "size": {
+              "type": "long"
+            },
+            "user": {
+              "type": "flattened"
+            }
+          }
+        },
+        "file-upload-usage-collection-telemetry": {
+          "properties": {
+            "file_upload": {
+              "properties": {
+                "index_creation_count": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "fileShare": {
+          "dynamic": "false",
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "token": {
+              "type": "keyword"
+            },
+            "valid_until": {
+              "type": "long"
+            }
+          }
+        },
+        "fleet-fleet-server-host": {
+          "properties": {
+            "host_urls": {
+              "index": false,
+              "type": "keyword"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "is_preconfigured": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "proxy_id": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-preconfiguration-deletion-record": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            }
+          }
+        },
+        "fleet-proxy": {
+          "properties": {
+            "certificate": {
+              "index": false,
+              "type": "keyword"
+            },
+            "certificate_authorities": {
+              "index": false,
+              "type": "keyword"
+            },
+            "certificate_key": {
+              "index": false,
+              "type": "keyword"
+            },
+            "is_preconfigured": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "proxy_headers": {
+              "index": false,
+              "type": "text"
+            },
+            "url": {
+              "index": false,
+              "type": "keyword"
+            }
+          }
+        },
+        "graph-workspace": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "type": "text"
+                }
+              }
+            },
+            "legacyIndexPatternRef": {
+              "index": false,
+              "type": "text"
+            },
+            "numLinks": {
+              "type": "integer"
+            },
+            "numVertices": {
+              "type": "integer"
+            },
+            "title": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "wsState": {
+              "type": "text"
+            }
+          }
+        },
+        "guided-onboarding-guide-state": {
+          "dynamic": "false",
+          "properties": {
+            "guideId": {
+              "type": "keyword"
+            },
+            "isActive": {
+              "type": "boolean"
+            }
+          }
+        },
+        "guided-onboarding-plugin-state": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "index-pattern": {
+          "dynamic": "false",
+          "properties": {
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "infrastructure-monitoring-log-view": {
+          "dynamic": "false",
+          "properties": {
+            "name": {
+              "type": "text"
+            }
+          }
+        },
+        "infrastructure-ui-source": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "ingest-agent-policies": {
+          "properties": {
+            "data_output_id": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "download_source_id": {
+              "type": "keyword"
+            },
+            "fleet_server_host_id": {
+              "type": "keyword"
+            },
+            "inactivity_timeout": {
+              "type": "integer"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "is_default_fleet_server": {
+              "type": "boolean"
+            },
+            "is_managed": {
+              "type": "boolean"
+            },
+            "is_preconfigured": {
+              "type": "keyword"
+            },
+            "monitoring_enabled": {
+              "index": false,
+              "type": "keyword"
+            },
+            "monitoring_output_id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "schema_version": {
+              "type": "version"
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "unenroll_timeout": {
+              "type": "integer"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-download-sources": {
+          "properties": {
+            "host": {
+              "type": "keyword"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "source_id": {
+              "index": false,
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-outputs": {
+          "properties": {
+            "ca_sha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "ca_trusted_fingerprint": {
+              "index": false,
+              "type": "keyword"
+            },
+            "config": {
+              "type": "flattened"
+            },
+            "config_yaml": {
+              "type": "text"
+            },
+            "hosts": {
+              "type": "keyword"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "is_default_monitoring": {
+              "type": "boolean"
+            },
+            "is_preconfigured": {
+              "index": false,
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "output_id": {
+              "index": false,
+              "type": "keyword"
+            },
+            "proxy_id": {
+              "type": "keyword"
+            },
+            "shipper": {
+              "dynamic": "false",
+              "type": "object"
+            },
+            "ssl": {
+              "type": "binary"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ingest-package-policies": {
+          "properties": {
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "elasticsearch": {
+              "enabled": false,
+              "properties": {
+                "privileges": {
+                  "properties": {
+                    "cluster": {
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "inputs": {
+              "enabled": false,
+              "properties": {
+                "compiled_input": {
+                  "type": "flattened"
+                },
+                "config": {
+                  "type": "flattened"
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "policy_template": {
+                  "type": "keyword"
+                },
+                "streams": {
+                  "properties": {
+                    "compiled_stream": {
+                      "type": "flattened"
+                    },
+                    "config": {
+                      "type": "flattened"
+                    },
+                    "data_stream": {
+                      "properties": {
+                        "dataset": {
+                          "type": "keyword"
+                        },
+                        "elasticsearch": {
+                          "properties": {
+                            "privileges": {
+                              "type": "flattened"
+                            }
+                          }
+                        },
+                        "type": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "vars": {
+                      "type": "flattened"
+                    }
+                  },
+                  "type": "nested"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "vars": {
+                  "type": "flattened"
+                }
+              },
+              "type": "nested"
+            },
+            "is_managed": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "namespace": {
+              "type": "keyword"
+            },
+            "package": {
+              "properties": {
+                "name": {
+                  "type": "keyword"
+                },
+                "title": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "policy_id": {
+              "type": "keyword"
+            },
+            "revision": {
+              "type": "integer"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "vars": {
+              "type": "flattened"
+            }
+          }
+        },
+        "ingest_manager_settings": {
+          "properties": {
+            "fleet_server_hosts": {
+              "type": "keyword"
+            },
+            "has_seen_add_data_notice": {
+              "index": false,
+              "type": "boolean"
+            },
+            "prerelease_integrations_enabled": {
+              "type": "boolean"
+            }
+          }
+        },
+        "inventory-view": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "kql-telemetry": {
+          "properties": {
+            "optInCount": {
+              "type": "long"
+            },
+            "optOutCount": {
+              "type": "long"
+            }
+          }
+        },
+        "legacy-url-alias": {
+          "dynamic": "false",
+          "properties": {
+            "disabled": {
+              "type": "boolean"
+            },
+            "resolveCounter": {
+              "type": "long"
+            },
+            "sourceId": {
+              "type": "keyword"
+            },
+            "targetId": {
+              "type": "keyword"
+            },
+            "targetNamespace": {
+              "type": "keyword"
+            },
+            "targetType": {
+              "type": "keyword"
+            }
+          }
+        },
+        "lens": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "expression": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "state": {
+              "type": "flattened"
+            },
+            "title": {
+              "type": "text"
+            },
+            "visualizationType": {
+              "type": "keyword"
+            }
+          }
+        },
+        "lens-ui-telemetry": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            },
+            "date": {
+              "type": "date"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "map": {
+          "properties": {
+            "bounds": {
+              "dynamic": "false",
+              "type": "object"
+            },
+            "description": {
+              "type": "text"
+            },
+            "layerListJSON": {
+              "type": "text"
+            },
+            "mapStateJSON": {
+              "type": "text"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            }
+          }
+        },
+        "maps-telemetry": {
+          "enabled": false,
+          "type": "object"
+        },
+        "metrics-explorer-view": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "migrationVersion": {
+          "dynamic": "true",
+          "properties": {
+            "canvas-workpad-template": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "config": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "space": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "ml-job": {
+          "properties": {
+            "datafeed_id": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "job_id": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
+        "ml-module": {
+          "dynamic": "false",
+          "properties": {
+            "datafeeds": {
+              "type": "object"
+            },
+            "defaultIndexPattern": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "description": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "id": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "jobs": {
+              "type": "object"
+            },
+            "logo": {
+              "type": "object"
+            },
+            "query": {
+              "type": "object"
+            },
+            "title": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "type": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "ml-trained-model": {
+          "properties": {
+            "job": {
+              "properties": {
+                "create_time": {
+                  "type": "date"
+                },
+                "job_id": {
+                  "fields": {
+                    "keyword": {
+                      "type": "keyword"
+                    }
+                  },
+                  "type": "text"
+                }
+              }
+            },
+            "model_id": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "monitoring-telemetry": {
+          "properties": {
+            "reportedClusterUuids": {
+              "type": "keyword"
+            }
+          }
+        },
+        "namespace": {
+          "type": "keyword"
+        },
+        "namespaces": {
+          "type": "keyword"
+        },
+        "originId": {
+          "type": "keyword"
+        },
+        "osquery-manager-usage-metric": {
+          "properties": {
+            "count": {
+              "type": "long"
+            },
+            "errors": {
+              "type": "long"
+            }
+          }
+        },
+        "osquery-pack": {
+          "properties": {
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "text"
+            },
+            "queries": {
+              "dynamic": "false",
+              "properties": {
+                "ecs_mapping": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "text"
+                },
+                "platform": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "type": "text"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "shards": {
+              "enabled": false,
+              "type": "object"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "long"
+            }
+          }
+        },
+        "osquery-pack-asset": {
+          "dynamic": "false",
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "name": {
+              "type": "text"
+            },
+            "queries": {
+              "dynamic": "false",
+              "properties": {
+                "ecs_mapping": {
+                  "enabled": false,
+                  "type": "object"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "text"
+                },
+                "platform": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "type": "text"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "shards": {
+              "enabled": false,
+              "type": "object"
+            },
+            "version": {
+              "type": "long"
+            }
+          }
+        },
+        "osquery-saved-query": {
+          "dynamic": "false",
+          "properties": {
+            "created_at": {
+              "type": "date"
+            },
+            "created_by": {
+              "type": "text"
+            },
+            "description": {
+              "type": "text"
+            },
+            "ecs_mapping": {
+              "enabled": false,
+              "type": "object"
+            },
+            "id": {
+              "type": "keyword"
+            },
+            "interval": {
+              "type": "keyword"
+            },
+            "platform": {
+              "type": "keyword"
+            },
+            "query": {
+              "type": "text"
+            },
+            "updated_at": {
+              "type": "date"
+            },
+            "updated_by": {
+              "type": "text"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "query": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "filters": {
+              "enabled": false,
+              "type": "object"
+            },
+            "query": {
+              "properties": {
+                "language": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "timefilter": {
+              "enabled": false,
+              "type": "object"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "references": {
+          "properties": {
+            "id": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          },
+          "type": "nested"
+        },
+        "sample-data-telemetry": {
+          "properties": {
+            "installCount": {
+              "type": "long"
+            },
+            "unInstallCount": {
+              "type": "long"
+            }
+          }
+        },
+        "search": {
+          "properties": {
+            "breakdownField": {
+              "type": "text"
+            },
+            "columns": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "grid": {
+              "enabled": false,
+              "type": "object"
+            },
+            "hideAggregatedPreview": {
+              "doc_values": false,
+              "index": false,
+              "type": "boolean"
+            },
+            "hideChart": {
+              "doc_values": false,
+              "index": false,
+              "type": "boolean"
+            },
+            "hits": {
+              "doc_values": false,
+              "index": false,
+              "type": "integer"
+            },
+            "isTextBasedQuery": {
+              "doc_values": false,
+              "index": false,
+              "type": "boolean"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "refreshInterval": {
+              "dynamic": "false",
+              "properties": {
+                "pause": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "boolean"
+                },
+                "value": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "integer"
+                }
+              }
+            },
+            "rowHeight": {
+              "type": "text"
+            },
+            "rowsPerPage": {
+              "doc_values": false,
+              "index": false,
+              "type": "integer"
+            },
+            "sort": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "timeRange": {
+              "dynamic": "false",
+              "properties": {
+                "from": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "keyword"
+                },
+                "to": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "keyword"
+                }
+              }
+            },
+            "timeRestore": {
+              "doc_values": false,
+              "index": false,
+              "type": "boolean"
+            },
+            "title": {
+              "type": "text"
+            },
+            "usesAdHocDataView": {
+              "doc_values": false,
+              "index": false,
+              "type": "boolean"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "viewMode": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            }
+          }
+        },
+        "search-session": {
+          "properties": {
+            "appId": {
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "expires": {
+              "type": "date"
+            },
+            "idMapping": {
+              "enabled": false,
+              "type": "object"
+            },
+            "initialState": {
+              "enabled": false,
+              "type": "object"
+            },
+            "isCanceled": {
+              "type": "boolean"
+            },
+            "locatorId": {
+              "type": "keyword"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "realmName": {
+              "type": "keyword"
+            },
+            "realmType": {
+              "type": "keyword"
+            },
+            "restoreState": {
+              "enabled": false,
+              "type": "object"
+            },
+            "sessionId": {
+              "type": "keyword"
+            },
+            "username": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "keyword"
+            }
+          }
+        },
+        "search-telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "security-rule": {
+          "dynamic": "false",
+          "properties": {
+            "name": {
+              "type": "keyword"
+            },
+            "rule_id": {
+              "type": "keyword"
+            },
+            "version": {
+              "type": "long"
+            }
+          }
+        },
+        "security-solution-signals-migration": {
+          "properties": {
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "createdBy": {
+              "index": false,
+              "type": "text"
+            },
+            "destinationIndex": {
+              "index": false,
+              "type": "keyword"
+            },
+            "error": {
+              "index": false,
+              "type": "text"
+            },
+            "sourceIndex": {
+              "type": "keyword"
+            },
+            "status": {
+              "index": false,
+              "type": "keyword"
+            },
+            "taskId": {
+              "index": false,
+              "type": "keyword"
+            },
+            "updated": {
+              "index": false,
+              "type": "date"
+            },
+            "updatedBy": {
+              "index": false,
+              "type": "text"
+            },
+            "version": {
+              "type": "long"
+            }
+          }
+        },
+        "siem-detection-engine-rule-actions": {
+          "properties": {
+            "actions": {
+              "properties": {
+                "actionRef": {
+                  "type": "keyword"
+                },
+                "action_type_id": {
+                  "type": "keyword"
+                },
+                "group": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "params": {
+                  "enabled": false,
+                  "type": "object"
+                }
+              }
+            },
+            "alertThrottle": {
+              "type": "keyword"
+            },
+            "ruleAlertId": {
+              "type": "keyword"
+            },
+            "ruleThrottle": {
+              "type": "keyword"
+            }
+          }
+        },
+        "siem-detection-engine-rule-execution-info": {
+          "properties": {
+            "last_execution": {
+              "properties": {
+                "date": {
+                  "type": "date"
+                },
+                "message": {
+                  "type": "text"
+                },
+                "metrics": {
+                  "properties": {
+                    "execution_gap_duration_s": {
+                      "type": "long"
+                    },
+                    "total_enrichment_duration_ms": {
+                      "type": "long"
+                    },
+                    "total_indexing_duration_ms": {
+                      "type": "long"
+                    },
+                    "total_search_duration_ms": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "status_order": {
+                  "type": "long"
+                }
+              }
+            }
+          }
+        },
+        "siem-ui-timeline": {
+          "properties": {
+            "columns": {
+              "properties": {
+                "aggregatable": {
+                  "type": "boolean"
+                },
+                "category": {
+                  "type": "keyword"
+                },
+                "columnHeaderType": {
+                  "type": "keyword"
+                },
+                "description": {
+                  "type": "text"
+                },
+                "example": {
+                  "type": "text"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "indexes": {
+                  "type": "keyword"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "placeholder": {
+                  "type": "text"
+                },
+                "searchable": {
+                  "type": "boolean"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "dataProviders": {
+              "properties": {
+                "and": {
+                  "properties": {
+                    "enabled": {
+                      "type": "boolean"
+                    },
+                    "excluded": {
+                      "type": "boolean"
+                    },
+                    "id": {
+                      "type": "keyword"
+                    },
+                    "kqlQuery": {
+                      "type": "text"
+                    },
+                    "name": {
+                      "type": "text"
+                    },
+                    "queryMatch": {
+                      "properties": {
+                        "displayField": {
+                          "type": "text"
+                        },
+                        "displayValue": {
+                          "type": "text"
+                        },
+                        "field": {
+                          "type": "text"
+                        },
+                        "operator": {
+                          "type": "text"
+                        },
+                        "value": {
+                          "type": "text"
+                        }
+                      }
+                    },
+                    "type": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "enabled": {
+                  "type": "boolean"
+                },
+                "excluded": {
+                  "type": "boolean"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "kqlQuery": {
+                  "type": "text"
+                },
+                "name": {
+                  "type": "text"
+                },
+                "queryMatch": {
+                  "properties": {
+                    "displayField": {
+                      "type": "text"
+                    },
+                    "displayValue": {
+                      "type": "text"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "operator": {
+                      "type": "text"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "type": {
+                  "type": "text"
+                }
+              }
+            },
+            "dateRange": {
+              "properties": {
+                "end": {
+                  "type": "date"
+                },
+                "start": {
+                  "type": "date"
+                }
+              }
+            },
+            "description": {
+              "type": "text"
+            },
+            "eqlOptions": {
+              "properties": {
+                "eventCategoryField": {
+                  "type": "text"
+                },
+                "query": {
+                  "type": "text"
+                },
+                "size": {
+                  "type": "text"
+                },
+                "tiebreakerField": {
+                  "type": "text"
+                },
+                "timestampField": {
+                  "type": "text"
+                }
+              }
+            },
+            "eventType": {
+              "type": "keyword"
+            },
+            "excludedRowRendererIds": {
+              "type": "text"
+            },
+            "favorite": {
+              "properties": {
+                "favoriteDate": {
+                  "type": "date"
+                },
+                "fullName": {
+                  "type": "text"
+                },
+                "keySearch": {
+                  "type": "text"
+                },
+                "userName": {
+                  "type": "text"
+                }
+              }
+            },
+            "filters": {
+              "properties": {
+                "exists": {
+                  "type": "text"
+                },
+                "match_all": {
+                  "type": "text"
+                },
+                "meta": {
+                  "properties": {
+                    "alias": {
+                      "type": "text"
+                    },
+                    "controlledBy": {
+                      "type": "text"
+                    },
+                    "disabled": {
+                      "type": "boolean"
+                    },
+                    "field": {
+                      "type": "text"
+                    },
+                    "formattedValue": {
+                      "type": "text"
+                    },
+                    "index": {
+                      "type": "keyword"
+                    },
+                    "key": {
+                      "type": "keyword"
+                    },
+                    "negate": {
+                      "type": "boolean"
+                    },
+                    "params": {
+                      "type": "text"
+                    },
+                    "type": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "missing": {
+                  "type": "text"
+                },
+                "query": {
+                  "type": "text"
+                },
+                "range": {
+                  "type": "text"
+                },
+                "script": {
+                  "type": "text"
+                }
+              }
+            },
+            "indexNames": {
+              "type": "text"
+            },
+            "kqlMode": {
+              "type": "keyword"
+            },
+            "kqlQuery": {
+              "properties": {
+                "filterQuery": {
+                  "properties": {
+                    "kuery": {
+                      "properties": {
+                        "expression": {
+                          "type": "text"
+                        },
+                        "kind": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "serializedQuery": {
+                      "type": "text"
+                    }
+                  }
+                }
+              }
+            },
+            "sort": {
+              "dynamic": "false",
+              "properties": {
+                "columnId": {
+                  "type": "keyword"
+                },
+                "columnType": {
+                  "type": "keyword"
+                },
+                "sortDirection": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            },
+            "templateTimelineId": {
+              "type": "text"
+            },
+            "templateTimelineVersion": {
+              "type": "integer"
+            },
+            "timelineType": {
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-note": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "note": {
+              "type": "text"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "siem-ui-timeline-pinned-event": {
+          "properties": {
+            "created": {
+              "type": "date"
+            },
+            "createdBy": {
+              "type": "text"
+            },
+            "eventId": {
+              "type": "keyword"
+            },
+            "updated": {
+              "type": "date"
+            },
+            "updatedBy": {
+              "type": "text"
+            }
+          }
+        },
+        "space": {
+          "properties": {
+            "_reserved": {
+              "type": "boolean"
+            },
+            "color": {
+              "type": "keyword"
+            },
+            "description": {
+              "type": "text"
+            },
+            "disabledFeatures": {
+              "type": "keyword"
+            },
+            "imageUrl": {
+              "index": false,
+              "type": "text"
+            },
+            "initials": {
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "spaces-usage-stats": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "synthetics-monitor": {
+          "dynamic": "false",
+          "properties": {
+            "custom_heartbeat_id": {
+              "type": "keyword"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "hash": {
+              "type": "keyword"
+            },
+            "hosts": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "id": {
+              "type": "keyword"
+            },
+            "journey_id": {
+              "type": "keyword"
+            },
+            "locations": {
+              "properties": {
+                "id": {
+                  "fields": {
+                    "text": {
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 256,
+                  "type": "keyword"
+                },
+                "label": {
+                  "type": "text"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "normalizer": "lowercase",
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "origin": {
+              "type": "keyword"
+            },
+            "project_id": {
+              "fields": {
+                "text": {
+                  "type": "text"
+                }
+              },
+              "type": "keyword"
+            },
+            "schedule": {
+              "properties": {
+                "number": {
+                  "type": "integer"
+                }
+              }
+            },
+            "tags": {
+              "fields": {
+                "text": {
+                  "type": "text"
+                }
+              },
+              "type": "keyword"
+            },
+            "type": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "urls": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "synthetics-param": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "synthetics-privates-locations": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "tag": {
+          "properties": {
+            "color": {
+              "type": "text"
+            },
+            "description": {
+              "type": "text"
+            },
+            "name": {
+              "type": "text"
+            }
+          }
+        },
+        "telemetry": {
+          "properties": {
+            "allowChangingOptInStatus": {
+              "type": "boolean"
+            },
+            "enabled": {
+              "type": "boolean"
+            },
+            "lastReported": {
+              "type": "date"
+            },
+            "lastVersionChecked": {
+              "type": "keyword"
+            },
+            "reportFailureCount": {
+              "type": "integer"
+            },
+            "reportFailureVersion": {
+              "type": "keyword"
+            },
+            "sendUsageFrom": {
+              "type": "keyword"
+            },
+            "userHasSeenNotice": {
+              "type": "boolean"
+            }
+          }
+        },
+        "test-actions-export-hidden": {
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-deprecations-plugin": {
+          "properties": {
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-export-add": {
+          "properties": {
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-export-add-dep": {
+          "properties": {
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-export-invalid-transform": {
+          "properties": {
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-export-transform": {
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-export-transform-error": {
+          "properties": {
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-hidden-from-http-apis-importable-exportable": {
+          "properties": {
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-hidden-importable-exportable": {
+          "properties": {
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-hidden-non-importable-exportable": {
+          "properties": {
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-is-exportable": {
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-not-hidden-from-http-apis-importable-exportable": {
+          "properties": {
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-not-visible-in-management": {
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-visible-in-management": {
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test-with-display-name": {
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            },
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test_import_warning_1": {
+          "properties": {
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "test_import_warning_2": {
+          "properties": {
+            "title": {
+              "type": "text"
+            }
+          }
+        },
+        "type": {
+          "type": "keyword"
+        },
+        "ui-metric": {
+          "properties": {
+            "count": {
+              "type": "integer"
+            }
+          }
+        },
+        "updated_at": {
+          "type": "date"
+        },
+        "upgrade-assistant-ml-upgrade-operation": {
+          "properties": {
+            "jobId": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "nodeId": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "snapshotId": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "status": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "upgrade-assistant-reindex-operation": {
+          "properties": {
+            "errorMessage": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "indexName": {
+              "type": "keyword"
+            },
+            "lastCompletedStep": {
+              "type": "long"
+            },
+            "locked": {
+              "type": "date"
+            },
+            "newIndexName": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexOptions": {
+              "properties": {
+                "openAndClose": {
+                  "type": "boolean"
+                },
+                "queueSettings": {
+                  "properties": {
+                    "queuedAt": {
+                      "type": "long"
+                    },
+                    "startedAt": {
+                      "type": "long"
+                    }
+                  }
+                }
+              }
+            },
+            "reindexTaskId": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 256,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "reindexTaskPercComplete": {
+              "type": "float"
+            },
+            "runningReindexCount": {
+              "type": "integer"
+            },
+            "status": {
+              "type": "integer"
+            }
+          }
+        },
+        "upgrade-assistant-telemetry": {
+          "properties": {
+            "features": {
+              "properties": {
+                "deprecation_logging": {
+                  "properties": {
+                    "enabled": {
+                      "null_value": true,
+                      "type": "boolean"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "uptime-dynamic-settings": {
+          "dynamic": "false",
+          "type": "object"
+        },
+        "uptime-synthetics-api-key": {
+          "dynamic": "false",
+          "properties": {
+            "apiKey": {
+              "type": "binary"
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "accessCount": {
+              "type": "long"
+            },
+            "accessDate": {
+              "type": "date"
+            },
+            "createDate": {
+              "type": "date"
+            },
+            "locatorJSON": {
+              "index": false,
+              "type": "text"
+            },
+            "slug": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "url": {
+              "fields": {
+                "keyword": {
+                  "ignore_above": 2048,
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            }
+          }
+        },
+        "usage-counters": {
+          "dynamic": "false",
+          "properties": {
+            "domainId": {
+              "type": "keyword"
+            }
+          }
+        },
+        "visualization": {
+          "properties": {
+            "description": {
+              "type": "text"
+            },
+            "kibanaSavedObjectMeta": {
+              "properties": {
+                "searchSourceJSON": {
+                  "index": false,
+                  "type": "text"
+                }
+              }
+            },
+            "savedSearchRefName": {
+              "doc_values": false,
+              "index": false,
+              "type": "keyword"
+            },
+            "title": {
+              "type": "text"
+            },
+            "uiStateJSON": {
+              "index": false,
+              "type": "text"
+            },
+            "version": {
+              "type": "integer"
+            },
+            "visState": {
+              "index": false,
+              "type": "text"
+            }
+          }
+        },
+        "workplace_search_telemetry": {
+          "dynamic": "false",
+          "type": "object"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "hidden": "true",
+        "mapping": {
+          "total_fields": {
+            "limit": "1500"
+          }
+        },
+        "number_of_replicas": "0",
+        "number_of_shards": "1",
+        "priority": "10",
+        "refresh_interval": "1s"
+      }
+    }
+  }
+}
diff --git a/test/functional/fixtures/kbn_archiver/saved_objects_management/hidden_from_http_apis.json b/test/functional/fixtures/kbn_archiver/saved_objects_management/hidden_from_http_apis.json
new file mode 100644
index 00000000000000..3448d3d339e09f
--- /dev/null
+++ b/test/functional/fixtures/kbn_archiver/saved_objects_management/hidden_from_http_apis.json
@@ -0,0 +1,39 @@
+{
+  "attributes": {
+    "title": "I am hidden from http apis but the client can still see me"
+  },
+  "id": "hidden-from-http-apis-1",
+  "references": [],
+  "type": "test-hidden-from-http-apis-importable-exportable",
+  "version": "WzQ0LDFd"
+}
+
+{
+  "attributes": {
+    "title": "I am not hidden from http apis"
+  },
+  "id": "not-hidden-from-http-apis-1",
+  "references": [],
+  "type": "test-not-hidden-from-http-apis-importable-exportable",
+  "version": "WzQ5LDFd"
+}
+
+{
+  "attributes": {
+    "title": "I am also hidden from http apis but the client can still see me"
+  },
+  "id": "hidden-from-http-apis-2",
+  "references": [],
+  "type": "test-hidden-from-http-apis-importable-exportable",
+  "version": "WzcyLDFd"
+}
+
+{
+  "attributes": {
+    "title": "I am also not hidden from http apis"
+  },
+  "id": "not-hidden-from-http-apis-2",
+  "references": [],
+  "type": "test-not-hidden-from-http-apis-importable-exportable",
+  "version": "WzczLDFd"
+}
diff --git a/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/kibana.json b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/kibana.json
new file mode 100644
index 00000000000000..43ec012e720abf
--- /dev/null
+++ b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/kibana.json
@@ -0,0 +1,12 @@
+{
+  "id": "savedObjectsHiddenFromHttpApisType",
+  "owner": {
+    "name": "Core",
+    "githubTeam": "kibana-core"
+  },
+  "version": "0.0.1",
+  "kibanaVersion": "kibana",
+  "configPath": ["saved_objects_hidden_from_http_apis_type"],
+  "server": true,
+  "ui": false
+}
diff --git a/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/package.json b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/package.json
new file mode 100644
index 00000000000000..098e70c85d7ba8
--- /dev/null
+++ b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "saved_objects_hidden_from_http_apis_type",
+  "version": "1.0.0",
+  "main": "target/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type",
+  "kibana": {
+    "version": "kibana",
+    "templateVersion": "1.0.0"
+  },
+  "license": "Apache-2.0",
+  "scripts": {
+    "kbn": "node ../../../../scripts/kbn.js",
+    "build": "rm -rf './target' && ../../../../node_modules/.bin/tsc"
+  }
+}
diff --git a/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/index.ts b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/index.ts
new file mode 100644
index 00000000000000..6e0e8ae6554796
--- /dev/null
+++ b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { SavedObjectsHiddenFromHttpApisTypePlugin } from './plugin';
+
+export const plugin = () => new SavedObjectsHiddenFromHttpApisTypePlugin();
diff --git a/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/plugin.ts b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/plugin.ts
new file mode 100644
index 00000000000000..10a169ef21d4eb
--- /dev/null
+++ b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/server/plugin.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { Plugin, CoreSetup } from '@kbn/core/server';
+
+export class SavedObjectsHiddenFromHttpApisTypePlugin implements Plugin {
+  public setup({ savedObjects }: CoreSetup, deps: {}) {
+    // example of a SO type that not hidden but is hidden from the http apis.
+    savedObjects.registerType({
+      name: 'test-hidden-from-http-apis-importable-exportable',
+      hidden: false,
+      hiddenFromHttpApis: true,
+      namespaceType: 'single',
+      mappings: {
+        properties: {
+          title: { type: 'text' },
+        },
+      },
+      management: {
+        importableAndExportable: true,
+        visibleInManagement: true,
+      },
+    });
+    savedObjects.registerType({
+      name: 'test-not-hidden-from-http-apis-importable-exportable',
+      hidden: false,
+      hiddenFromHttpApis: false,
+      namespaceType: 'single',
+      mappings: {
+        properties: {
+          title: { type: 'text' },
+        },
+      },
+      management: {
+        importableAndExportable: true,
+        visibleInManagement: true,
+      },
+    });
+  }
+
+  public start() {}
+  public stop() {}
+}
diff --git a/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/tsconfig.json b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/tsconfig.json
new file mode 100644
index 00000000000000..bf146797a42ee8
--- /dev/null
+++ b/test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "extends": "../../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types"
+  },
+  "include": [
+    "index.ts",
+    "server/**/*.ts",
+    "../../../../typings/**/*",
+  ],
+  "exclude": [
+    "target/**/*",
+  ],
+  "kbn_references": [
+    "@kbn/core"
+  ]
+}
diff --git a/test/plugin_functional/test_suites/saved_objects_management/exports/_import_hidden_from_http_apis.ndjson b/test/plugin_functional/test_suites/saved_objects_management/exports/_import_hidden_from_http_apis.ndjson
new file mode 100644
index 00000000000000..1c509c9f75aa37
--- /dev/null
+++ b/test/plugin_functional/test_suites/saved_objects_management/exports/_import_hidden_from_http_apis.ndjson
@@ -0,0 +1,2 @@
+{"attributes": {"title": "I am hidden from http apis but the client can still see me"},"id": "hidden-from-http-apis-import1","references": [],"type":"test-hidden-from-http-apis-importable-exportable","version": 1}
+{"attributes": {"title": "I am not hidden from http apis"},"id": "not-hidden-from-http-apis-import1","references": [],"type": "test-not-hidden-from-http-apis-importable-exportable","version": 1}
diff --git a/test/plugin_functional/test_suites/saved_objects_management/hidden_from_http_apis.ts b/test/plugin_functional/test_suites/saved_objects_management/hidden_from_http_apis.ts
new file mode 100644
index 00000000000000..ce441d9d1b3536
--- /dev/null
+++ b/test/plugin_functional/test_suites/saved_objects_management/hidden_from_http_apis.ts
@@ -0,0 +1,209 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { join } from 'path';
+import expect from '@kbn/expect';
+import type { Response } from 'supertest';
+import { SavedObject } from '@kbn/core/types';
+import type { PluginFunctionalProviderContext } from '../../services';
+
+function parseNdJson(input: string): Array<SavedObject<any>> {
+  return input.split('\n').map((str) => JSON.parse(str));
+}
+
+export default function ({ getService }: PluginFunctionalProviderContext) {
+  const supertest = getService('supertest');
+  const kbnServer = getService('kibanaServer');
+  const esArchiver = getService('esArchiver');
+
+  describe('types with `hiddenFromHttpApis` ', () => {
+    before(async () => {
+      // `kbnServer.savedObjects.cleanStandardList` uses global saved objects `delete`.
+      // If there are any remaining saved objects registered as `hiddenFromHttpApis:true`,
+      // cleaning them up will fail.
+      await kbnServer.savedObjects.cleanStandardList();
+
+      await kbnServer.importExport.load(
+        'test/functional/fixtures/kbn_archiver/saved_objects_management/hidden_from_http_apis.json'
+      );
+    });
+
+    after(async () => {
+      // We cannot use `kbnServer.importExport.unload` to clean up test fixtures.
+      // `kbnServer.importExport.unload` uses the global SOM `delete` HTTP API
+      // and will throw on `hiddenFromHttpApis:true` objects
+      await esArchiver.unload(
+        'test/functional/fixtures/es_archiver/saved_objects_management/hidden_from_http_apis'
+      );
+    });
+
+    describe('APIS', () => {
+      const hiddenFromHttpApisType = {
+        type: 'test-hidden-from-http-apis-importable-exportable',
+        id: 'hidden-from-http-apis-1',
+      };
+      const notHiddenFromHttpApisType = {
+        type: 'test-not-hidden-from-http-apis-importable-exportable',
+        id: 'not-hidden-from-http-apis-1',
+      };
+
+      describe('_bulk_get', () => {
+        describe('saved objects with hiddenFromHttpApis type', () => {
+          const URL = '/api/kibana/management/saved_objects/_bulk_get';
+
+          it('should return 200 for types that are not hidden from the http apis', async () =>
+            await supertest
+              .post(URL)
+              .send([notHiddenFromHttpApisType])
+              .set('kbn-xsrf', 'true')
+              .expect(200)
+              .then((response: Response) => {
+                expect(response.body).to.have.length(1);
+                const { type, id, meta, error } = response.body[0];
+                expect(type).to.eql(notHiddenFromHttpApisType.type);
+                expect(id).to.eql(notHiddenFromHttpApisType.id);
+                expect(meta).to.not.equal(undefined);
+                expect(error).to.equal(undefined);
+              }));
+
+          it('should return 200 for types that are hidden from the http apis', async () =>
+            await supertest
+              .post(URL)
+              .send([hiddenFromHttpApisType])
+              .set('kbn-xsrf', 'true')
+              .expect(200)
+              .then((response: Response) => {
+                expect(response.body).to.have.length(1);
+                const { type, id, meta, error } = response.body[0];
+                expect(type).to.eql(hiddenFromHttpApisType.type);
+                expect(id).to.eql(hiddenFromHttpApisType.id);
+                expect(meta).to.not.equal(undefined);
+                expect(error).to.equal(undefined);
+              }));
+
+          it('should return 200 for a mix of types', async () =>
+            await supertest
+              .post(URL)
+              .send([hiddenFromHttpApisType, notHiddenFromHttpApisType])
+              .set('kbn-xsrf', 'true')
+              .expect(200)
+              .expect(200)
+              .then((response: Response) => {
+                expect(response.body).to.have.length(2);
+                const { type, id, meta, error } = response.body[0];
+                expect(type).to.eql(hiddenFromHttpApisType.type);
+                expect(id).to.eql(hiddenFromHttpApisType.id);
+                expect(meta).to.not.equal(undefined);
+                expect(error).to.equal(undefined);
+              }));
+        });
+      });
+
+      describe('find', () => {
+        it('returns saved objects registered as hidden from the http Apis', async () => {
+          await supertest
+            .get(
+              `/api/kibana/management/saved_objects/_find?type=${hiddenFromHttpApisType.type}&fields=title`
+            )
+            .set('kbn-xsrf', 'true')
+            .expect(200)
+            .then((resp) => {
+              expect(
+                resp.body.saved_objects.map((so: { id: string; type: string }) => ({
+                  id: so.id,
+                  type: so.type,
+                }))
+              ).to.eql([
+                {
+                  id: 'hidden-from-http-apis-1',
+                  type: 'test-hidden-from-http-apis-importable-exportable',
+                },
+                {
+                  id: 'hidden-from-http-apis-2',
+                  type: 'test-hidden-from-http-apis-importable-exportable',
+                },
+              ]);
+            });
+        });
+      });
+
+      describe('export', () => {
+        it('allows to export them directly by id', async () => {
+          await supertest
+            .post('/api/saved_objects/_export')
+            .set('kbn-xsrf', 'true')
+            .send({
+              objects: [
+                {
+                  type: 'test-hidden-from-http-apis-importable-exportable',
+                  id: 'hidden-from-http-apis-1',
+                },
+              ],
+              excludeExportDetails: true,
+            })
+            .expect(200)
+            .then((resp) => {
+              const objects = parseNdJson(resp.text);
+              expect(objects.map((obj) => obj.id)).to.eql(['hidden-from-http-apis-1']);
+            });
+        });
+
+        it('allows to export them directly by type', async () => {
+          await supertest
+            .post('/api/saved_objects/_export')
+            .set('kbn-xsrf', 'true')
+            .send({
+              type: ['test-hidden-from-http-apis-importable-exportable'],
+              excludeExportDetails: true,
+            })
+            .expect(200)
+            .then((resp) => {
+              const objects = parseNdJson(resp.text);
+              expect(objects.map((obj) => obj.id)).to.eql([
+                'hidden-from-http-apis-1',
+                'hidden-from-http-apis-2',
+              ]);
+            });
+        });
+      });
+
+      describe('import', () => {
+        it('allows to import them', async () => {
+          await supertest
+            .post('/api/saved_objects/_import')
+            .set('kbn-xsrf', 'true')
+            .attach('file', join(__dirname, './exports/_import_hidden_from_http_apis.ndjson'))
+            .expect(200)
+            .then((resp) => {
+              expect(resp.body).to.eql({
+                success: true,
+                successCount: 2,
+                successResults: [
+                  {
+                    id: 'hidden-from-http-apis-import1',
+                    meta: {
+                      title: 'I am hidden from http apis but the client can still see me',
+                    },
+                    type: 'test-hidden-from-http-apis-importable-exportable',
+                  },
+                  {
+                    id: 'not-hidden-from-http-apis-import1',
+                    meta: {
+                      title: 'I am not hidden from http apis',
+                    },
+                    type: 'test-not-hidden-from-http-apis-importable-exportable',
+                  },
+                ],
+                warnings: [],
+              });
+            });
+        });
+      });
+    });
+  });
+}
diff --git a/test/plugin_functional/test_suites/saved_objects_management/index.ts b/test/plugin_functional/test_suites/saved_objects_management/index.ts
index b7730a95d3c717..3c8ceae23d6824 100644
--- a/test/plugin_functional/test_suites/saved_objects_management/index.ts
+++ b/test/plugin_functional/test_suites/saved_objects_management/index.ts
@@ -17,5 +17,6 @@ export default function ({ loadTestFile }: PluginFunctionalProviderContext) {
     loadTestFile(require.resolve('./import_warnings'));
     loadTestFile(require.resolve('./hidden_types'));
     loadTestFile(require.resolve('./visible_in_management'));
+    loadTestFile(require.resolve('./hidden_from_http_apis'));
   });
 }
diff --git a/test/plugin_functional/test_suites/usage_collection/usage_counters.ts b/test/plugin_functional/test_suites/usage_collection/usage_counters.ts
index 0e49b4ddbc91ba..be4797b1cf61f4 100644
--- a/test/plugin_functional/test_suites/usage_collection/usage_counters.ts
+++ b/test/plugin_functional/test_suites/usage_collection/usage_counters.ts
@@ -18,7 +18,7 @@ export default function ({ getService, getPageObjects }: PluginFunctionalProvide
 
   async function getSavedObjectCounters() {
     // wait until ES indexes the counter SavedObject;
-    await new Promise((res) => setTimeout(res, 7 * 1000));
+    await new Promise((res) => setTimeout(res, 10 * 1000));
 
     return await supertest
       .get('/api/saved_objects/_find?type=usage-counters')
diff --git a/tsconfig.base.json b/tsconfig.base.json
index 58b859be7395f5..ca0c15d5a7cac9 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -958,6 +958,8 @@
       "@kbn/saved-object-import-warnings-plugin/*": ["test/plugin_functional/plugins/saved_object_import_warnings/*"],
       "@kbn/saved-objects-finder-plugin": ["src/plugins/saved_objects_finder"],
       "@kbn/saved-objects-finder-plugin/*": ["src/plugins/saved_objects_finder/*"],
+      "@kbn/saved-objects-hidden-from-http-apis-type-plugin": ["test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type"],
+      "@kbn/saved-objects-hidden-from-http-apis-type-plugin/*": ["test/plugin_functional/plugins/saved_objects_hidden_from_http_apis_type/*"],
       "@kbn/saved-objects-hidden-type-plugin": ["test/plugin_functional/plugins/saved_objects_hidden_type"],
       "@kbn/saved-objects-hidden-type-plugin/*": ["test/plugin_functional/plugins/saved_objects_hidden_type/*"],
       "@kbn/saved-objects-management-plugin": ["src/plugins/saved_objects_management"],

From 77742b8a9e941dc94cee68e76a14fc53a3cd49c7 Mon Sep 17 00:00:00 2001
From: Alexi Doak <109488926+doakalexi@users.noreply.github.com>
Date: Mon, 23 Jan 2023 17:33:01 -0500
Subject: [PATCH 26/54] [ResponseOps][OnWeek] Connector logs view (#148291)

Resolves https://github.com/elastic/kibana/issues/147795

## Summary

Adds a connectors event log tab that gives the ability to see historical
activity of connectors.


### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### To verify

- Create a rule with a connector, create a few to help test the search
capability
- Go to
http://localhost:5601/app/management/insightsAndAlerting/triggersActionsConnectors/logs
- Verify that you can see the execution logs for the connector
- Verify that you can search
- Verify that you can filter by error/success

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Ying Mao <ying.mao@elastic.co>
---
 .../actions/common/execution_log_types.ts     |  61 ++
 x-pack/plugins/actions/common/index.ts        |   1 +
 .../actions/server/actions_client.mock.ts     |   2 +
 .../actions/server/actions_client.test.ts     | 141 +++
 .../plugins/actions/server/actions_client.ts  | 148 ++-
 .../server/lib/action_executor.test.ts        | 145 +--
 .../actions/server/lib/action_executor.ts     |  11 +
 .../actions/server/lib/audit_events.ts        |   6 +
 ...ate_action_event_log_record_object.test.ts |  99 ++
 .../create_action_event_log_record_object.ts  |  27 +-
 .../lib/get_execution_log_aggregation.test.ts | 945 ++++++++++++++++++
 .../lib/get_execution_log_aggregation.ts      | 424 ++++++++
 x-pack/plugins/actions/server/lib/index.ts    |   1 +
 .../actions/server/lib/parse_date.test.ts     |  51 +
 .../plugins/actions/server/lib/parse_date.ts  |  90 ++
 .../server/lib/task_runner_factory.test.ts    |  74 +-
 .../actions/server/lib/task_runner_factory.ts |   4 +
 x-pack/plugins/actions/server/plugin.test.ts  |   2 +
 x-pack/plugins/actions/server/plugin.ts       |  15 +-
 .../routes/get_global_execution_kpi.test.ts   |  68 ++
 .../server/routes/get_global_execution_kpi.ts |  58 ++
 .../routes/get_global_execution_logs.test.ts  |  88 ++
 .../routes/get_global_execution_logs.ts       |  70 ++
 x-pack/plugins/actions/server/routes/index.ts |   4 +
 .../server/routes/rewrite_namespaces.ts       |  11 +
 x-pack/plugins/actions/tsconfig.json          |   2 +-
 .../plugins/event_log/generated/mappings.json |  23 +
 x-pack/plugins/event_log/generated/schemas.ts |  12 +
 x-pack/plugins/event_log/scripts/mappings.js  |  23 +
 .../server/es/cluster_client_adapter.test.ts  | 148 +++
 .../server/es/cluster_client_adapter.ts       |  21 +-
 .../event_log/server/event_log_client.test.ts |  13 +-
 .../event_log/server/event_log_client.ts      |   4 +-
 x-pack/plugins/event_log/server/types.ts      |   3 +-
 .../translations/translations/fr-FR.json      |  18 -
 .../translations/translations/ja-JP.json      |  18 -
 .../translations/translations/zh-CN.json      |  18 -
 .../public/application/connectors_app.tsx     |  20 +-
 .../public/application/constants/index.ts     |  19 +
 .../application/hooks/use_multiple_spaces.ts  |  60 ++
 .../lib/action_connector_api/index.ts         |   4 +
 .../load_execution_kpi_aggregations.test.ts   |  45 +
 .../load_execution_kpi_aggregations.ts        |  42 +
 .../load_execution_log_aggregations.test.ts   |  81 ++
 .../load_execution_log_aggregations.ts        |  87 ++
 .../public/application/lib/rule_api/index.ts  |   1 +
 ...ons_connectors_event_log_list_kpi.test.tsx | 133 +++
 .../actions_connectors_event_log_list_kpi.tsx | 187 ++++
 ...s_connectors_event_log_list_table.test.tsx | 119 +++
 ...ctions_connectors_event_log_list_table.tsx | 597 +++++++++++
 .../components/actions_connectors_home.tsx    | 137 +++
 .../components/actions_connectors_list.tsx    |  98 +-
 .../event_log/event_log_data_grid.tsx         | 373 +++++++
 .../components/event_log/event_log_list.scss} |   0
 .../event_log_list_cell_renderer.test.tsx}    |  37 +-
 .../event_log_list_cell_renderer.tsx}         |  25 +-
 .../event_log/event_log_list_status.tsx}      |   6 +-
 .../event_log_list_status_filter.test.tsx}    |  12 +-
 .../event_log_list_status_filter.tsx}         |  16 +-
 .../event_log_pagination_status.tsx}          |  14 +-
 .../components/event_log/event_log_stat.tsx   |  34 +
 .../common/components/event_log/index.ts      |  22 +
 .../components}/refine_search_prompt.tsx      |   4 +-
 .../with_actions_api_operations.tsx           |  36 +-
 .../components/rule_error_log.test.tsx        |   2 +-
 .../components/rule_error_log.tsx             |   6 +-
 .../components/rule_event_log_data_grid.tsx   | 655 ------------
 .../components/rule_event_log_list.test.tsx   |  29 +-
 .../components/rule_event_log_list_kpi.tsx    |  47 +-
 .../components/rule_event_log_list_table.tsx  | 345 ++++++-
 .../triggers_actions_ui/connectors/general.ts | 106 ++
 .../triggers_actions_ui/connectors/utils.ts   |  63 +-
 .../apps/triggers_actions_ui/details.ts       |  10 +-
 73 files changed, 5272 insertions(+), 1049 deletions(-)
 create mode 100644 x-pack/plugins/actions/common/execution_log_types.ts
 create mode 100644 x-pack/plugins/actions/server/lib/get_execution_log_aggregation.test.ts
 create mode 100644 x-pack/plugins/actions/server/lib/get_execution_log_aggregation.ts
 create mode 100644 x-pack/plugins/actions/server/lib/parse_date.test.ts
 create mode 100644 x-pack/plugins/actions/server/lib/parse_date.ts
 create mode 100644 x-pack/plugins/actions/server/routes/get_global_execution_kpi.test.ts
 create mode 100644 x-pack/plugins/actions/server/routes/get_global_execution_kpi.ts
 create mode 100644 x-pack/plugins/actions/server/routes/get_global_execution_logs.test.ts
 create mode 100644 x-pack/plugins/actions/server/routes/get_global_execution_logs.ts
 create mode 100644 x-pack/plugins/actions/server/routes/rewrite_namespaces.ts
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/hooks/use_multiple_spaces.ts
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_kpi_aggregations.test.ts
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_kpi_aggregations.ts
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_log_aggregations.test.ts
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_log_aggregations.ts
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_kpi.test.tsx
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_kpi.tsx
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_table.test.tsx
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_table.tsx
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_home.tsx
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_data_grid.tsx
 rename x-pack/plugins/triggers_actions_ui/public/application/sections/{rule_details/components/rule_event_log_list.scss => common/components/event_log/event_log_list.scss} (100%)
 rename x-pack/plugins/triggers_actions_ui/public/application/sections/{rule_details/components/rule_event_log_list_cell_renderer.test.tsx => common/components/event_log/event_log_list_cell_renderer.test.tsx} (69%)
 rename x-pack/plugins/triggers_actions_ui/public/application/sections/{rule_details/components/rule_event_log_list_cell_renderer.tsx => common/components/event_log/event_log_list_cell_renderer.tsx} (82%)
 rename x-pack/plugins/triggers_actions_ui/public/application/sections/{rule_details/components/rule_event_log_list_status.tsx => common/components/event_log/event_log_list_status.tsx} (90%)
 rename x-pack/plugins/triggers_actions_ui/public/application/sections/{rule_details/components/rule_event_log_list_status_filter.test.tsx => common/components/event_log/event_log_list_status_filter.test.tsx} (79%)
 rename x-pack/plugins/triggers_actions_ui/public/application/sections/{rule_details/components/rule_event_log_list_status_filter.tsx => common/components/event_log/event_log_list_status_filter.tsx} (81%)
 rename x-pack/plugins/triggers_actions_ui/public/application/sections/{rule_details/components/rule_event_log_pagination_status.tsx => common/components/event_log/event_log_pagination_status.tsx} (70%)
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_stat.tsx
 create mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/index.ts
 rename x-pack/plugins/triggers_actions_ui/public/application/sections/{rule_details => common/components}/refine_search_prompt.tsx (89%)
 delete mode 100644 x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_data_grid.tsx

diff --git a/x-pack/plugins/actions/common/execution_log_types.ts b/x-pack/plugins/actions/common/execution_log_types.ts
new file mode 100644
index 00000000000000..7fed846f081cab
--- /dev/null
+++ b/x-pack/plugins/actions/common/execution_log_types.ts
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { estypes } from '@elastic/elasticsearch';
+
+export interface IExecutionLog {
+  id: string;
+  timestamp: string;
+  duration_ms: number;
+  status: string;
+  message: string;
+  version: string;
+  schedule_delay_ms: number;
+  space_ids: string[];
+  connector_name: string;
+  connector_id: string;
+  timed_out: boolean;
+}
+
+export interface IExecutionLogResult {
+  total: number;
+  data: IExecutionLog[];
+}
+
+export interface GetGlobalExecutionLogParams {
+  dateStart: string;
+  dateEnd?: string;
+  filter?: string;
+  page: number;
+  perPage: number;
+  sort: estypes.Sort;
+  namespaces?: Array<string | undefined>;
+}
+
+export interface GetGlobalExecutionKPIParams {
+  dateStart: string;
+  dateEnd?: string;
+  filter?: string;
+  namespaces?: Array<string | undefined>;
+}
+
+export const EMPTY_EXECUTION_KPI_RESULT = {
+  success: 0,
+  unknown: 0,
+  failure: 0,
+  warning: 0,
+};
+
+export type IExecutionKPIResult = typeof EMPTY_EXECUTION_KPI_RESULT;
+
+export const executionLogSortableColumns = [
+  'timestamp',
+  'execution_duration',
+  'schedule_delay',
+] as const;
+
+export type ExecutionLogSortFields = typeof executionLogSortableColumns[number];
diff --git a/x-pack/plugins/actions/common/index.ts b/x-pack/plugins/actions/common/index.ts
index 95b3d9e6c7c07c..feeb07fe84477e 100644
--- a/x-pack/plugins/actions/common/index.ts
+++ b/x-pack/plugins/actions/common/index.ts
@@ -14,6 +14,7 @@ export * from './rewrite_request_case';
 export * from './mustache_template';
 export * from './validate_email_addresses';
 export * from './connector_feature_config';
+export * from './execution_log_types';
 
 export const BASE_ACTION_API_PATH = '/api/actions';
 export const INTERNAL_BASE_ACTION_API_PATH = '/internal/actions';
diff --git a/x-pack/plugins/actions/server/actions_client.mock.ts b/x-pack/plugins/actions/server/actions_client.mock.ts
index 38d7ded9cf7a6a..b80914c309b253 100644
--- a/x-pack/plugins/actions/server/actions_client.mock.ts
+++ b/x-pack/plugins/actions/server/actions_client.mock.ts
@@ -27,6 +27,8 @@ const createActionsClientMock = () => {
     listTypes: jest.fn(),
     isActionTypeEnabled: jest.fn(),
     isPreconfigured: jest.fn(),
+    getGlobalExecutionKpiWithAuth: jest.fn(),
+    getGlobalExecutionLogWithAuth: jest.fn(),
   };
   return mocked;
 };
diff --git a/x-pack/plugins/actions/server/actions_client.test.ts b/x-pack/plugins/actions/server/actions_client.test.ts
index 017b8f4d1b5ea4..a164058d3b87db 100644
--- a/x-pack/plugins/actions/server/actions_client.test.ts
+++ b/x-pack/plugins/actions/server/actions_client.test.ts
@@ -44,6 +44,8 @@ import { inMemoryMetricsMock } from './monitoring/in_memory_metrics.mock';
 import { getOAuthJwtAccessToken } from './lib/get_oauth_jwt_access_token';
 import { getOAuthClientCredentialsAccessToken } from './lib/get_oauth_client_credentials_access_token';
 import { OAuthParams } from './routes/get_oauth_access_token';
+import { eventLogClientMock } from '@kbn/event-log-plugin/server/event_log_client.mock';
+import { GetGlobalExecutionKPIParams, GetGlobalExecutionLogParams } from '../common';
 
 jest.mock('@kbn/core-saved-objects-utils-server', () => {
   const actual = jest.requireActual('@kbn/core-saved-objects-utils-server');
@@ -81,6 +83,10 @@ jest.mock('./lib/get_oauth_client_credentials_access_token', () => ({
   getOAuthClientCredentialsAccessToken: jest.fn(),
 }));
 
+jest.mock('uuid', () => ({
+  v4: () => 'uuidv4',
+}));
+
 const defaultKibanaIndex = '.kibana';
 const unsecuredSavedObjectsClient = savedObjectsClientMock.create();
 const scopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
@@ -96,6 +102,8 @@ const mockUsageCounter = mockUsageCountersSetup.createUsageCounter('test');
 const logger = loggingSystemMock.create().get() as jest.Mocked<Logger>;
 const mockTaskManager = taskManagerMock.createSetup();
 const configurationUtilities = actionsConfigMock.create();
+const eventLogClient = eventLogClientMock.create();
+const getEventLogClient = jest.fn();
 
 let actionsClient: ActionsClient;
 let mockedLicenseState: jest.Mocked<ILicenseState>;
@@ -139,11 +147,13 @@ beforeEach(() => {
     auditLogger,
     usageCounter: mockUsageCounter,
     connectorTokenClient,
+    getEventLogClient,
   });
   (getOAuthJwtAccessToken as jest.Mock).mockResolvedValue(`Bearer jwttokentokentoken`);
   (getOAuthClientCredentialsAccessToken as jest.Mock).mockResolvedValue(
     `Bearer clienttokentokentoken`
   );
+  getEventLogClient.mockResolvedValue(eventLogClient);
 });
 
 describe('create()', () => {
@@ -566,6 +576,7 @@ describe('create()', () => {
       request,
       authorization: authorization as unknown as ActionsAuthorization,
       connectorTokenClient: connectorTokenClientMock.create(),
+      getEventLogClient,
     });
 
     const savedObjectCreateResult = {
@@ -687,6 +698,7 @@ describe('get()', () => {
           },
         ],
         connectorTokenClient: connectorTokenClientMock.create(),
+        getEventLogClient,
       });
 
       await actionsClient.get({ id: 'testPreconfigured' });
@@ -747,6 +759,7 @@ describe('get()', () => {
           },
         ],
         connectorTokenClient: connectorTokenClientMock.create(),
+        getEventLogClient,
       });
 
       authorization.ensureAuthorized.mockRejectedValue(
@@ -869,6 +882,7 @@ describe('get()', () => {
         },
       ],
       connectorTokenClient: connectorTokenClientMock.create(),
+      getEventLogClient,
     });
 
     const result = await actionsClient.get({ id: 'testPreconfigured' });
@@ -942,6 +956,7 @@ describe('getAll()', () => {
           },
         ],
         connectorTokenClient: connectorTokenClientMock.create(),
+        getEventLogClient,
       });
       return actionsClient.getAll();
     }
@@ -1084,6 +1099,7 @@ describe('getAll()', () => {
         },
       ],
       connectorTokenClient: connectorTokenClientMock.create(),
+      getEventLogClient,
     });
     const result = await actionsClient.getAll();
     expect(result).toEqual([
@@ -1166,6 +1182,7 @@ describe('getBulk()', () => {
           },
         ],
         connectorTokenClient: connectorTokenClientMock.create(),
+        getEventLogClient,
       });
       return actionsClient.getBulk(['1', 'testPreconfigured']);
     }
@@ -1302,6 +1319,7 @@ describe('getBulk()', () => {
         },
       ],
       connectorTokenClient: connectorTokenClientMock.create(),
+      getEventLogClient,
     });
     const result = await actionsClient.getBulk(['1', 'testPreconfigured']);
     expect(result).toEqual([
@@ -1361,6 +1379,7 @@ describe('getOAuthAccessToken()', () => {
         },
       ],
       connectorTokenClient: connectorTokenClientMock.create(),
+      getEventLogClient,
     });
     return actionsClient.getOAuthAccessToken(requestBody, configurationUtilities);
   }
@@ -2194,6 +2213,7 @@ describe('execute()', () => {
 
   test('calls the actionExecutor with the appropriate parameters', async () => {
     const actionId = uuidv4();
+    const actionExecutionId = uuidv4();
     actionExecutor.execute.mockResolvedValue({ status: 'ok', actionId });
     await expect(
       actionsClient.execute({
@@ -2210,6 +2230,7 @@ describe('execute()', () => {
       params: {
         name: 'my name',
       },
+      actionExecutionId,
     });
 
     await expect(
@@ -2241,6 +2262,7 @@ describe('execute()', () => {
           type: 'some-type',
         },
       ],
+      actionExecutionId,
     });
 
     await expect(
@@ -2274,6 +2296,7 @@ describe('execute()', () => {
           namespace: 'some-namespace',
         },
       ],
+      actionExecutionId,
     });
   });
 });
@@ -2525,6 +2548,7 @@ describe('isPreconfigured()', () => {
         encryptedSavedObjectsClient: encryptedSavedObjectsMock.createClient(),
         logger,
       }),
+      getEventLogClient,
     });
 
     expect(actionsClient.isPreconfigured('testPreconfigured')).toEqual(true);
@@ -2563,8 +2587,125 @@ describe('isPreconfigured()', () => {
         encryptedSavedObjectsClient: encryptedSavedObjectsMock.createClient(),
         logger,
       }),
+      getEventLogClient,
     });
 
     expect(actionsClient.isPreconfigured(uuidv4())).toEqual(false);
   });
 });
+
+describe('getGlobalExecutionLogWithAuth()', () => {
+  const opts: GetGlobalExecutionLogParams = {
+    dateStart: '2023-01-09T08:55:56-08:00',
+    dateEnd: '2023-01-10T08:55:56-08:00',
+    page: 1,
+    perPage: 50,
+    sort: [{ timestamp: { order: 'desc' } }],
+  };
+  const results = {
+    aggregations: {
+      executionLogAgg: {
+        doc_count: 5,
+        executionUuid: {
+          doc_count_error_upper_bound: 0,
+          sum_other_doc_count: 0,
+          buckets: [],
+        },
+        executionUuidCardinality: { doc_count: 5, executionUuidCardinality: { value: 5 } },
+      },
+    },
+  };
+  describe('authorization', () => {
+    test('ensures user is authorised to access logs', async () => {
+      eventLogClient.aggregateEventsWithAuthFilter.mockResolvedValue(results);
+
+      (getAuthorizationModeBySource as jest.Mock).mockImplementationOnce(() => {
+        return AuthorizationMode.RBAC;
+      });
+      await actionsClient.getGlobalExecutionLogWithAuth(opts);
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+
+    test('throws when user is not authorised to access logs', async () => {
+      (getAuthorizationModeBySource as jest.Mock).mockImplementationOnce(() => {
+        return AuthorizationMode.RBAC;
+      });
+      authorization.ensureAuthorized.mockRejectedValue(new Error(`Unauthorized to access logs`));
+
+      await expect(actionsClient.getGlobalExecutionLogWithAuth(opts)).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to access logs]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+  });
+
+  test('calls the eventLogClient with the appropriate parameters', async () => {
+    eventLogClient.aggregateEventsWithAuthFilter.mockResolvedValue(results);
+
+    await expect(actionsClient.getGlobalExecutionLogWithAuth(opts)).resolves.toMatchInlineSnapshot(`
+      Object {
+        "data": Array [],
+        "total": 5,
+      }
+    `);
+    expect(eventLogClient.aggregateEventsWithAuthFilter).toHaveBeenCalled();
+  });
+});
+
+describe('getGlobalExecutionKpiWithAuth()', () => {
+  const opts: GetGlobalExecutionKPIParams = {
+    dateStart: '2023-01-09T08:55:56-08:00',
+    dateEnd: '2023-01-10T08:55:56-08:00',
+  };
+  const results = {
+    aggregations: {
+      executionKpiAgg: {
+        doc_count: 5,
+        executionUuid: {
+          doc_count_error_upper_bound: 0,
+          sum_other_doc_count: 0,
+          buckets: [],
+        },
+      },
+    },
+  };
+  describe('authorization', () => {
+    test('ensures user is authorised to access kpi', async () => {
+      eventLogClient.aggregateEventsWithAuthFilter.mockResolvedValue(results);
+
+      (getAuthorizationModeBySource as jest.Mock).mockImplementationOnce(() => {
+        return AuthorizationMode.RBAC;
+      });
+      await actionsClient.getGlobalExecutionKpiWithAuth(opts);
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+
+    test('throws when user is not authorised to access kpi', async () => {
+      (getAuthorizationModeBySource as jest.Mock).mockImplementationOnce(() => {
+        return AuthorizationMode.RBAC;
+      });
+      authorization.ensureAuthorized.mockRejectedValue(new Error(`Unauthorized to access kpi`));
+
+      await expect(actionsClient.getGlobalExecutionKpiWithAuth(opts)).rejects.toMatchInlineSnapshot(
+        `[Error: Unauthorized to access kpi]`
+      );
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('get');
+    });
+  });
+
+  test('calls the eventLogClient with the appropriate parameters', async () => {
+    eventLogClient.aggregateEventsWithAuthFilter.mockResolvedValue(results);
+
+    await expect(actionsClient.getGlobalExecutionKpiWithAuth(opts)).resolves.toMatchInlineSnapshot(`
+      Object {
+        "failure": 0,
+        "success": 0,
+        "unknown": 0,
+        "warning": 0,
+      }
+    `);
+    expect(eventLogClient.aggregateEventsWithAuthFilter).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/actions/server/actions_client.ts b/x-pack/plugins/actions/server/actions_client.ts
index 232d2920080233..867fc4f9c7e476 100644
--- a/x-pack/plugins/actions/server/actions_client.ts
+++ b/x-pack/plugins/actions/server/actions_client.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { v4 as uuidv4 } from 'uuid';
 import Boom from '@hapi/boom';
 import url from 'url';
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
@@ -23,7 +24,14 @@ import {
 } from '@kbn/core/server';
 import { AuditLogger } from '@kbn/security-plugin/server';
 import { RunNowResult } from '@kbn/task-manager-plugin/server';
-import { ActionType } from '../common';
+import { IEventLogClient } from '@kbn/event-log-plugin/server';
+import { KueryNode } from '@kbn/es-query';
+import {
+  ActionType,
+  GetGlobalExecutionKPIParams,
+  GetGlobalExecutionLogParams,
+  IExecutionLogResult,
+} from '../common';
 import { ActionTypeRegistry } from './action_type_registry';
 import {
   validateConfig,
@@ -31,6 +39,7 @@ import {
   ActionExecutorContract,
   validateConnector,
   ActionExecutionSource,
+  parseDate,
 } from './lib';
 import {
   ActionResult,
@@ -72,6 +81,13 @@ import {
   GetOAuthClientCredentialsConfig,
   GetOAuthClientCredentialsSecrets,
 } from './lib/get_oauth_client_credentials_access_token';
+import {
+  ACTION_FILTER,
+  formatExecutionKPIResult,
+  formatExecutionLogResult,
+  getExecutionKPIAggregation,
+  getExecutionLogAggregation,
+} from './lib/get_execution_log_aggregation';
 
 // We are assuming there won't be many actions. This is why we will load
 // all the actions in advance and assume the total count to not go over 10000.
@@ -108,6 +124,7 @@ interface ConstructorOptions {
   auditLogger?: AuditLogger;
   usageCounter?: UsageCounter;
   connectorTokenClient: ConnectorTokenClientContract;
+  getEventLogClient: () => Promise<IEventLogClient>;
 }
 
 export interface UpdateOptions {
@@ -131,6 +148,7 @@ export class ActionsClient {
   private readonly auditLogger?: AuditLogger;
   private readonly usageCounter?: UsageCounter;
   private readonly connectorTokenClient: ConnectorTokenClientContract;
+  private readonly getEventLogClient: () => Promise<IEventLogClient>;
 
   constructor({
     logger,
@@ -148,6 +166,7 @@ export class ActionsClient {
     auditLogger,
     usageCounter,
     connectorTokenClient,
+    getEventLogClient,
   }: ConstructorOptions) {
     this.logger = logger;
     this.actionTypeRegistry = actionTypeRegistry;
@@ -164,6 +183,7 @@ export class ActionsClient {
     this.auditLogger = auditLogger;
     this.usageCounter = usageCounter;
     this.connectorTokenClient = connectorTokenClient;
+    this.getEventLogClient = getEventLogClient;
   }
 
   /**
@@ -647,7 +667,9 @@ export class ActionsClient {
     params,
     source,
     relatedSavedObjects,
-  }: Omit<ExecuteOptions, 'request'>): Promise<ActionTypeExecutorResult<unknown>> {
+  }: Omit<ExecuteOptions, 'request' | 'actionExecutionId'>): Promise<
+    ActionTypeExecutorResult<unknown>
+  > {
     if (
       (await getAuthorizationModeBySource(this.unsecuredSavedObjectsClient, source)) ===
       AuthorizationMode.RBAC
@@ -656,12 +678,14 @@ export class ActionsClient {
     } else {
       trackLegacyRBACExemption('execute', this.usageCounter);
     }
+
     return this.actionExecutor.execute({
       actionId,
       params,
       source,
       request: this.request,
       relatedSavedObjects,
+      actionExecutionId: uuidv4(),
     });
   }
 
@@ -729,6 +753,126 @@ export class ActionsClient {
   public isPreconfigured(connectorId: string): boolean {
     return !!this.preconfiguredActions.find((preconfigured) => preconfigured.id === connectorId);
   }
+
+  public async getGlobalExecutionLogWithAuth({
+    dateStart,
+    dateEnd,
+    filter,
+    page,
+    perPage,
+    sort,
+    namespaces,
+  }: GetGlobalExecutionLogParams): Promise<IExecutionLogResult> {
+    this.logger.debug(`getGlobalExecutionLogWithAuth(): getting global execution log`);
+
+    const authorizationTuple = {} as KueryNode;
+    try {
+      await this.authorization.ensureAuthorized('get');
+    } catch (error) {
+      this.auditLogger?.log(
+        connectorAuditEvent({
+          action: ConnectorAuditAction.GET_GLOBAL_EXECUTION_LOG,
+          error,
+        })
+      );
+      throw error;
+    }
+
+    this.auditLogger?.log(
+      connectorAuditEvent({
+        action: ConnectorAuditAction.GET_GLOBAL_EXECUTION_LOG,
+      })
+    );
+
+    const dateNow = new Date();
+    const parsedDateStart = parseDate(dateStart, 'dateStart', dateNow);
+    const parsedDateEnd = parseDate(dateEnd, 'dateEnd', dateNow);
+
+    const eventLogClient = await this.getEventLogClient();
+
+    try {
+      const aggResult = await eventLogClient.aggregateEventsWithAuthFilter(
+        'action',
+        authorizationTuple,
+        {
+          start: parsedDateStart.toISOString(),
+          end: parsedDateEnd.toISOString(),
+          aggs: getExecutionLogAggregation({
+            filter: filter ? `${filter} AND (${ACTION_FILTER})` : ACTION_FILTER,
+            page,
+            perPage,
+            sort,
+          }),
+        },
+        namespaces,
+        true
+      );
+
+      return formatExecutionLogResult(aggResult);
+    } catch (err) {
+      this.logger.debug(
+        `actionsClient.getGlobalExecutionLogWithAuth(): error searching global event log: ${err.message}`
+      );
+      throw err;
+    }
+  }
+
+  public async getGlobalExecutionKpiWithAuth({
+    dateStart,
+    dateEnd,
+    filter,
+    namespaces,
+  }: GetGlobalExecutionKPIParams) {
+    this.logger.debug(`getGlobalExecutionKpiWithAuth(): getting global execution KPI`);
+
+    const authorizationTuple = {} as KueryNode;
+    try {
+      await this.authorization.ensureAuthorized('get');
+    } catch (error) {
+      this.auditLogger?.log(
+        connectorAuditEvent({
+          action: ConnectorAuditAction.GET_GLOBAL_EXECUTION_KPI,
+          error,
+        })
+      );
+      throw error;
+    }
+
+    this.auditLogger?.log(
+      connectorAuditEvent({
+        action: ConnectorAuditAction.GET_GLOBAL_EXECUTION_KPI,
+      })
+    );
+
+    const dateNow = new Date();
+    const parsedDateStart = parseDate(dateStart, 'dateStart', dateNow);
+    const parsedDateEnd = parseDate(dateEnd, 'dateEnd', dateNow);
+
+    const eventLogClient = await this.getEventLogClient();
+
+    try {
+      const aggResult = await eventLogClient.aggregateEventsWithAuthFilter(
+        'action',
+        authorizationTuple,
+        {
+          start: parsedDateStart.toISOString(),
+          end: parsedDateEnd.toISOString(),
+          aggs: getExecutionKPIAggregation(
+            filter ? `${filter} AND (${ACTION_FILTER})` : ACTION_FILTER
+          ),
+        },
+        namespaces,
+        true
+      );
+
+      return formatExecutionKPIResult(aggResult);
+    } catch (err) {
+      this.logger.debug(
+        `actionsClient.getGlobalExecutionKpiWithAuth(): error searching global execution KPI: ${err.message}`
+      );
+      throw err;
+    }
+  }
 }
 
 function actionFromSavedObject(
diff --git a/x-pack/plugins/actions/server/lib/action_executor.test.ts b/x-pack/plugins/actions/server/lib/action_executor.test.ts
index 4fde645fb367eb..ecb99eaf9d852a 100644
--- a/x-pack/plugins/actions/server/lib/action_executor.test.ts
+++ b/x-pack/plugins/actions/server/lib/action_executor.test.ts
@@ -32,6 +32,7 @@ const executeParams = {
   },
   executionId: '123abc',
   request: {} as KibanaRequest,
+  actionExecutionId: '2',
 };
 
 const spacesMock = spacesServiceMock.createStartContract();
@@ -139,6 +140,13 @@ test('successfully executes', async () => {
             "kind": "action",
           },
           "kibana": Object {
+            "action": Object {
+              "execution": Object {
+                "uuid": "2",
+              },
+              "id": "1",
+              "name": "1",
+            },
             "alert": Object {
               "rule": Object {
                 "execution": Object {
@@ -170,6 +178,13 @@ test('successfully executes', async () => {
             "outcome": "success",
           },
           "kibana": Object {
+            "action": Object {
+              "execution": Object {
+                "uuid": "2",
+              },
+              "id": "1",
+              "name": "1",
+            },
             "alert": Object {
               "rule": Object {
                 "execution": Object {
@@ -240,6 +255,13 @@ test('successfully executes with preconfigured connector', async () => {
             "kind": "action",
           },
           "kibana": Object {
+            "action": Object {
+              "execution": Object {
+                "uuid": "2",
+              },
+              "id": "preconfigured",
+              "name": "Preconfigured",
+            },
             "alert": Object {
               "rule": Object {
                 "execution": Object {
@@ -252,6 +274,7 @@ test('successfully executes with preconfigured connector', async () => {
                 "id": "preconfigured",
                 "namespace": "some-namespace",
                 "rel": "primary",
+                "space_agnostic": true,
                 "type": "action",
                 "type_id": "test",
               },
@@ -271,6 +294,13 @@ test('successfully executes with preconfigured connector', async () => {
             "outcome": "success",
           },
           "kibana": Object {
+            "action": Object {
+              "execution": Object {
+                "uuid": "2",
+              },
+              "id": "preconfigured",
+              "name": "Preconfigured",
+            },
             "alert": Object {
               "rule": Object {
                 "execution": Object {
@@ -283,6 +313,7 @@ test('successfully executes with preconfigured connector', async () => {
                 "id": "preconfigured",
                 "namespace": "some-namespace",
                 "rel": "primary",
+                "space_agnostic": true,
                 "type": "action",
                 "type_id": "test",
               },
@@ -692,6 +723,13 @@ test('should not throw error if action is preconfigured and isESOCanEncrypt is f
             "kind": "action",
           },
           "kibana": Object {
+            "action": Object {
+              "execution": Object {
+                "uuid": "2",
+              },
+              "id": "preconfigured",
+              "name": "Preconfigured",
+            },
             "alert": Object {
               "rule": Object {
                 "execution": Object {
@@ -704,6 +742,7 @@ test('should not throw error if action is preconfigured and isESOCanEncrypt is f
                 "id": "preconfigured",
                 "namespace": "some-namespace",
                 "rel": "primary",
+                "space_agnostic": true,
                 "type": "action",
                 "type_id": "test",
               },
@@ -723,6 +762,13 @@ test('should not throw error if action is preconfigured and isESOCanEncrypt is f
             "outcome": "success",
           },
           "kibana": Object {
+            "action": Object {
+              "execution": Object {
+                "uuid": "2",
+              },
+              "id": "preconfigured",
+              "name": "Preconfigured",
+            },
             "alert": Object {
               "rule": Object {
                 "execution": Object {
@@ -735,6 +781,7 @@ test('should not throw error if action is preconfigured and isESOCanEncrypt is f
                 "id": "preconfigured",
                 "namespace": "some-namespace",
                 "rel": "primary",
+                "space_agnostic": true,
                 "type": "action",
                 "type_id": "test",
               },
@@ -815,6 +862,7 @@ test('writes to event log for execute timeout', async () => {
     consumer: 'test-consumer',
     relatedSavedObjects: [],
     request: {} as KibanaRequest,
+    actionExecutionId: '2',
   });
   expect(eventLogger.logEvent).toHaveBeenCalledTimes(1);
   expect(eventLogger.logEvent).toHaveBeenNthCalledWith(1, {
@@ -823,6 +871,13 @@ test('writes to event log for execute timeout', async () => {
       kind: 'action',
     },
     kibana: {
+      action: {
+        execution: {
+          uuid: '2',
+        },
+        name: undefined,
+        id: 'action1',
+      },
       alert: {
         rule: {
           consumer: 'test-consumer',
@@ -833,16 +888,17 @@ test('writes to event log for execute timeout', async () => {
       },
       saved_objects: [
         {
+          id: 'action1',
+          namespace: 'some-namespace',
           rel: 'primary',
           type: 'action',
-          id: 'action1',
           type_id: 'test',
-          namespace: 'some-namespace',
         },
       ],
       space_ids: ['some-namespace'],
     },
-    message: `action: test:action1: 'action-1' execution cancelled due to timeout - exceeded default timeout of "5m"`,
+    message:
+      'action: test:action1: \'action-1\' execution cancelled due to timeout - exceeded default timeout of "5m"',
   });
 });
 
@@ -860,33 +916,13 @@ test('writes to event log for execute and execute start', async () => {
       kind: 'action',
     },
     kibana: {
-      alert: {
-        rule: {
-          execution: {
-            uuid: '123abc',
-          },
+      action: {
+        execution: {
+          uuid: '2',
         },
+        name: 'action-1',
+        id: '1',
       },
-      saved_objects: [
-        {
-          rel: 'primary',
-          type: 'action',
-          id: '1',
-          type_id: 'test',
-          namespace: 'some-namespace',
-        },
-      ],
-      space_ids: ['some-namespace'],
-    },
-    message: 'action started: test:1: action-1',
-  });
-  expect(eventLogger.logEvent).toHaveBeenNthCalledWith(2, {
-    event: {
-      action: 'execute',
-      kind: 'action',
-      outcome: 'success',
-    },
-    kibana: {
       alert: {
         rule: {
           execution: {
@@ -896,16 +932,16 @@ test('writes to event log for execute and execute start', async () => {
       },
       saved_objects: [
         {
+          id: '1',
+          namespace: 'some-namespace',
           rel: 'primary',
           type: 'action',
-          id: '1',
           type_id: 'test',
-          namespace: 'some-namespace',
         },
       ],
       space_ids: ['some-namespace'],
     },
-    message: 'action executed: test:1: action-1',
+    message: 'action started: test:1: action-1',
   });
 });
 
@@ -933,41 +969,13 @@ test('writes to event log for execute and execute start when consumer and relate
       kind: 'action',
     },
     kibana: {
-      alert: {
-        rule: {
-          consumer: 'test-consumer',
-          execution: {
-            uuid: '123abc',
-          },
-          rule_type_id: '.rule-type',
+      action: {
+        execution: {
+          uuid: '2',
         },
+        name: 'action-1',
+        id: '1',
       },
-      saved_objects: [
-        {
-          rel: 'primary',
-          type: 'action',
-          id: '1',
-          type_id: 'test',
-          namespace: 'some-namespace',
-        },
-        {
-          rel: 'primary',
-          type: 'alert',
-          id: '12',
-          type_id: '.rule-type',
-        },
-      ],
-      space_ids: ['some-namespace'],
-    },
-    message: 'action started: test:1: action-1',
-  });
-  expect(eventLogger.logEvent).toHaveBeenNthCalledWith(2, {
-    event: {
-      action: 'execute',
-      kind: 'action',
-      outcome: 'success',
-    },
-    kibana: {
       alert: {
         rule: {
           consumer: 'test-consumer',
@@ -979,22 +987,23 @@ test('writes to event log for execute and execute start when consumer and relate
       },
       saved_objects: [
         {
+          id: '1',
+          namespace: 'some-namespace',
           rel: 'primary',
           type: 'action',
-          id: '1',
           type_id: 'test',
-          namespace: 'some-namespace',
         },
         {
+          id: '12',
+          namespace: undefined,
           rel: 'primary',
           type: 'alert',
-          id: '12',
           type_id: '.rule-type',
         },
       ],
       space_ids: ['some-namespace'],
     },
-    message: 'action executed: test:1: action-1',
+    message: 'action started: test:1: action-1',
   });
 });
 
diff --git a/x-pack/plugins/actions/server/lib/action_executor.ts b/x-pack/plugins/actions/server/lib/action_executor.ts
index 42e5c8c8e1a999..36212bc9ae042c 100644
--- a/x-pack/plugins/actions/server/lib/action_executor.ts
+++ b/x-pack/plugins/actions/server/lib/action_executor.ts
@@ -59,6 +59,7 @@ export interface TaskInfo {
 
 export interface ExecuteOptions<Source = unknown> {
   actionId: string;
+  actionExecutionId: string;
   isEphemeral?: boolean;
   request: KibanaRequest;
   params: Record<string, unknown>;
@@ -100,6 +101,7 @@ export class ActionExecutor {
     executionId,
     consumer,
     relatedSavedObjects,
+    actionExecutionId,
   }: ExecuteOptions): Promise<ActionTypeExecutorResult<unknown>> {
     if (!this.isInitialized) {
       throw new Error('ActionExecutor not initialized');
@@ -189,6 +191,9 @@ export class ActionExecutor {
             },
           ],
           relatedSavedObjects,
+          name,
+          actionExecutionId,
+          isPreconfigured: this.actionInfo.isPreconfigured,
         });
 
         eventLogger.startTiming(event);
@@ -297,8 +302,10 @@ export class ActionExecutor {
     executionId,
     taskInfo,
     consumer,
+    actionExecutionId,
   }: {
     actionId: string;
+    actionExecutionId: string;
     request: KibanaRequest;
     taskInfo?: TaskInfo;
     executionId?: string;
@@ -357,6 +364,8 @@ export class ActionExecutor {
         },
       ],
       relatedSavedObjects,
+      actionExecutionId,
+      isPreconfigured: this.actionInfo.isPreconfigured,
     });
 
     eventLogger.logEvent(event);
@@ -369,6 +378,7 @@ interface ActionInfo {
   config: unknown;
   secrets: unknown;
   actionId: string;
+  isPreconfigured?: boolean;
 }
 
 async function getActionInfoInternal<Source = unknown>(
@@ -395,6 +405,7 @@ async function getActionInfoInternal<Source = unknown>(
       config: pcAction.config,
       secrets: pcAction.secrets,
       actionId,
+      isPreconfigured: true,
     };
   }
 
diff --git a/x-pack/plugins/actions/server/lib/audit_events.ts b/x-pack/plugins/actions/server/lib/audit_events.ts
index 2ad012c6e64738..5c2cf6fb7cc084 100644
--- a/x-pack/plugins/actions/server/lib/audit_events.ts
+++ b/x-pack/plugins/actions/server/lib/audit_events.ts
@@ -15,6 +15,8 @@ export enum ConnectorAuditAction {
   DELETE = 'connector_delete',
   FIND = 'connector_find',
   EXECUTE = 'connector_execute',
+  GET_GLOBAL_EXECUTION_LOG = 'connector_get_global_execution_log',
+  GET_GLOBAL_EXECUTION_KPI = 'connector_get_global_execution_kpi',
 }
 
 type VerbsTuple = [string, string, string];
@@ -26,6 +28,8 @@ const eventVerbs: Record<ConnectorAuditAction, VerbsTuple> = {
   connector_delete: ['delete', 'deleting', 'deleted'],
   connector_find: ['access', 'accessing', 'accessed'],
   connector_execute: ['execute', 'executing', 'executed'],
+  connector_get_global_execution_log: ['access', 'accessing', 'accessed'],
+  connector_get_global_execution_kpi: ['access', 'accessing', 'accessed'],
 };
 
 const eventTypes: Record<ConnectorAuditAction, EcsEventType | undefined> = {
@@ -35,6 +39,8 @@ const eventTypes: Record<ConnectorAuditAction, EcsEventType | undefined> = {
   connector_delete: 'deletion',
   connector_find: 'access',
   connector_execute: undefined,
+  connector_get_global_execution_log: 'access',
+  connector_get_global_execution_kpi: 'access',
 };
 
 export interface ConnectorAuditEventParams {
diff --git a/x-pack/plugins/actions/server/lib/create_action_event_log_record_object.test.ts b/x-pack/plugins/actions/server/lib/create_action_event_log_record_object.test.ts
index 69eca915cc721d..58a21c911cf34e 100644
--- a/x-pack/plugins/actions/server/lib/create_action_event_log_record_object.test.ts
+++ b/x-pack/plugins/actions/server/lib/create_action_event_log_record_object.test.ts
@@ -29,6 +29,8 @@ describe('createActionEventLogRecordObject', () => {
           },
         ],
         spaceId: 'default',
+        name: 'test name',
+        actionExecutionId: '123abc',
       })
     ).toStrictEqual({
       '@timestamp': '1970-01-01T00:00:00.000Z',
@@ -58,6 +60,13 @@ describe('createActionEventLogRecordObject', () => {
           schedule_delay: 0,
           scheduled: '1970-01-01T00:00:00.000Z',
         },
+        action: {
+          name: 'test name',
+          id: '1',
+          execution: {
+            uuid: '123abc',
+          },
+        },
       },
     });
   });
@@ -80,6 +89,7 @@ describe('createActionEventLogRecordObject', () => {
             relation: 'primary',
           },
         ],
+        actionExecutionId: '123abc',
       })
     ).toStrictEqual({
       event: {
@@ -104,6 +114,13 @@ describe('createActionEventLogRecordObject', () => {
             type_id: '.email',
           },
         ],
+        action: {
+          name: 'test name',
+          id: '1',
+          execution: {
+            uuid: '123abc',
+          },
+        },
       },
       message: 'action execution start',
     });
@@ -125,6 +142,7 @@ describe('createActionEventLogRecordObject', () => {
             relation: 'primary',
           },
         ],
+        actionExecutionId: '123abc',
       })
     ).toStrictEqual({
       event: {
@@ -141,6 +159,13 @@ describe('createActionEventLogRecordObject', () => {
             type_id: '.email',
           },
         ],
+        action: {
+          name: 'test name',
+          id: '1',
+          execution: {
+            uuid: '123abc',
+          },
+        },
       },
       message: 'action execution start',
     });
@@ -163,6 +188,8 @@ describe('createActionEventLogRecordObject', () => {
             relation: 'primary',
           },
         ],
+        name: 'test name',
+        actionExecutionId: '123abc',
       })
     ).toStrictEqual({
       event: {
@@ -189,6 +216,13 @@ describe('createActionEventLogRecordObject', () => {
           schedule_delay: undefined,
           scheduled: '1970-01-01T00:00:00.000Z',
         },
+        action: {
+          name: 'test name',
+          id: '1',
+          execution: {
+            uuid: '123abc',
+          },
+        },
       },
     });
   });
@@ -218,6 +252,7 @@ describe('createActionEventLogRecordObject', () => {
             id: '123',
           },
         ],
+        actionExecutionId: '123abc',
       })
     ).toStrictEqual({
       event: {
@@ -250,6 +285,70 @@ describe('createActionEventLogRecordObject', () => {
             type_id: '.rule-type',
           },
         ],
+        action: {
+          name: 'test name',
+          id: '1',
+          execution: {
+            uuid: '123abc',
+          },
+        },
+      },
+      message: 'action execution start',
+    });
+  });
+
+  test('created action event "execute" for preconfigured connector with space_agnostic true', async () => {
+    expect(
+      createActionEventLogRecordObject({
+        actionId: '1',
+        name: 'test name',
+        action: 'execute',
+        message: 'action execution start',
+        namespace: 'default',
+        executionId: '123abc',
+        consumer: 'test-consumer',
+        savedObjects: [
+          {
+            id: '2',
+            type: 'action',
+            typeId: '.email',
+            relation: 'primary',
+          },
+        ],
+        actionExecutionId: '123abc',
+        isPreconfigured: true,
+      })
+    ).toStrictEqual({
+      event: {
+        action: 'execute',
+        kind: 'action',
+      },
+      kibana: {
+        alert: {
+          rule: {
+            consumer: 'test-consumer',
+            execution: {
+              uuid: '123abc',
+            },
+          },
+        },
+        saved_objects: [
+          {
+            id: '2',
+            namespace: 'default',
+            rel: 'primary',
+            type: 'action',
+            type_id: '.email',
+            space_agnostic: true,
+          },
+        ],
+        action: {
+          name: 'test name',
+          id: '1',
+          execution: {
+            uuid: '123abc',
+          },
+        },
       },
       message: 'action execution start',
     });
diff --git a/x-pack/plugins/actions/server/lib/create_action_event_log_record_object.ts b/x-pack/plugins/actions/server/lib/create_action_event_log_record_object.ts
index 2632ead26a4770..d3ad7c1ae30060 100644
--- a/x-pack/plugins/actions/server/lib/create_action_event_log_record_object.ts
+++ b/x-pack/plugins/actions/server/lib/create_action_event_log_record_object.ts
@@ -14,6 +14,7 @@ export type Event = Exclude<IEvent, undefined>;
 interface CreateActionEventLogRecordParams {
   actionId: string;
   action: string;
+  actionExecutionId: string;
   name?: string;
   message?: string;
   namespace?: string;
@@ -32,11 +33,24 @@ interface CreateActionEventLogRecordParams {
     relation?: string;
   }>;
   relatedSavedObjects?: RelatedSavedObjects;
+  isPreconfigured?: boolean;
 }
 
 export function createActionEventLogRecordObject(params: CreateActionEventLogRecordParams): Event {
-  const { action, message, task, namespace, executionId, spaceId, consumer, relatedSavedObjects } =
-    params;
+  const {
+    action,
+    message,
+    task,
+    namespace,
+    executionId,
+    spaceId,
+    consumer,
+    relatedSavedObjects,
+    name,
+    actionExecutionId,
+    isPreconfigured,
+    actionId,
+  } = params;
 
   const kibanaAlertRule = {
     ...(consumer ? { consumer } : {}),
@@ -62,10 +76,19 @@ export function createActionEventLogRecordObject(params: CreateActionEventLogRec
         type: so.type,
         id: so.id,
         type_id: so.typeId,
+        // set space_agnostic to true for preconfigured connectors
+        ...(so.type === 'action' && isPreconfigured ? { space_agnostic: isPreconfigured } : {}),
         ...(namespace ? { namespace } : {}),
       })),
       ...(spaceId ? { space_ids: [spaceId] } : {}),
       ...(task ? { task: { scheduled: task.scheduled, schedule_delay: task.scheduleDelay } } : {}),
+      action: {
+        ...(name ? { name } : {}),
+        id: actionId,
+        execution: {
+          uuid: actionExecutionId,
+        },
+      },
     },
     ...(message ? { message } : {}),
   };
diff --git a/x-pack/plugins/actions/server/lib/get_execution_log_aggregation.test.ts b/x-pack/plugins/actions/server/lib/get_execution_log_aggregation.test.ts
new file mode 100644
index 00000000000000..c92f4be981795d
--- /dev/null
+++ b/x-pack/plugins/actions/server/lib/get_execution_log_aggregation.test.ts
@@ -0,0 +1,945 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { fromKueryExpression } from '@kbn/es-query';
+import {
+  getExecutionLogAggregation,
+  formatExecutionLogResult,
+  ExecutionUuidAggResult,
+  getExecutionKPIAggregation,
+  formatExecutionKPIResult,
+} from './get_execution_log_aggregation';
+
+describe('getExecutionLogAggregation', () => {
+  test('should throw error when given bad sort field', () => {
+    expect(() => {
+      getExecutionLogAggregation({
+        page: 1,
+        perPage: 10,
+        sort: [{ notsortable: { order: 'asc' } }],
+      });
+    }).toThrowErrorMatchingInlineSnapshot(
+      `"Invalid sort field \\"notsortable\\" - must be one of [timestamp,execution_duration,schedule_delay]"`
+    );
+  });
+
+  test('should throw error when given one bad sort field', () => {
+    expect(() => {
+      getExecutionLogAggregation({
+        page: 1,
+        perPage: 10,
+        sort: [{ notsortable: { order: 'asc' } }, { timestamp: { order: 'asc' } }],
+      });
+    }).toThrowErrorMatchingInlineSnapshot(
+      `"Invalid sort field \\"notsortable\\" - must be one of [timestamp,execution_duration,schedule_delay]"`
+    );
+  });
+
+  test('should throw error when given bad page field', () => {
+    expect(() => {
+      getExecutionLogAggregation({
+        page: 0,
+        perPage: 10,
+        sort: [{ timestamp: { order: 'asc' } }],
+      });
+    }).toThrowErrorMatchingInlineSnapshot(`"Invalid page field \\"0\\" - must be greater than 0"`);
+  });
+
+  test('should throw error when given bad perPage field', () => {
+    expect(() => {
+      getExecutionLogAggregation({
+        page: 1,
+        perPage: 0,
+        sort: [{ timestamp: { order: 'asc' } }],
+      });
+    }).toThrowErrorMatchingInlineSnapshot(
+      `"Invalid perPage field \\"0\\" - must be greater than 0"`
+    );
+  });
+
+  test('should correctly generate aggregation', () => {
+    expect(
+      getExecutionLogAggregation({
+        page: 2,
+        perPage: 10,
+        sort: [{ timestamp: { order: 'asc' } }, { execution_duration: { order: 'desc' } }],
+      })
+    ).toEqual({
+      executionLogAgg: {
+        aggs: {
+          executionUuid: {
+            aggs: {
+              actionExecution: {
+                aggs: {
+                  executeStartTime: {
+                    min: {
+                      field: 'event.start',
+                    },
+                  },
+                  executionDuration: {
+                    max: {
+                      field: 'event.duration',
+                    },
+                  },
+                  outcomeAndMessage: {
+                    top_hits: {
+                      _source: {
+                        includes: [
+                          'event.outcome',
+                          'message',
+                          'error.message',
+                          'kibana.version',
+                          'kibana.space_ids',
+                          'kibana.action.name',
+                          'kibana.action.id',
+                        ],
+                      },
+                    },
+                  },
+                  scheduleDelay: {
+                    max: {
+                      field: 'kibana.task.schedule_delay',
+                    },
+                  },
+                },
+                filter: {
+                  bool: {
+                    must: [
+                      {
+                        match: {
+                          'event.action': 'execute',
+                        },
+                      },
+                    ],
+                  },
+                },
+              },
+              executionUuidSorted: {
+                bucket_sort: {
+                  from: 10,
+                  gap_policy: 'insert_zeros',
+                  size: 10,
+                  sort: [
+                    {
+                      'actionExecution>executeStartTime': {
+                        order: 'asc',
+                      },
+                    },
+                    {
+                      'actionExecution>executionDuration': {
+                        order: 'desc',
+                      },
+                    },
+                  ],
+                },
+              },
+              timeoutMessage: {
+                filter: {
+                  bool: {
+                    must: [
+                      {
+                        match: {
+                          'event.action': 'execute-timeout',
+                        },
+                      },
+                    ],
+                  },
+                },
+              },
+            },
+            terms: {
+              field: 'kibana.action.execution.uuid',
+              order: [
+                {
+                  'actionExecution>executeStartTime': 'asc',
+                },
+                {
+                  'actionExecution>executionDuration': 'desc',
+                },
+              ],
+              size: 1000,
+            },
+          },
+          executionUuidCardinality: {
+            aggs: {
+              executionUuidCardinality: {
+                cardinality: {
+                  field: 'kibana.action.execution.uuid',
+                },
+              },
+            },
+            filter: {
+              bool: {
+                must: [
+                  {
+                    match: {
+                      'event.action': 'execute',
+                    },
+                  },
+                ],
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+
+  test('should correctly generate aggregation with a defined filter in the form of a string', () => {
+    expect(
+      getExecutionLogAggregation({
+        page: 2,
+        perPage: 10,
+        sort: [{ timestamp: { order: 'asc' } }, { execution_duration: { order: 'desc' } }],
+        filter: 'test:test',
+      })
+    ).toEqual({
+      executionLogAgg: {
+        aggs: {
+          executionUuid: {
+            aggs: {
+              actionExecution: {
+                aggs: {
+                  executeStartTime: {
+                    min: {
+                      field: 'event.start',
+                    },
+                  },
+                  executionDuration: {
+                    max: {
+                      field: 'event.duration',
+                    },
+                  },
+                  outcomeAndMessage: {
+                    top_hits: {
+                      _source: {
+                        includes: [
+                          'event.outcome',
+                          'message',
+                          'error.message',
+                          'kibana.version',
+                          'kibana.space_ids',
+                          'kibana.action.name',
+                          'kibana.action.id',
+                        ],
+                      },
+                    },
+                  },
+                  scheduleDelay: {
+                    max: {
+                      field: 'kibana.task.schedule_delay',
+                    },
+                  },
+                },
+                filter: {
+                  bool: {
+                    must: [
+                      {
+                        match: {
+                          'event.action': 'execute',
+                        },
+                      },
+                    ],
+                  },
+                },
+              },
+              executionUuidSorted: {
+                bucket_sort: {
+                  from: 10,
+                  gap_policy: 'insert_zeros',
+                  size: 10,
+                  sort: [
+                    {
+                      'actionExecution>executeStartTime': {
+                        order: 'asc',
+                      },
+                    },
+                    {
+                      'actionExecution>executionDuration': {
+                        order: 'desc',
+                      },
+                    },
+                  ],
+                },
+              },
+              timeoutMessage: {
+                filter: {
+                  bool: {
+                    must: [
+                      {
+                        match: {
+                          'event.action': 'execute-timeout',
+                        },
+                      },
+                    ],
+                  },
+                },
+              },
+            },
+            terms: {
+              field: 'kibana.action.execution.uuid',
+              order: [
+                {
+                  'actionExecution>executeStartTime': 'asc',
+                },
+                {
+                  'actionExecution>executionDuration': 'desc',
+                },
+              ],
+              size: 1000,
+            },
+          },
+          executionUuidCardinality: {
+            aggs: {
+              executionUuidCardinality: {
+                cardinality: {
+                  field: 'kibana.action.execution.uuid',
+                },
+              },
+            },
+            filter: {
+              bool: {
+                must: [
+                  {
+                    match: {
+                      'event.action': 'execute',
+                    },
+                  },
+                ],
+              },
+            },
+          },
+        },
+        filter: {
+          bool: {
+            filter: {
+              bool: {
+                minimum_should_match: 1,
+                should: [
+                  {
+                    match: {
+                      test: 'test',
+                    },
+                  },
+                ],
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+
+  test('should correctly generate aggregation with a defined filter in the form of a KueryNode', () => {
+    expect(
+      getExecutionLogAggregation({
+        page: 2,
+        perPage: 10,
+        sort: [{ timestamp: { order: 'asc' } }, { execution_duration: { order: 'desc' } }],
+        filter: fromKueryExpression('test:test'),
+      })
+    ).toEqual({
+      executionLogAgg: {
+        aggs: {
+          executionUuid: {
+            aggs: {
+              actionExecution: {
+                aggs: {
+                  executeStartTime: {
+                    min: {
+                      field: 'event.start',
+                    },
+                  },
+                  executionDuration: {
+                    max: {
+                      field: 'event.duration',
+                    },
+                  },
+                  outcomeAndMessage: {
+                    top_hits: {
+                      _source: {
+                        includes: [
+                          'event.outcome',
+                          'message',
+                          'error.message',
+                          'kibana.version',
+                          'kibana.space_ids',
+                          'kibana.action.name',
+                          'kibana.action.id',
+                        ],
+                      },
+                    },
+                  },
+                  scheduleDelay: {
+                    max: {
+                      field: 'kibana.task.schedule_delay',
+                    },
+                  },
+                },
+                filter: {
+                  bool: {
+                    must: [
+                      {
+                        match: {
+                          'event.action': 'execute',
+                        },
+                      },
+                    ],
+                  },
+                },
+              },
+              executionUuidSorted: {
+                bucket_sort: {
+                  from: 10,
+                  gap_policy: 'insert_zeros',
+                  size: 10,
+                  sort: [
+                    {
+                      'actionExecution>executeStartTime': {
+                        order: 'asc',
+                      },
+                    },
+                    {
+                      'actionExecution>executionDuration': {
+                        order: 'desc',
+                      },
+                    },
+                  ],
+                },
+              },
+              timeoutMessage: {
+                filter: {
+                  bool: {
+                    must: [
+                      {
+                        match: {
+                          'event.action': 'execute-timeout',
+                        },
+                      },
+                    ],
+                  },
+                },
+              },
+            },
+            terms: {
+              field: 'kibana.action.execution.uuid',
+              order: [
+                {
+                  'actionExecution>executeStartTime': 'asc',
+                },
+                {
+                  'actionExecution>executionDuration': 'desc',
+                },
+              ],
+              size: 1000,
+            },
+          },
+          executionUuidCardinality: {
+            aggs: {
+              executionUuidCardinality: {
+                cardinality: {
+                  field: 'kibana.action.execution.uuid',
+                },
+              },
+            },
+            filter: {
+              bool: {
+                must: [
+                  {
+                    match: {
+                      'event.action': 'execute',
+                    },
+                  },
+                ],
+              },
+            },
+          },
+        },
+        filter: {
+          bool: {
+            filter: {
+              bool: {
+                minimum_should_match: 1,
+                should: [
+                  {
+                    match: {
+                      test: 'test',
+                    },
+                  },
+                ],
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+});
+
+describe('formatExecutionLogResult', () => {
+  test('should return empty results if aggregations are undefined', () => {
+    expect(formatExecutionLogResult({ aggregations: undefined })).toEqual({
+      total: 0,
+      data: [],
+    });
+  });
+  test('should return empty results if aggregations.executionLogAgg are undefined', () => {
+    expect(
+      formatExecutionLogResult({
+        aggregations: { executionLogAgg: undefined as unknown as ExecutionUuidAggResult },
+      })
+    ).toEqual({
+      total: 0,
+      data: [],
+    });
+  });
+  test('should format results correctly', () => {
+    const results = {
+      aggregations: {
+        executionLogAgg: {
+          doc_count: 5,
+          executionUuid: {
+            doc_count_error_upper_bound: 0,
+            sum_other_doc_count: 0,
+            buckets: [
+              {
+                key: '8b3af07e-7593-4c40-b704-9c06d3b06e58',
+                doc_count: 1,
+                actionExecution: {
+                  doc_count: 1,
+                  scheduleDelay: { value: 2783000000 },
+                  outcomeAndMessage: {
+                    hits: {
+                      total: { value: 1, relation: 'eq' },
+                      max_score: 3.033605,
+                      hits: [
+                        {
+                          _index: '.kibana-event-log-8.7.0-000001',
+                          _id: '5SmlgoUBAOza-PIJVKGD',
+                          _score: 3.033605,
+                          _source: {
+                            event: { outcome: 'success' },
+                            kibana: {
+                              space_ids: ['default'],
+                              version: '8.7.0',
+                              action: { name: 'test connector', id: '1' },
+                            },
+                            message:
+                              'action executed: .server-log:6709f660-8d11-11ed-bae5-bd32cbc9eaaa: test connector',
+                          },
+                        },
+                      ],
+                    },
+                  },
+                  executionDuration: { value: 1000000 },
+                  executeStartTime: {
+                    value: 1672934150495,
+                    value_as_string: '2023-01-05T15:55:50.495Z',
+                  },
+                },
+              },
+            ],
+          },
+          executionUuidCardinality: { doc_count: 1, executionUuidCardinality: { value: 1 } },
+        },
+      },
+    };
+    expect(formatExecutionLogResult(results)).toEqual({
+      data: [
+        {
+          connector_name: 'test connector',
+          connector_id: '1',
+          duration_ms: 1,
+          id: '8b3af07e-7593-4c40-b704-9c06d3b06e58',
+          message:
+            'action executed: .server-log:6709f660-8d11-11ed-bae5-bd32cbc9eaaa: test connector',
+          schedule_delay_ms: 2783,
+          space_ids: ['default'],
+          status: 'success',
+          timestamp: '2023-01-05T15:55:50.495Z',
+          version: '8.7.0',
+          timed_out: false,
+        },
+      ],
+      total: 1,
+    });
+  });
+
+  test('should format results correctly with action execution errors', () => {
+    const results = {
+      aggregations: {
+        executionLogAgg: {
+          doc_count: 10,
+          executionUuid: {
+            doc_count_error_upper_bound: 0,
+            sum_other_doc_count: 0,
+            buckets: [
+              {
+                key: 'fdf9cadb-4568-4d22-afd2-437e4efbe767',
+                doc_count: 1,
+                actionExecution: {
+                  doc_count: 1,
+                  scheduleDelay: { value: 2946000000 },
+                  outcomeAndMessage: {
+                    hits: {
+                      total: { value: 1, relation: 'eq' },
+                      max_score: 3.1420498,
+                      hits: [
+                        {
+                          _index: '.kibana-event-log-8.7.0-000001',
+                          _id: 'CSm_goUBAOza-PIJBaIn',
+                          _score: 3.1420498,
+                          _source: {
+                            event: { outcome: 'failure' },
+                            kibana: {
+                              space_ids: ['default'],
+                              version: '8.7.0',
+                              action: { name: 'test', id: '1' },
+                            },
+                            message:
+                              'action execution failure: .email:e020c620-8d14-11ed-bae5-bd32cbc9eaaa: test',
+                            error: {
+                              message:
+                                'action execution failure: .email:e020c620-8d14-11ed-bae5-bd32cbc9eaaa: test',
+                            },
+                          },
+                        },
+                      ],
+                    },
+                  },
+                  executionDuration: { value: 441000000 },
+                  executeStartTime: {
+                    value: 1672935833813,
+                    value_as_string: '2023-01-05T16:23:53.813Z',
+                  },
+                },
+              },
+              {
+                key: '8b3af07e-7593-4c40-b704-9c06d3b06e58',
+                doc_count: 1,
+                actionExecution: {
+                  doc_count: 1,
+                  scheduleDelay: { value: 2783000000 },
+                  outcomeAndMessage: {
+                    hits: {
+                      total: { value: 1, relation: 'eq' },
+                      max_score: 3.1420498,
+                      hits: [
+                        {
+                          _index: '.kibana-event-log-8.7.0-000001',
+                          _id: '5SmlgoUBAOza-PIJVKGD',
+                          _score: 3.1420498,
+                          _source: {
+                            event: { outcome: 'success' },
+                            kibana: {
+                              space_ids: ['default'],
+                              version: '8.7.0',
+                              action: { name: 'test connector', id: '1' },
+                            },
+                            message:
+                              'action executed: .server-log:6709f660-8d11-11ed-bae5-bd32cbc9eaaa: test connector',
+                          },
+                        },
+                      ],
+                    },
+                  },
+                  executionDuration: { value: 1000000 },
+                  executeStartTime: {
+                    value: 1672934150495,
+                    value_as_string: '2023-01-05T15:55:50.495Z',
+                  },
+                },
+              },
+            ],
+          },
+          executionUuidCardinality: { doc_count: 2, executionUuidCardinality: { value: 2 } },
+        },
+      },
+    };
+    expect(formatExecutionLogResult(results)).toEqual({
+      data: [
+        {
+          connector_name: 'test',
+          connector_id: '1',
+          duration_ms: 441,
+          id: 'fdf9cadb-4568-4d22-afd2-437e4efbe767',
+          message:
+            'action execution failure: .email:e020c620-8d14-11ed-bae5-bd32cbc9eaaa: test - action execution failure: .email:e020c620-8d14-11ed-bae5-bd32cbc9eaaa: test',
+          schedule_delay_ms: 2946,
+          space_ids: ['default'],
+          status: 'failure',
+          timestamp: '2023-01-05T16:23:53.813Z',
+          version: '8.7.0',
+          timed_out: false,
+        },
+        {
+          connector_name: 'test connector',
+          connector_id: '1',
+          duration_ms: 1,
+          id: '8b3af07e-7593-4c40-b704-9c06d3b06e58',
+          message:
+            'action executed: .server-log:6709f660-8d11-11ed-bae5-bd32cbc9eaaa: test connector',
+          schedule_delay_ms: 2783,
+          space_ids: ['default'],
+          status: 'success',
+          timestamp: '2023-01-05T15:55:50.495Z',
+          version: '8.7.0',
+          timed_out: false,
+        },
+      ],
+      total: 2,
+    });
+  });
+});
+
+describe('getExecutionKPIAggregation', () => {
+  test('should correctly generate aggregation', () => {
+    expect(getExecutionKPIAggregation()).toEqual({
+      executionKpiAgg: {
+        aggs: {
+          executionUuid: {
+            aggs: {
+              actionExecution: {
+                aggs: {
+                  actionExecutionOutcomes: {
+                    terms: {
+                      field: 'event.outcome',
+                      size: 3,
+                    },
+                  },
+                  executeStartTime: {
+                    min: {
+                      field: 'event.start',
+                    },
+                  },
+                },
+                filter: {
+                  bool: {
+                    must: [
+                      {
+                        match: {
+                          'event.action': 'execute',
+                        },
+                      },
+                    ],
+                  },
+                },
+              },
+              executionUuidSorted: {
+                bucket_sort: {
+                  from: 0,
+                  gap_policy: 'insert_zeros',
+                  size: 10000,
+                },
+              },
+            },
+            terms: {
+              field: 'kibana.action.execution.uuid',
+              order: [
+                {
+                  'actionExecution>executeStartTime': 'desc',
+                },
+              ],
+              size: 10000,
+            },
+          },
+        },
+      },
+    });
+  });
+
+  test('should correctly generate aggregation with a defined filter in the form of a string', () => {
+    expect(getExecutionKPIAggregation('test:test')).toEqual({
+      executionKpiAgg: {
+        aggs: {
+          executionUuid: {
+            aggs: {
+              actionExecution: {
+                aggs: {
+                  actionExecutionOutcomes: {
+                    terms: {
+                      field: 'event.outcome',
+                      size: 3,
+                    },
+                  },
+                  executeStartTime: {
+                    min: {
+                      field: 'event.start',
+                    },
+                  },
+                },
+                filter: {
+                  bool: {
+                    must: [
+                      {
+                        match: {
+                          'event.action': 'execute',
+                        },
+                      },
+                    ],
+                  },
+                },
+              },
+              executionUuidSorted: {
+                bucket_sort: {
+                  from: 0,
+                  gap_policy: 'insert_zeros',
+                  size: 10000,
+                },
+              },
+            },
+            terms: {
+              field: 'kibana.action.execution.uuid',
+              order: [
+                {
+                  'actionExecution>executeStartTime': 'desc',
+                },
+              ],
+              size: 10000,
+            },
+          },
+        },
+        filter: {
+          bool: {
+            filter: {
+              bool: {
+                minimum_should_match: 1,
+                should: [
+                  {
+                    match: {
+                      test: 'test',
+                    },
+                  },
+                ],
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+
+  test('should correctly generate aggregation with a defined filter in the form of a KueryNode', () => {
+    expect(getExecutionKPIAggregation(fromKueryExpression('test:test'))).toEqual({
+      executionKpiAgg: {
+        aggs: {
+          executionUuid: {
+            aggs: {
+              actionExecution: {
+                aggs: {
+                  actionExecutionOutcomes: {
+                    terms: {
+                      field: 'event.outcome',
+                      size: 3,
+                    },
+                  },
+                  executeStartTime: {
+                    min: {
+                      field: 'event.start',
+                    },
+                  },
+                },
+                filter: {
+                  bool: {
+                    must: [
+                      {
+                        match: {
+                          'event.action': 'execute',
+                        },
+                      },
+                    ],
+                  },
+                },
+              },
+              executionUuidSorted: {
+                bucket_sort: {
+                  from: 0,
+                  gap_policy: 'insert_zeros',
+                  size: 10000,
+                },
+              },
+            },
+            terms: {
+              field: 'kibana.action.execution.uuid',
+              order: [
+                {
+                  'actionExecution>executeStartTime': 'desc',
+                },
+              ],
+              size: 10000,
+            },
+          },
+        },
+        filter: {
+          bool: {
+            filter: {
+              bool: {
+                minimum_should_match: 1,
+                should: [
+                  {
+                    match: {
+                      test: 'test',
+                    },
+                  },
+                ],
+              },
+            },
+          },
+        },
+      },
+    });
+  });
+});
+
+describe('formatExecutionKPIAggBuckets', () => {
+  test('should return empty results if aggregations are undefined', () => {
+    expect(
+      formatExecutionKPIResult({
+        aggregations: undefined,
+      })
+    ).toEqual({ failure: 0, success: 0, unknown: 0, warning: 0 });
+  });
+
+  test('should format results correctly', () => {
+    const results = {
+      aggregations: {
+        executionKpiAgg: {
+          doc_count: 21,
+          executionUuid: {
+            doc_count_error_upper_bound: 0,
+            sum_other_doc_count: 0,
+            buckets: [
+              {
+                key: '8b3af07e-7593-4c40-b704-9c06d3b06e58',
+                doc_count: 1,
+                actionExecution: {
+                  doc_count: 1,
+                  actionExecutionOutcomes: {
+                    doc_count_error_upper_bound: 0,
+                    sum_other_doc_count: 0,
+                    buckets: [{ key: 'success', doc_count: 1 }],
+                  },
+                  executeStartTime: {
+                    value: 1672934150495,
+                    value_as_string: '2023-01-05T15:55:50.495Z',
+                  },
+                },
+              },
+            ],
+          },
+        },
+      },
+    };
+
+    expect(formatExecutionKPIResult(results)).toEqual({
+      failure: 0,
+      success: 1,
+      unknown: 0,
+      warning: 0,
+    });
+  });
+});
diff --git a/x-pack/plugins/actions/server/lib/get_execution_log_aggregation.ts b/x-pack/plugins/actions/server/lib/get_execution_log_aggregation.ts
new file mode 100644
index 00000000000000..e2f39407163178
--- /dev/null
+++ b/x-pack/plugins/actions/server/lib/get_execution_log_aggregation.ts
@@ -0,0 +1,424 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { KueryNode } from '@kbn/es-query';
+import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import Boom from '@hapi/boom';
+import { flatMap, get, isEmpty } from 'lodash';
+import { AggregateEventsBySavedObjectResult } from '@kbn/event-log-plugin/server';
+import { fromKueryExpression, toElasticsearchQuery } from '@kbn/es-query';
+import { IExecutionLog, IExecutionLogResult, EMPTY_EXECUTION_KPI_RESULT } from '../../common';
+
+const DEFAULT_MAX_BUCKETS_LIMIT = 1000; // do not retrieve more than this number of executions
+const DEFAULT_MAX_KPI_BUCKETS_LIMIT = 10000;
+
+const SPACE_ID_FIELD = 'kibana.space_ids';
+const ACTION_NAME_FIELD = 'kibana.action.name';
+const ACTION_ID_FIELD = 'kibana.action.id';
+const START_FIELD = 'event.start';
+const ACTION_FIELD = 'event.action';
+const OUTCOME_FIELD = 'event.outcome';
+const DURATION_FIELD = 'event.duration';
+const MESSAGE_FIELD = 'message';
+const VERSION_FIELD = 'kibana.version';
+const ERROR_MESSAGE_FIELD = 'error.message';
+const SCHEDULE_DELAY_FIELD = 'kibana.task.schedule_delay';
+const EXECUTION_UUID_FIELD = 'kibana.action.execution.uuid';
+
+const Millis2Nanos = 1000 * 1000;
+
+export const ACTION_FILTER = 'event.provider: actions AND NOT event.action: execute-start';
+export const EMPTY_EXECUTION_LOG_RESULT = {
+  total: 0,
+  data: [],
+};
+
+interface IActionExecution
+  extends estypes.AggregationsTermsAggregateBase<{ key: string; doc_count: number }> {
+  buckets: Array<{ key: string; doc_count: number }>;
+}
+
+interface IExecutionUuidKpiAggBucket extends estypes.AggregationsStringTermsBucketKeys {
+  actionExecution: {
+    doc_count: number;
+    actionExecutionOutcomes: IActionExecution;
+  };
+}
+interface IExecutionUuidAggBucket extends estypes.AggregationsStringTermsBucketKeys {
+  timeoutMessage: estypes.AggregationsMultiBucketBase;
+  actionExecution: {
+    executeStartTime: estypes.AggregationsMinAggregate;
+    executionDuration: estypes.AggregationsMaxAggregate;
+    scheduleDelay: estypes.AggregationsMaxAggregate;
+    outcomeAndMessage: estypes.AggregationsTopHitsAggregate;
+  };
+}
+
+export interface ExecutionUuidAggResult extends estypes.AggregationsAggregateBase {
+  buckets: IExecutionUuidAggBucket[];
+}
+
+export interface ExecutionUuidKPIAggResult extends estypes.AggregationsAggregateBase {
+  buckets: IExecutionUuidKpiAggBucket[];
+}
+
+interface ExecutionLogAggResult extends estypes.AggregationsAggregateBase {
+  executionUuid: ExecutionUuidAggResult;
+  executionUuidCardinality: {
+    executionUuidCardinality: estypes.AggregationsCardinalityAggregate;
+  };
+}
+
+interface ExecutionKpiAggResult extends estypes.AggregationsAggregateBase {
+  executionUuid: ExecutionUuidKPIAggResult;
+}
+
+export interface IExecutionLogAggOptions {
+  filter?: string | KueryNode;
+  page: number;
+  perPage: number;
+  sort: estypes.Sort;
+}
+
+const ExecutionLogSortFields: Record<string, string> = {
+  timestamp: 'actionExecution>executeStartTime',
+  execution_duration: 'actionExecution>executionDuration',
+  schedule_delay: 'actionExecution>scheduleDelay',
+};
+
+export const getExecutionKPIAggregation = (filter?: IExecutionLogAggOptions['filter']) => {
+  const dslFilterQuery: estypes.QueryDslBoolQuery['filter'] = buildDslFilterQuery(filter);
+
+  return {
+    executionKpiAgg: {
+      ...(dslFilterQuery ? { filter: { bool: { filter: dslFilterQuery } } } : {}),
+      aggs: {
+        executionUuid: {
+          // Bucket by execution UUID
+          terms: {
+            field: EXECUTION_UUID_FIELD,
+            size: DEFAULT_MAX_KPI_BUCKETS_LIMIT,
+            order: formatSortForTermSort([{ timestamp: { order: 'desc' } }]),
+          },
+          aggs: {
+            executionUuidSorted: {
+              bucket_sort: {
+                from: 0,
+                size: DEFAULT_MAX_KPI_BUCKETS_LIMIT,
+                gap_policy: 'insert_zeros' as estypes.AggregationsGapPolicy,
+              },
+            },
+            actionExecution: {
+              filter: {
+                bool: {
+                  must: [
+                    {
+                      match: {
+                        [ACTION_FIELD]: 'execute',
+                      },
+                    },
+                  ],
+                },
+              },
+              aggs: {
+                executeStartTime: {
+                  min: {
+                    field: START_FIELD,
+                  },
+                },
+                actionExecutionOutcomes: {
+                  terms: {
+                    size: 3,
+                    field: OUTCOME_FIELD,
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  };
+};
+
+export function getExecutionLogAggregation({
+  filter,
+  page,
+  perPage,
+  sort,
+}: IExecutionLogAggOptions) {
+  // Check if valid sort fields
+  const sortFields = flatMap(sort as estypes.SortCombinations[], (s) => Object.keys(s));
+  for (const field of sortFields) {
+    if (!Object.keys(ExecutionLogSortFields).includes(field)) {
+      throw Boom.badRequest(
+        `Invalid sort field "${field}" - must be one of [${Object.keys(ExecutionLogSortFields).join(
+          ','
+        )}]`
+      );
+    }
+  }
+
+  // Check if valid page value
+  if (page <= 0) {
+    throw Boom.badRequest(`Invalid page field "${page}" - must be greater than 0`);
+  }
+
+  // Check if valid page value
+  if (perPage <= 0) {
+    throw Boom.badRequest(`Invalid perPage field "${perPage}" - must be greater than 0`);
+  }
+
+  const dslFilterQuery: estypes.QueryDslBoolQuery['filter'] = buildDslFilterQuery(filter);
+
+  return {
+    executionLogAgg: {
+      ...(dslFilterQuery ? { filter: { bool: { filter: dslFilterQuery } } } : {}),
+      aggs: {
+        // Get total number of executions
+        executionUuidCardinality: {
+          filter: {
+            bool: {
+              must: [
+                {
+                  match: {
+                    [ACTION_FIELD]: 'execute',
+                  },
+                },
+              ],
+            },
+          },
+          aggs: {
+            executionUuidCardinality: {
+              cardinality: {
+                field: EXECUTION_UUID_FIELD,
+              },
+            },
+          },
+        },
+        executionUuid: {
+          // Bucket by execution UUID
+          terms: {
+            field: EXECUTION_UUID_FIELD,
+            size: DEFAULT_MAX_BUCKETS_LIMIT,
+            order: formatSortForTermSort(sort),
+          },
+          aggs: {
+            // Bucket sort to allow paging through executions
+            executionUuidSorted: {
+              bucket_sort: {
+                sort: formatSortForBucketSort(sort),
+                from: (page - 1) * perPage,
+                size: perPage,
+                gap_policy: 'insert_zeros' as estypes.AggregationsGapPolicy,
+              },
+            },
+            // Filter by action execute doc and get information from this event
+            actionExecution: {
+              filter: {
+                bool: {
+                  must: [
+                    {
+                      match: {
+                        [ACTION_FIELD]: 'execute',
+                      },
+                    },
+                  ],
+                },
+              },
+              aggs: {
+                executeStartTime: {
+                  min: {
+                    field: START_FIELD,
+                  },
+                },
+                scheduleDelay: {
+                  max: {
+                    field: SCHEDULE_DELAY_FIELD,
+                  },
+                },
+                executionDuration: {
+                  max: {
+                    field: DURATION_FIELD,
+                  },
+                },
+                outcomeAndMessage: {
+                  top_hits: {
+                    _source: {
+                      includes: [
+                        OUTCOME_FIELD,
+                        MESSAGE_FIELD,
+                        ERROR_MESSAGE_FIELD,
+                        VERSION_FIELD,
+                        SPACE_ID_FIELD,
+                        ACTION_NAME_FIELD,
+                        ACTION_ID_FIELD,
+                      ],
+                    },
+                  },
+                },
+              },
+            },
+            // If there was a timeout, this filter will return non-zero doc count
+            timeoutMessage: {
+              filter: {
+                bool: {
+                  must: [
+                    {
+                      match: {
+                        [ACTION_FIELD]: 'execute-timeout',
+                      },
+                    },
+                  ],
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  };
+}
+
+function buildDslFilterQuery(filter: IExecutionLogAggOptions['filter']) {
+  try {
+    const filterKueryNode = typeof filter === 'string' ? fromKueryExpression(filter) : filter;
+    return filterKueryNode ? toElasticsearchQuery(filterKueryNode) : undefined;
+  } catch (err) {
+    throw Boom.badRequest(`Invalid kuery syntax for filter ${filter}`);
+  }
+}
+
+function formatExecutionLogAggBucket(bucket: IExecutionUuidAggBucket): IExecutionLog {
+  const durationUs = bucket?.actionExecution?.executionDuration?.value
+    ? bucket.actionExecution.executionDuration.value
+    : 0;
+  const scheduleDelayUs = bucket?.actionExecution?.scheduleDelay?.value
+    ? bucket.actionExecution.scheduleDelay.value
+    : 0;
+
+  const outcomeAndMessage =
+    bucket?.actionExecution?.outcomeAndMessage?.hits?.hits[0]?._source ?? {};
+  let status = outcomeAndMessage.kibana?.alerting?.outcome ?? '';
+  if (isEmpty(status)) {
+    status = outcomeAndMessage.event?.outcome ?? '';
+  }
+  const outcomeMessage = outcomeAndMessage.message ?? '';
+  const outcomeErrorMessage = outcomeAndMessage.error?.message ?? '';
+  const message =
+    status === 'failure' ? `${outcomeMessage} - ${outcomeErrorMessage}` : outcomeMessage;
+  const version = outcomeAndMessage.kibana?.version ?? '';
+
+  const spaceIds = outcomeAndMessage?.kibana?.space_ids ?? [];
+  const connectorName = outcomeAndMessage?.kibana?.action?.name ?? '';
+  const connectorId = outcomeAndMessage?.kibana?.action?.id ?? '';
+  const timedOut = (bucket?.timeoutMessage?.doc_count ?? 0) > 0;
+  return {
+    id: bucket?.key ?? '',
+    timestamp: bucket?.actionExecution?.executeStartTime.value_as_string ?? '',
+    duration_ms: durationUs / Millis2Nanos,
+    status,
+    message,
+    version,
+    schedule_delay_ms: scheduleDelayUs / Millis2Nanos,
+    space_ids: spaceIds,
+    connector_name: connectorName,
+    connector_id: connectorId,
+    timed_out: timedOut,
+  };
+}
+
+function formatExecutionKPIAggBuckets(buckets: IExecutionUuidKpiAggBucket[]) {
+  const objToReturn = {
+    success: 0,
+    unknown: 0,
+    failure: 0,
+    warning: 0,
+  };
+
+  buckets.forEach((bucket) => {
+    const actionExecutionOutcomes = bucket?.actionExecution?.actionExecutionOutcomes?.buckets ?? [];
+
+    const actionExecutionCount = bucket?.actionExecution?.doc_count ?? 0;
+    const outcomes = {
+      successActionExecution: 0,
+      failureActionExecution: 0,
+      warningActionExecution: 0,
+    };
+    actionExecutionOutcomes.reduce((acc, subBucket) => {
+      const key = subBucket.key;
+
+      if (key === 'success') {
+        acc.successActionExecution = subBucket.doc_count ?? 0;
+      } else if (key === 'failure') {
+        acc.failureActionExecution = subBucket.doc_count ?? 0;
+      } else if (key === 'warning') {
+        acc.warningActionExecution = subBucket.doc_count ?? 0;
+      }
+      return acc;
+    }, outcomes);
+
+    objToReturn.success += outcomes.successActionExecution;
+    objToReturn.unknown +=
+      actionExecutionCount -
+      (outcomes.successActionExecution +
+        outcomes.failureActionExecution +
+        outcomes.warningActionExecution);
+    objToReturn.failure += outcomes.failureActionExecution;
+    objToReturn.warning += outcomes.warningActionExecution;
+  });
+
+  return objToReturn;
+}
+
+export function formatExecutionKPIResult(results: AggregateEventsBySavedObjectResult) {
+  const { aggregations } = results;
+  if (!aggregations || !aggregations.executionKpiAgg) {
+    return EMPTY_EXECUTION_KPI_RESULT;
+  }
+  const aggs = aggregations.executionKpiAgg as ExecutionKpiAggResult;
+  const buckets = aggs.executionUuid.buckets;
+  return formatExecutionKPIAggBuckets(buckets);
+}
+
+export function formatExecutionLogResult(
+  results: AggregateEventsBySavedObjectResult
+): IExecutionLogResult {
+  const { aggregations } = results;
+
+  if (!aggregations || !aggregations.executionLogAgg) {
+    return EMPTY_EXECUTION_LOG_RESULT;
+  }
+
+  const aggs = aggregations.executionLogAgg as ExecutionLogAggResult;
+
+  const total = aggs.executionUuidCardinality.executionUuidCardinality.value;
+  const buckets = aggs.executionUuid.buckets;
+
+  return {
+    total,
+    data: buckets.map((bucket: IExecutionUuidAggBucket) => formatExecutionLogAggBucket(bucket)),
+  };
+}
+
+export function formatSortForBucketSort(sort: estypes.Sort) {
+  return (sort as estypes.SortCombinations[]).map((s) =>
+    Object.keys(s).reduce(
+      (acc, curr) => ({ ...acc, [ExecutionLogSortFields[curr]]: get(s, curr) }),
+      {}
+    )
+  );
+}
+
+export function formatSortForTermSort(sort: estypes.Sort) {
+  return (sort as estypes.SortCombinations[]).map((s) =>
+    Object.keys(s).reduce(
+      (acc, curr) => ({ ...acc, [ExecutionLogSortFields[curr]]: get(s, `${curr}.order`) }),
+      {}
+    )
+  );
+}
diff --git a/x-pack/plugins/actions/server/lib/index.ts b/x-pack/plugins/actions/server/lib/index.ts
index c40ab4206488fd..9ac123babecefd 100644
--- a/x-pack/plugins/actions/server/lib/index.ts
+++ b/x-pack/plugins/actions/server/lib/index.ts
@@ -34,3 +34,4 @@ export {
   isHttpRequestExecutionSource,
 } from './action_execution_source';
 export { validateEmptyStrings } from './validate_empty_strings';
+export { parseDate } from './parse_date';
diff --git a/x-pack/plugins/actions/server/lib/parse_date.test.ts b/x-pack/plugins/actions/server/lib/parse_date.test.ts
new file mode 100644
index 00000000000000..0a41b065ff9b8b
--- /dev/null
+++ b/x-pack/plugins/actions/server/lib/parse_date.test.ts
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { parseDate, parseIsoOrRelativeDate } from './parse_date';
+
+describe('parseDate', () => {
+  test('returns valid parsed date', () => {
+    const date = new Date(Date.now() - 1 * 60 * 60 * 1000);
+    const parsedDate = parseDate(date.toISOString(), 'dateStart', new Date());
+    expect(parsedDate?.valueOf()).toBe(date.valueOf());
+  });
+
+  test('returns default value if date is undefined', () => {
+    const date = new Date();
+    const parsedDate = parseDate(undefined, 'dateStart', date);
+    expect(parsedDate?.valueOf()).toBe(date.valueOf());
+  });
+
+  test('throws an error for invalid date strings', () => {
+    expect(() =>
+      parseDate('this shall not pass', 'dateStart', new Date())
+    ).toThrowErrorMatchingInlineSnapshot(
+      `"Invalid date for parameter dateStart: \\"this shall not pass\\""`
+    );
+  });
+});
+
+describe('parseIsoOrRelativeDate', () => {
+  test('handles ISO dates', () => {
+    const date = new Date();
+    const parsedDate = parseIsoOrRelativeDate(date.toISOString());
+    expect(parsedDate?.valueOf()).toBe(date.valueOf());
+  });
+
+  test('handles relative dates', () => {
+    const hoursDiff = 1;
+    const date = new Date(Date.now() - hoursDiff * 60 * 60 * 1000);
+    const parsedDate = parseIsoOrRelativeDate(`${hoursDiff}h`);
+    const diff = Math.abs(parsedDate!.valueOf() - date.valueOf());
+    expect(diff).toBeLessThan(1000);
+  });
+
+  test('returns undefined for invalid date strings', () => {
+    const parsedDate = parseIsoOrRelativeDate('this shall not pass');
+    expect(parsedDate).toBeUndefined();
+  });
+});
diff --git a/x-pack/plugins/actions/server/lib/parse_date.ts b/x-pack/plugins/actions/server/lib/parse_date.ts
new file mode 100644
index 00000000000000..72eda642096f41
--- /dev/null
+++ b/x-pack/plugins/actions/server/lib/parse_date.ts
@@ -0,0 +1,90 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import Boom from '@hapi/boom';
+import { i18n } from '@kbn/i18n';
+
+const SECONDS_REGEX = /^[1-9][0-9]*s$/;
+const MINUTES_REGEX = /^[1-9][0-9]*m$/;
+const HOURS_REGEX = /^[1-9][0-9]*h$/;
+const DAYS_REGEX = /^[1-9][0-9]*d$/;
+
+export function parseDate(
+  dateString: string | undefined,
+  propertyName: string,
+  defaultValue: Date
+): Date {
+  if (dateString === undefined) {
+    return defaultValue;
+  }
+
+  const parsedDate = parseIsoOrRelativeDate(dateString);
+  if (parsedDate === undefined) {
+    throw Boom.badRequest(
+      i18n.translate('xpack.actions.actionsClient.invalidDate', {
+        defaultMessage: 'Invalid date for parameter {field}: "{dateValue}"',
+        values: {
+          field: propertyName,
+          dateValue: dateString,
+        },
+      })
+    );
+  }
+
+  return parsedDate;
+}
+
+/**
+ * Parse an ISO date or NNx duration string as a Date
+ *
+ * @param dateString an ISO date or NNx "duration" string representing now-duration
+ * @returns a Date or undefined if the dateString was not valid
+ */
+export function parseIsoOrRelativeDate(dateString: string): Date | undefined {
+  const epochMillis = Date.parse(dateString);
+  if (!isNaN(epochMillis)) return new Date(epochMillis);
+
+  let millis: number;
+  try {
+    millis = parseDuration(dateString);
+  } catch (err) {
+    return;
+  }
+
+  return new Date(Date.now() - millis);
+}
+
+export function parseDuration(duration: string): number {
+  const parsed = parseInt(duration, 10);
+  if (isSeconds(duration)) {
+    return parsed * 1000;
+  } else if (isMinutes(duration)) {
+    return parsed * 60 * 1000;
+  } else if (isHours(duration)) {
+    return parsed * 60 * 60 * 1000;
+  } else if (isDays(duration)) {
+    return parsed * 24 * 60 * 60 * 1000;
+  }
+  throw new Error(
+    `Invalid duration "${duration}". Durations must be of the form {number}x. Example: 5s, 5m, 5h or 5d"`
+  );
+}
+
+function isSeconds(duration: string) {
+  return SECONDS_REGEX.test(duration);
+}
+
+function isMinutes(duration: string) {
+  return MINUTES_REGEX.test(duration);
+}
+
+function isHours(duration: string) {
+  return HOURS_REGEX.test(duration);
+}
+
+function isDays(duration: string) {
+  return DAYS_REGEX.test(duration);
+}
diff --git a/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts b/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts
index 63ab73ccc0efeb..49aadcbefe933a 100644
--- a/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts
+++ b/x-pack/plugins/actions/server/lib/task_runner_factory.test.ts
@@ -19,7 +19,17 @@ import { ActionTypeDisabledError } from './errors';
 import { actionsClientMock } from '../mocks';
 import { inMemoryMetricsMock } from '../monitoring/in_memory_metrics.mock';
 import { IN_MEMORY_METRICS } from '../monitoring';
-
+import { pick } from 'lodash';
+
+const executeParamsFields = [
+  'actionId',
+  'isEphemeral',
+  'params',
+  'relatedSavedObjects',
+  'executionId',
+  'request.headers',
+  'taskInfo',
+];
 const spaceIdToNamespace = jest.fn();
 const actionTypeRegistry = actionTypeRegistryMock.create();
 const mockedEncryptedSavedObjectsClient = encryptedSavedObjectsMock.createClient();
@@ -136,25 +146,25 @@ test('executes the task by calling the executor with proper parameters, using gi
     { namespace: 'namespace-test' }
   );
 
-  expect(mockedActionExecutor.execute).toHaveBeenCalledWith({
+  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
+  expect(pick(executeParams, executeParamsFields)).toEqual({
     actionId: '2',
     isEphemeral: false,
     params: { baz: true },
     relatedSavedObjects: [],
     executionId: '123abc',
-    request: expect.objectContaining({
+    request: {
       headers: {
         // base64 encoded "123:abc"
         authorization: 'ApiKey MTIzOmFiYw==',
       },
-    }),
+    },
     taskInfo: {
       scheduled: new Date(),
       attempts: 0,
     },
   });
 
-  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
   expect(taskRunnerFactoryInitializerParams.basePathService.set).toHaveBeenCalledWith(
     executeParams.request,
     '/s/test'
@@ -196,25 +206,25 @@ test('executes the task by calling the executor with proper parameters, using st
     { namespace: 'namespace-test' }
   );
 
-  expect(mockedActionExecutor.execute).toHaveBeenCalledWith({
+  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
+  expect(pick(executeParams, executeParamsFields)).toEqual({
     actionId: '9',
     isEphemeral: false,
     params: { baz: true },
     executionId: '123abc',
     relatedSavedObjects: [],
-    request: expect.objectContaining({
+    request: {
       headers: {
         // base64 encoded "123:abc"
         authorization: 'ApiKey MTIzOmFiYw==',
       },
-    }),
+    },
     taskInfo: {
       scheduled: new Date(),
       attempts: 0,
     },
   });
 
-  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
   expect(taskRunnerFactoryInitializerParams.basePathService.set).toHaveBeenCalledWith(
     executeParams.request,
     '/s/test'
@@ -251,26 +261,26 @@ test('executes the task by calling the executor with proper parameters when cons
     { namespace: 'namespace-test' }
   );
 
-  expect(mockedActionExecutor.execute).toHaveBeenCalledWith({
+  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
+  expect(pick(executeParams, [...executeParamsFields, 'consumer'])).toEqual({
     actionId: '2',
     consumer: 'test-consumer',
     isEphemeral: false,
     params: { baz: true },
     relatedSavedObjects: [],
     executionId: '123abc',
-    request: expect.objectContaining({
+    request: {
       headers: {
         // base64 encoded "123:abc"
         authorization: 'ApiKey MTIzOmFiYw==',
       },
-    }),
+    },
     taskInfo: {
       scheduled: new Date(),
       attempts: 0,
     },
   });
 
-  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
   expect(taskRunnerFactoryInitializerParams.basePathService.set).toHaveBeenCalledWith(
     executeParams.request,
     '/s/test'
@@ -444,25 +454,25 @@ test('uses API key when provided', async () => {
 
   await taskRunner.run();
 
-  expect(mockedActionExecutor.execute).toHaveBeenCalledWith({
+  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
+  expect(pick(executeParams, executeParamsFields)).toEqual({
     actionId: '2',
     isEphemeral: false,
     params: { baz: true },
     executionId: '123abc',
     relatedSavedObjects: [],
-    request: expect.objectContaining({
+    request: {
       headers: {
         // base64 encoded "123:abc"
         authorization: 'ApiKey MTIzOmFiYw==',
       },
-    }),
+    },
     taskInfo: {
       scheduled: new Date(),
       attempts: 0,
     },
   });
 
-  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
   expect(taskRunnerFactoryInitializerParams.basePathService.set).toHaveBeenCalledWith(
     executeParams.request,
     '/s/test'
@@ -502,7 +512,8 @@ test('uses relatedSavedObjects merged with references when provided', async () =
 
   await taskRunner.run();
 
-  expect(mockedActionExecutor.execute).toHaveBeenCalledWith({
+  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
+  expect(pick(executeParams, executeParamsFields)).toEqual({
     actionId: '2',
     isEphemeral: false,
     params: { baz: true },
@@ -513,12 +524,12 @@ test('uses relatedSavedObjects merged with references when provided', async () =
         type: 'some-type',
       },
     ],
-    request: expect.objectContaining({
+    request: {
       headers: {
         // base64 encoded "123:abc"
         authorization: 'ApiKey MTIzOmFiYw==',
       },
-    }),
+    },
     taskInfo: {
       scheduled: new Date(),
       attempts: 0,
@@ -554,7 +565,8 @@ test('uses relatedSavedObjects as is when references are empty', async () => {
 
   await taskRunner.run();
 
-  expect(mockedActionExecutor.execute).toHaveBeenCalledWith({
+  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
+  expect(pick(executeParams, executeParamsFields)).toEqual({
     actionId: '2',
     isEphemeral: false,
     params: { baz: true },
@@ -566,12 +578,12 @@ test('uses relatedSavedObjects as is when references are empty', async () => {
         namespace: 'yo',
       },
     ],
-    request: expect.objectContaining({
+    request: {
       headers: {
         // base64 encoded "123:abc"
         authorization: 'ApiKey MTIzOmFiYw==',
       },
-    }),
+    },
     taskInfo: {
       scheduled: new Date(),
       attempts: 0,
@@ -611,16 +623,18 @@ test('sanitizes invalid relatedSavedObjects when provided', async () => {
   });
 
   await taskRunner.run();
-  expect(mockedActionExecutor.execute).toHaveBeenCalledWith({
+
+  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
+  expect(pick(executeParams, executeParamsFields)).toEqual({
     actionId: '2',
     isEphemeral: false,
     params: { baz: true },
-    request: expect.objectContaining({
+    request: {
       headers: {
         // base64 encoded "123:abc"
         authorization: 'ApiKey MTIzOmFiYw==',
       },
-    }),
+    },
     executionId: '123abc',
     relatedSavedObjects: [],
     taskInfo: {
@@ -656,22 +670,22 @@ test(`doesn't use API key when not provided`, async () => {
 
   await taskRunner.run();
 
-  expect(mockedActionExecutor.execute).toHaveBeenCalledWith({
+  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
+  expect(pick(executeParams, executeParamsFields)).toEqual({
     actionId: '2',
     isEphemeral: false,
     params: { baz: true },
     executionId: '123abc',
     relatedSavedObjects: [],
-    request: expect.objectContaining({
+    request: {
       headers: {},
-    }),
+    },
     taskInfo: {
       scheduled: new Date(),
       attempts: 0,
     },
   });
 
-  const [executeParams] = mockedActionExecutor.execute.mock.calls[0];
   expect(taskRunnerFactoryInitializerParams.basePathService.set).toHaveBeenCalledWith(
     executeParams.request,
     '/s/test'
diff --git a/x-pack/plugins/actions/server/lib/task_runner_factory.ts b/x-pack/plugins/actions/server/lib/task_runner_factory.ts
index 72460decabab6c..d5b82e8fc6f6e5 100644
--- a/x-pack/plugins/actions/server/lib/task_runner_factory.ts
+++ b/x-pack/plugins/actions/server/lib/task_runner_factory.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { v4 as uuidv4 } from 'uuid';
 import { pick } from 'lodash';
 import { pipe } from 'fp-ts/lib/pipeable';
 import { map, fromNullable, getOrElse } from 'fp-ts/lib/Option';
@@ -84,6 +85,7 @@ export class TaskRunnerFactory {
       scheduled: taskInstance.runAt,
       attempts: taskInstance.attempts,
     };
+    const actionExecutionId = uuidv4();
 
     return {
       async run() {
@@ -122,6 +124,7 @@ export class TaskRunnerFactory {
             executionId,
             consumer,
             relatedSavedObjects: validatedRelatedSavedObjects(logger, relatedSavedObjects),
+            actionExecutionId,
           });
         } catch (e) {
           logger.error(
@@ -208,6 +211,7 @@ export class TaskRunnerFactory {
           executionId,
           relatedSavedObjects: (relatedSavedObjects || []) as RelatedSavedObjects,
           ...getSourceFromReferences(references),
+          actionExecutionId,
         });
 
         inMemoryMetrics.increment(IN_MEMORY_METRICS.ACTION_TIMEOUTS);
diff --git a/x-pack/plugins/actions/server/plugin.test.ts b/x-pack/plugins/actions/server/plugin.test.ts
index d560beab681c49..d26fc5e680f14c 100644
--- a/x-pack/plugins/actions/server/plugin.test.ts
+++ b/x-pack/plugins/actions/server/plugin.test.ts
@@ -302,6 +302,7 @@ describe('Actions Plugin', () => {
         licensing: licensingMock.createStart(),
         taskManager: taskManagerMock.createStart(),
         encryptedSavedObjects: encryptedSavedObjectsMock.createStart(),
+        eventLog: eventLogMock.createStart(),
       };
     });
 
@@ -380,6 +381,7 @@ describe('Actions Plugin', () => {
           licensing: licensingMock.createStart(),
           taskManager: taskManagerMock.createStart(),
           encryptedSavedObjects: encryptedSavedObjectsMock.createStart(),
+          eventLog: eventLogMock.createStart(),
         };
       }
 
diff --git a/x-pack/plugins/actions/server/plugin.ts b/x-pack/plugins/actions/server/plugin.ts
index d45fde5cff09f0..21884b12cacd5f 100644
--- a/x-pack/plugins/actions/server/plugin.ts
+++ b/x-pack/plugins/actions/server/plugin.ts
@@ -33,7 +33,11 @@ import { LicensingPluginSetup, LicensingPluginStart } from '@kbn/licensing-plugi
 import { SpacesPluginStart, SpacesPluginSetup } from '@kbn/spaces-plugin/server';
 import { PluginSetupContract as FeaturesPluginSetup } from '@kbn/features-plugin/server';
 import { SecurityPluginSetup } from '@kbn/security-plugin/server';
-import { IEventLogger, IEventLogService } from '@kbn/event-log-plugin/server';
+import {
+  IEventLogClientService,
+  IEventLogger,
+  IEventLogService,
+} from '@kbn/event-log-plugin/server';
 import { MonitoringCollectionSetup } from '@kbn/monitoring-collection-plugin/server';
 import {
   ensureCleanupFailedExecutionsTaskScheduled,
@@ -171,6 +175,7 @@ export interface ActionsPluginsStart {
   encryptedSavedObjects: EncryptedSavedObjectsPluginStart;
   taskManager: TaskManagerStartContract;
   licensing: LicensingPluginStart;
+  eventLog: IEventLogClientService;
   spaces?: SpacesPluginStart;
 }
 
@@ -458,6 +463,9 @@ export class ActionsPlugin implements Plugin<PluginSetupContract, PluginStartCon
           encryptedSavedObjectsClient,
           logger: this.logger,
         }),
+        async getEventLogClient() {
+          return plugins.eventLog.getClient(request);
+        },
       });
     };
 
@@ -620,7 +628,7 @@ export class ActionsPlugin implements Plugin<PluginSetupContract, PluginStartCon
     } = this;
 
     return async function actionsRouteHandlerContext(context, request) {
-      const [{ savedObjects }, { taskManager, encryptedSavedObjects }] =
+      const [{ savedObjects }, { taskManager, encryptedSavedObjects, eventLog }] =
         await core.getStartServices();
       const coreContext = await context.core;
 
@@ -672,6 +680,9 @@ export class ActionsPlugin implements Plugin<PluginSetupContract, PluginStartCon
               }),
               logger,
             }),
+            async getEventLogClient() {
+              return eventLog.getClient(request);
+            },
           });
         },
         listTypes: actionTypeRegistry!.list.bind(actionTypeRegistry!),
diff --git a/x-pack/plugins/actions/server/routes/get_global_execution_kpi.test.ts b/x-pack/plugins/actions/server/routes/get_global_execution_kpi.test.ts
new file mode 100644
index 00000000000000..838a1bf69789f1
--- /dev/null
+++ b/x-pack/plugins/actions/server/routes/get_global_execution_kpi.test.ts
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { httpServiceMock } from '@kbn/core/server/mocks';
+import { licenseStateMock } from '../lib/license_state.mock';
+import { mockHandlerArguments } from './legacy/_mock_handler_arguments';
+import { actionsClientMock } from '../actions_client.mock';
+import { getGlobalExecutionKPIRoute } from './get_global_execution_kpi';
+import { verifyAccessAndContext } from './verify_access_and_context';
+
+const actionsClient = actionsClientMock.create();
+jest.mock('./verify_access_and_context', () => ({
+  verifyAccessAndContext: jest.fn(),
+}));
+beforeEach(() => {
+  jest.resetAllMocks();
+  (verifyAccessAndContext as jest.Mock).mockImplementation((license, handler) => handler);
+});
+
+describe('getGlobalExecutionKPIRoute', () => {
+  const dateString = new Date().toISOString();
+  const mockedExecutionLog = {
+    success: 3,
+    unknown: 0,
+    failure: 0,
+    warning: 0,
+  };
+
+  it('gets global execution KPI', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    getGlobalExecutionKPIRoute(router, licenseState);
+
+    const [config, handler] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(
+      `"/internal/actions/_global_connector_execution_kpi"`
+    );
+
+    actionsClient.getGlobalExecutionKpiWithAuth.mockResolvedValue(mockedExecutionLog);
+
+    const [context, req, res] = mockHandlerArguments(
+      { actionsClient },
+      {
+        body: {
+          date_start: dateString,
+        },
+      },
+      ['ok']
+    );
+
+    await handler(context, req, res);
+
+    expect(actionsClient.getGlobalExecutionKpiWithAuth).toHaveBeenCalledTimes(1);
+    expect(actionsClient.getGlobalExecutionKpiWithAuth.mock.calls[0]).toEqual([
+      {
+        dateStart: dateString,
+      },
+    ]);
+
+    expect(res.ok).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/actions/server/routes/get_global_execution_kpi.ts b/x-pack/plugins/actions/server/routes/get_global_execution_kpi.ts
new file mode 100644
index 00000000000000..978a957b70ce87
--- /dev/null
+++ b/x-pack/plugins/actions/server/routes/get_global_execution_kpi.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { IRouter } from '@kbn/core/server';
+import { schema } from '@kbn/config-schema';
+import {
+  GetGlobalExecutionKPIParams,
+  INTERNAL_BASE_ACTION_API_PATH,
+  RewriteRequestCase,
+} from '../../common';
+import { verifyAccessAndContext } from './verify_access_and_context';
+import { ActionsRequestHandlerContext } from '../types';
+import { ILicenseState } from '../lib';
+import { rewriteNamespaces } from './rewrite_namespaces';
+
+const bodySchema = schema.object({
+  date_start: schema.string(),
+  date_end: schema.maybe(schema.string()),
+  filter: schema.maybe(schema.string()),
+  namespaces: schema.maybe(schema.arrayOf(schema.string())),
+});
+
+const rewriteReq: RewriteRequestCase<GetGlobalExecutionKPIParams> = ({
+  date_start: dateStart,
+  date_end: dateEnd,
+  namespaces,
+  ...rest
+}) => ({
+  ...rest,
+  namespaces: rewriteNamespaces(namespaces),
+  dateStart,
+  dateEnd,
+});
+
+export const getGlobalExecutionKPIRoute = (
+  router: IRouter<ActionsRequestHandlerContext>,
+  licenseState: ILicenseState
+) => {
+  router.post(
+    {
+      path: `${INTERNAL_BASE_ACTION_API_PATH}/_global_connector_execution_kpi`,
+      validate: {
+        body: bodySchema,
+      },
+    },
+    router.handleLegacyErrors(
+      verifyAccessAndContext(licenseState, async function (context, req, res) {
+        const actionsClient = (await context.actions).getActionsClient();
+        return res.ok({
+          body: await actionsClient.getGlobalExecutionKpiWithAuth(rewriteReq(req.body)),
+        });
+      })
+    )
+  );
+};
diff --git a/x-pack/plugins/actions/server/routes/get_global_execution_logs.test.ts b/x-pack/plugins/actions/server/routes/get_global_execution_logs.test.ts
new file mode 100644
index 00000000000000..e91ab9268bac5b
--- /dev/null
+++ b/x-pack/plugins/actions/server/routes/get_global_execution_logs.test.ts
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getGlobalExecutionLogRoute } from './get_global_execution_logs';
+import { httpServiceMock } from '@kbn/core/server/mocks';
+import { licenseStateMock } from '../lib/license_state.mock';
+import { mockHandlerArguments } from './legacy/_mock_handler_arguments';
+import { actionsClientMock } from '../actions_client.mock';
+import { IExecutionLogResult } from '../../common';
+import { verifyAccessAndContext } from './verify_access_and_context';
+
+const actionsClient = actionsClientMock.create();
+jest.mock('./verify_access_and_context', () => ({
+  verifyAccessAndContext: jest.fn(),
+}));
+beforeEach(() => {
+  jest.resetAllMocks();
+  (verifyAccessAndContext as jest.Mock).mockImplementation((license, handler) => handler);
+});
+
+describe('getRuleExecutionLogRoute', () => {
+  const dateString = new Date().toISOString();
+  const mockedExecutionLog: IExecutionLogResult = {
+    data: [
+      {
+        connector_name: 'test connector',
+        connector_id: '1',
+        duration_ms: 1,
+        id: '8b3af07e-7593-4c40-b704-9c06d3b06e58',
+        message:
+          'action executed: .server-log:6709f660-8d11-11ed-bae5-bd32cbc9eaaa: test connector',
+        schedule_delay_ms: 2783,
+        space_ids: ['default'],
+        status: 'success',
+        timestamp: '2023-01-05T15:55:50.495Z',
+        version: '8.7.0',
+        timed_out: false,
+      },
+    ],
+    total: 1,
+  };
+
+  it('gets global execution logs', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    getGlobalExecutionLogRoute(router, licenseState);
+
+    const [config, handler] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(
+      `"/internal/actions/_global_connector_execution_logs"`
+    );
+
+    actionsClient.getGlobalExecutionLogWithAuth.mockResolvedValue(mockedExecutionLog);
+
+    const [context, req, res] = mockHandlerArguments(
+      { actionsClient },
+      {
+        body: {
+          date_start: dateString,
+          per_page: 10,
+          page: 1,
+          sort: [{ timestamp: { order: 'desc' } }],
+        },
+      },
+      ['ok']
+    );
+
+    await handler(context, req, res);
+
+    expect(actionsClient.getGlobalExecutionLogWithAuth).toHaveBeenCalledTimes(1);
+    expect(actionsClient.getGlobalExecutionLogWithAuth.mock.calls[0]).toEqual([
+      {
+        dateStart: dateString,
+        page: 1,
+        perPage: 10,
+        sort: [{ timestamp: { order: 'desc' } }],
+      },
+    ]);
+
+    expect(res.ok).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/plugins/actions/server/routes/get_global_execution_logs.ts b/x-pack/plugins/actions/server/routes/get_global_execution_logs.ts
new file mode 100644
index 00000000000000..959ab2b62b0900
--- /dev/null
+++ b/x-pack/plugins/actions/server/routes/get_global_execution_logs.ts
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IRouter } from '@kbn/core/server';
+import { schema } from '@kbn/config-schema';
+import { ILicenseState } from '../lib';
+import { ActionsRequestHandlerContext } from '../types';
+import {
+  GetGlobalExecutionLogParams,
+  INTERNAL_BASE_ACTION_API_PATH,
+  RewriteRequestCase,
+} from '../../common';
+import { verifyAccessAndContext } from './verify_access_and_context';
+import { rewriteNamespaces } from './rewrite_namespaces';
+
+const sortOrderSchema = schema.oneOf([schema.literal('asc'), schema.literal('desc')]);
+
+const sortFieldSchema = schema.oneOf([
+  schema.object({ timestamp: schema.object({ order: sortOrderSchema }) }),
+  schema.object({ execution_duration: schema.object({ order: sortOrderSchema }) }),
+  schema.object({ schedule_delay: schema.object({ order: sortOrderSchema }) }),
+]);
+
+const sortFieldsSchema = schema.arrayOf(sortFieldSchema, {
+  defaultValue: [{ timestamp: { order: 'desc' } }],
+});
+
+const bodySchema = schema.object({
+  date_start: schema.string(),
+  date_end: schema.maybe(schema.string()),
+  filter: schema.maybe(schema.string()),
+  per_page: schema.number({ defaultValue: 10, min: 1 }),
+  page: schema.number({ defaultValue: 1, min: 1 }),
+  sort: sortFieldsSchema,
+  namespaces: schema.maybe(schema.arrayOf(schema.string())),
+});
+
+const rewriteBodyReq: RewriteRequestCase<GetGlobalExecutionLogParams> = ({
+  date_start: dateStart,
+  date_end: dateEnd,
+  per_page: perPage,
+  namespaces,
+  ...rest
+}) => ({ ...rest, namespaces: rewriteNamespaces(namespaces), dateStart, dateEnd, perPage });
+
+export const getGlobalExecutionLogRoute = (
+  router: IRouter<ActionsRequestHandlerContext>,
+  licenseState: ILicenseState
+) => {
+  router.post(
+    {
+      path: `${INTERNAL_BASE_ACTION_API_PATH}/_global_connector_execution_logs`,
+      validate: {
+        body: bodySchema,
+      },
+    },
+    router.handleLegacyErrors(
+      verifyAccessAndContext(licenseState, async function (context, req, res) {
+        const actionsClient = (await context.actions).getActionsClient();
+        return res.ok({
+          body: await actionsClient.getGlobalExecutionLogWithAuth(rewriteBodyReq(req.body)),
+        });
+      })
+    )
+  );
+};
diff --git a/x-pack/plugins/actions/server/routes/index.ts b/x-pack/plugins/actions/server/routes/index.ts
index 9ff98e1ee940bf..90704190adb9c3 100644
--- a/x-pack/plugins/actions/server/routes/index.ts
+++ b/x-pack/plugins/actions/server/routes/index.ts
@@ -19,6 +19,8 @@ import { updateActionRoute } from './update';
 import { getOAuthAccessToken } from './get_oauth_access_token';
 import { defineLegacyRoutes } from './legacy';
 import { ActionsConfigurationUtilities } from '../actions_config';
+import { getGlobalExecutionLogRoute } from './get_global_execution_logs';
+import { getGlobalExecutionKPIRoute } from './get_global_execution_kpi';
 
 export interface RouteOptions {
   router: IRouter<ActionsRequestHandlerContext>;
@@ -39,6 +41,8 @@ export function defineRoutes(opts: RouteOptions) {
   updateActionRoute(router, licenseState);
   connectorTypesRoute(router, licenseState);
   executeActionRoute(router, licenseState);
+  getGlobalExecutionLogRoute(router, licenseState);
+  getGlobalExecutionKPIRoute(router, licenseState);
 
   getOAuthAccessToken(router, licenseState, actionsConfigUtils);
 }
diff --git a/x-pack/plugins/actions/server/routes/rewrite_namespaces.ts b/x-pack/plugins/actions/server/routes/rewrite_namespaces.ts
new file mode 100644
index 00000000000000..5339b41526efe6
--- /dev/null
+++ b/x-pack/plugins/actions/server/routes/rewrite_namespaces.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export const rewriteNamespaces = (namespaces?: Array<string | undefined>) =>
+  namespaces
+    ? namespaces.map((id: string | undefined) => (id === 'default' ? undefined : id))
+    : undefined;
diff --git a/x-pack/plugins/actions/tsconfig.json b/x-pack/plugins/actions/tsconfig.json
index aa450d51fbb3b7..e65c7725c8eaf8 100644
--- a/x-pack/plugins/actions/tsconfig.json
+++ b/x-pack/plugins/actions/tsconfig.json
@@ -31,7 +31,7 @@
     "@kbn/std",
     "@kbn/logging",
     "@kbn/logging-mocks",
-    "@kbn/core-elasticsearch-client-server-mocks",
+    "@kbn/core-elasticsearch-client-server-mocks"
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/event_log/generated/mappings.json b/x-pack/plugins/event_log/generated/mappings.json
index 67b60230c33aa8..1e3c5396927b7c 100644
--- a/x-pack/plugins/event_log/generated/mappings.json
+++ b/x-pack/plugins/event_log/generated/mappings.json
@@ -392,6 +392,9 @@
                         "type_id": {
                             "type": "keyword",
                             "ignore_above": 1024
+                        },
+                        "space_agnostic": {
+                            "type": "boolean"
                         }
                     }
                 },
@@ -404,6 +407,26 @@
                 },
                 "version": {
                     "type": "version"
+                },
+                "action": {
+                    "properties": {
+                        "name": {
+                            "ignore_above": 1024,
+                            "type": "keyword"
+                        },
+                        "id": {
+                            "type": "keyword",
+                            "ignore_above": 1024
+                        },
+                        "execution": {
+                            "properties": {
+                                "uuid": {
+                                    "ignore_above": 1024,
+                                    "type": "keyword"
+                                }
+                            }
+                        }
+                    }
                 }
             }
         }
diff --git a/x-pack/plugins/event_log/generated/schemas.ts b/x-pack/plugins/event_log/generated/schemas.ts
index acad4d86a6aa51..430feda52f1fba 100644
--- a/x-pack/plugins/event_log/generated/schemas.ts
+++ b/x-pack/plugins/event_log/generated/schemas.ts
@@ -170,11 +170,23 @@ export const EventSchema = schema.maybe(
               id: ecsString(),
               type: ecsString(),
               type_id: ecsString(),
+              space_agnostic: ecsBoolean(),
             })
           )
         ),
         space_ids: ecsStringMulti(),
         version: ecsVersion(),
+        action: schema.maybe(
+          schema.object({
+            name: ecsString(),
+            id: ecsString(),
+            execution: schema.maybe(
+              schema.object({
+                uuid: ecsString(),
+              })
+            ),
+          })
+        ),
       })
     ),
   })
diff --git a/x-pack/plugins/event_log/scripts/mappings.js b/x-pack/plugins/event_log/scripts/mappings.js
index ff69ef9160352b..fc4d40ee9f774b 100644
--- a/x-pack/plugins/event_log/scripts/mappings.js
+++ b/x-pack/plugins/event_log/scripts/mappings.js
@@ -178,6 +178,9 @@ exports.EcsCustomPropertyMappings = {
             type: 'keyword',
             ignore_above: 1024,
           },
+          space_agnostic: {
+            type: 'boolean',
+          },
         },
       },
       space_ids: {
@@ -187,6 +190,26 @@ exports.EcsCustomPropertyMappings = {
       version: {
         type: 'version',
       },
+      action: {
+        properties: {
+          name: {
+            ignore_above: 1024,
+            type: 'keyword',
+          },
+          id: {
+            type: 'keyword',
+            ignore_above: 1024,
+          },
+          execution: {
+            properties: {
+              uuid: {
+                ignore_above: 1024,
+                type: 'keyword',
+              },
+            },
+          },
+        },
+      },
     },
   },
 };
diff --git a/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts b/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
index a7a9e8bd0867a3..99a639815e7c67 100644
--- a/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
+++ b/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
@@ -827,6 +827,154 @@ describe('aggregateEventsWithAuthFilter', () => {
       },
     });
   });
+
+  test('should call cluster with correct options when includeSpaceAgnostic is true', async () => {
+    clusterClient.search.mockResponse({
+      aggregations: {
+        genericAgg: {
+          buckets: [
+            {
+              key: 'execute',
+              doc_count: 10,
+            },
+            {
+              key: 'execute-start',
+              doc_count: 10,
+            },
+            {
+              key: 'new-instance',
+              doc_count: 2,
+            },
+          ],
+        },
+      },
+      hits: {
+        hits: [],
+        total: { relation: 'eq', value: 0 },
+      },
+      took: 0,
+      timed_out: false,
+      _shards: {
+        failed: 0,
+        successful: 0,
+        total: 0,
+        skipped: 0,
+      },
+    });
+    const options: AggregateEventsWithAuthFilter = {
+      index: 'index-name',
+      namespaces: ['namespace'],
+      type: 'saved-object-type',
+      aggregateOptions: DEFAULT_OPTIONS as AggregateOptionsType,
+      authFilter: fromKueryExpression('test:test'),
+      includeSpaceAgnostic: true,
+    };
+    const result = await clusterClientAdapter.aggregateEventsWithAuthFilter(options);
+
+    const [query] = clusterClient.search.mock.calls[0];
+    expect(query).toEqual({
+      index: 'index-name',
+      body: {
+        size: 0,
+        query: {
+          bool: {
+            filter: {
+              bool: {
+                minimum_should_match: 1,
+                should: [
+                  {
+                    match: {
+                      test: 'test',
+                    },
+                  },
+                ],
+              },
+            },
+            must: [
+              {
+                nested: {
+                  path: 'kibana.saved_objects',
+                  query: {
+                    bool: {
+                      must: [
+                        {
+                          term: {
+                            'kibana.saved_objects.rel': {
+                              value: 'primary',
+                            },
+                          },
+                        },
+                        {
+                          term: {
+                            'kibana.saved_objects.type': {
+                              value: 'saved-object-type',
+                            },
+                          },
+                        },
+                        {
+                          bool: {
+                            should: [
+                              {
+                                bool: {
+                                  should: [
+                                    {
+                                      term: {
+                                        'kibana.saved_objects.namespace': {
+                                          value: 'namespace',
+                                        },
+                                      },
+                                    },
+                                  ],
+                                },
+                              },
+                              {
+                                match: {
+                                  'kibana.saved_objects.space_agnostic': true,
+                                },
+                              },
+                            ],
+                          },
+                        },
+                      ],
+                    },
+                  },
+                },
+              },
+            ],
+          },
+        },
+
+        aggs: {
+          genericAgg: {
+            term: {
+              field: 'event.action',
+              size: 10,
+            },
+          },
+        },
+      },
+    });
+    expect(result).toEqual({
+      aggregations: {
+        genericAgg: {
+          buckets: [
+            {
+              key: 'execute',
+              doc_count: 10,
+            },
+            {
+              key: 'execute-start',
+              doc_count: 10,
+            },
+            {
+              key: 'new-instance',
+              doc_count: 2,
+            },
+          ],
+        },
+      },
+    });
+  });
 });
 
 describe('getQueryBody', () => {
diff --git a/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts b/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
index 1c9d1e35b7a315..d057dd767fbee0 100644
--- a/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
+++ b/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
@@ -64,6 +64,7 @@ export interface AggregateEventsWithAuthFilter {
   type: string;
   authFilter: KueryNode;
   aggregateOptions: AggregateOptionsType;
+  includeSpaceAgnostic?: boolean;
 }
 
 export type FindEventsOptionsWithAuthFilter = QueryOptionsEventsWithAuthFilter & {
@@ -85,6 +86,7 @@ export interface AggregateEventsBySavedObjectResult {
 type GetQueryBodyWithAuthFilterOpts =
   | (FindEventsOptionsWithAuthFilter & {
       namespaces: AggregateEventsWithAuthFilter['namespaces'];
+      includeSpaceAgnostic?: AggregateEventsWithAuthFilter['includeSpaceAgnostic'];
     })
   | AggregateEventsWithAuthFilter;
 
@@ -527,7 +529,7 @@ export function getQueryBodyWithAuthFilter(
   opts: GetQueryBodyWithAuthFilterOpts,
   queryOptions: QueryOptionsType
 ) {
-  const { namespaces, type, authFilter } = opts;
+  const { namespaces, type, authFilter, includeSpaceAgnostic } = opts;
   const { start, end, filter } = queryOptions ?? {};
   const ids = 'ids' in opts ? opts.ids : [];
 
@@ -568,7 +570,22 @@ export function getQueryBodyWithAuthFilter(
     },
     {
       bool: {
-        should: namespaceQuery,
+        ...(includeSpaceAgnostic
+          ? {
+              should: [
+                {
+                  bool: {
+                    should: namespaceQuery,
+                  },
+                },
+                {
+                  match: {
+                    ['kibana.saved_objects.space_agnostic']: true,
+                  },
+                },
+              ],
+            }
+          : { should: namespaceQuery }),
       },
     },
   ];
diff --git a/x-pack/plugins/event_log/server/event_log_client.test.ts b/x-pack/plugins/event_log/server/event_log_client.test.ts
index b91ef3ef438367..d44ae687452458 100644
--- a/x-pack/plugins/event_log/server/event_log_client.test.ts
+++ b/x-pack/plugins/event_log/server/event_log_client.test.ts
@@ -251,9 +251,15 @@ describe('EventLogStart', () => {
     });
     test('calls aggregateEventsWithAuthFilter with given aggregation', async () => {
       savedObjectGetter.mockResolvedValueOnce(expectedSavedObject);
-      await eventLogClient.aggregateEventsWithAuthFilter('saved-object-type', testAuthFilter, {
-        aggs: { myAgg: {} },
-      });
+      await eventLogClient.aggregateEventsWithAuthFilter(
+        'saved-object-type',
+        testAuthFilter,
+        {
+          aggs: { myAgg: {} },
+        },
+        undefined,
+        true
+      );
       expect(esContext.esAdapter.aggregateEventsWithAuthFilter).toHaveBeenCalledWith({
         index: esContext.esNames.indexPattern,
         namespaces: [undefined],
@@ -270,6 +276,7 @@ describe('EventLogStart', () => {
             },
           ],
         },
+        includeSpaceAgnostic: true,
       });
     });
   });
diff --git a/x-pack/plugins/event_log/server/event_log_client.ts b/x-pack/plugins/event_log/server/event_log_client.ts
index 9a35868d248e54..4ffcfb6cef84ef 100644
--- a/x-pack/plugins/event_log/server/event_log_client.ts
+++ b/x-pack/plugins/event_log/server/event_log_client.ts
@@ -168,7 +168,8 @@ export class EventLogClient implements IEventLogClient {
     type: string,
     authFilter: KueryNode,
     options?: AggregateOptionsType,
-    namespaces?: Array<string | undefined>
+    namespaces?: Array<string | undefined>,
+    includeSpaceAgnostic?: boolean
   ) {
     if (!authFilter) {
       throw new Error('No authorization filter defined!');
@@ -188,6 +189,7 @@ export class EventLogClient implements IEventLogClient {
       type,
       authFilter,
       aggregateOptions: { ...aggregateOptions, aggs } as AggregateOptionsType,
+      includeSpaceAgnostic,
     });
   }
 
diff --git a/x-pack/plugins/event_log/server/types.ts b/x-pack/plugins/event_log/server/types.ts
index 07a7e7ed2f7e2b..6969ade7c3a8e3 100644
--- a/x-pack/plugins/event_log/server/types.ts
+++ b/x-pack/plugins/event_log/server/types.ts
@@ -74,7 +74,8 @@ export interface IEventLogClient {
     type: string,
     authFilter: KueryNode,
     options?: Partial<AggregateOptionsType>,
-    namespaces?: Array<string | undefined>
+    namespaces?: Array<string | undefined>,
+    includeSpaceAgnostic?: boolean
   ): Promise<AggregateEventsBySavedObjectResult>;
 }
 
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index 5b3940c8e809ad..2aae3ce7817d0e 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -34858,15 +34858,9 @@
     "xpack.triggersActionsUI.sections.ruleApi.bulkEditResponse.failure": "Impossible de mettre à jour {property} pour {failure, plural, one {# règle} other {# règles}}.",
     "xpack.triggersActionsUI.sections.ruleApi.bulkEditResponse.someSuccess": "{property} mise à jour pour {success, plural, one {# règle} other {# règles}}, erreurs rencontrées pour {failure, plural, one {# règle} other {# règles}}.",
     "xpack.triggersActionsUI.sections.ruleApi.bulkEditResponse.success": "{property} mise à jour pour {total, plural, one {# règle} other {# règles}}.",
-    "xpack.triggersActionsUI.sections.ruleDetails.refineSearchPrompt.prompt": "Voici les {visibleDocumentSize} premiers documents correspondant à votre recherche. Veuillez l'affiner pour en voir plus.",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.statusPanel.totalExecutions": "{executions, plural, one {# exécution} other {# exécutions}} au cours des dernières 24 heures",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleActionErrorLogFlyout.actionErrorsPlural": "{value, plural, one {action avec erreur} other {actions avec erreur}}",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleDetailsTitle": "{ruleName}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogDataGrid.erroredActionsCellPopover": "{value, plural, one {action avec erreur} other {actions avec erreur}}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogDataGrid.erroredActionsTooltip": "{value, plural, one {# action avec erreur} other {# actions avec erreur}}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResults": "Affichage de {range} sur {total, number} {type}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsRange": "{start, number} - {end, number}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsType": "{total, plural, one {entrée} other {entrées}} de log",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleExecutionSummaryAndChart.loadSummaryError": "Impossible de charger le résumé de la règle : {message}",
     "xpack.triggersActionsUI.sections.ruleDetails.unableToLoadRuleMessage": "Impossible de charger la règle : {message}",
     "xpack.triggersActionsUI.sections.ruleDetails.unableToLoadRulesMessage": "Impossible de charger les règles : {message}",
@@ -35181,37 +35175,26 @@
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.activeAlerts": "Alertes actives",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.apiError": "Impossible de récupérer l'historique d'exécution",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.duration": "Durée",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.erroredActions": "Actions comportant des erreurs",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.erroredActionsToolTip": "Nombre d'actions ayant échoué.",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.esSearchDuration": "Durée de la recherche ES",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.id": "Id",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.message": "Message",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.newAlerts": "Nouvelles alertes",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.openActionErrorsFlyout": "Ouvrir le menu volant des erreurs d’action",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.recoveredAlerts": "Alertes récupérées",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.response": "Réponse",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.ruleId": "ID règle",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.ruleName": "Règle",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduledActions": "Actions générées",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduledActionsToolTip": "Nombre total d'actions générées lors de l'exécution de la règle.",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduleDelay": "Retard sur la planification",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.searchPlaceholder": "Rechercher message de log d’événements",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.showAll": "Afficher tout",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.showOnlyFailures": "Afficher les échecs uniquement",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.spaceIds": "Espace",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.succeededActions": "Actions ayant réussi",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.succeededActionsToolTip": "Nombre d'actions ayant entièrement réussi.",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.timedOut": "Expiré",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.timestamp": "Horodatage",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.totalSearchDuration": "Durée de la recherche totale",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.triggeredActions": "Actions déclenchées",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.triggeredActionsToolTip": "Sous-ensemble des actions générées qui seront exécutées.",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.viewActionErrors": "Afficher les erreurs des actions",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogStatusFilterLabel": "Réponse",
     "xpack.triggersActionsUI.sections.ruleDetails.manageLicensePlanBannerLinkTitle": "Gérer la licence",
     "xpack.triggersActionsUI.sections.ruleDetails.popoverButtonTitle": "Actions",
     "xpack.triggersActionsUI.sections.ruleDetails.redirectObjectNoun": "règle",
-    "xpack.triggersActionsUI.sections.ruleDetails.refineSearchPrompt.backToTop": "Revenir en haut de la page.",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.alertsTabText": "Alertes",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.eventLogTabText": "Historique",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.ruleSummary.recoveredLabel": "Récupéré",
@@ -35223,7 +35206,6 @@
     "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.alertsTooltip": "Statuts des alertes pour un maximum de 10 000 exécutions de règles les plus récentes.",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.apiError": "Impossible de récupérer le KPI du log d'événements.",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.responseTooltip": "Réponses pour un maximum de 10 000 exécutions de règles les plus récentes.",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsRangeNoResult": "0",
     "xpack.triggersActionsUI.sections.ruleDetails.rulesList.ruleLastExecutionDescription": "Dernière réponse",
     "xpack.triggersActionsUI.sections.ruleDetails.rulesList.status.active": "Actif",
     "xpack.triggersActionsUI.sections.ruleDetails.rulesList.status.inactive": "Récupéré",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index ed1a1d54df0887..22956f832c5bc4 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -34828,15 +34828,9 @@
     "xpack.triggersActionsUI.sections.ruleApi.bulkEditResponse.failure": "{failure, plural, other {# ルール}}の{property}を更新できませんでした。",
     "xpack.triggersActionsUI.sections.ruleApi.bulkEditResponse.someSuccess": "{success, plural, other {# ルール}}, {failure, plural, other {# ルール}}エラーの{property}が更新されました。",
     "xpack.triggersActionsUI.sections.ruleApi.bulkEditResponse.success": "{total, plural, other {# ルール}}の{property}が更新されました。",
-    "xpack.triggersActionsUI.sections.ruleDetails.refineSearchPrompt.prompt": "これらは検索条件に一致した初めの{visibleDocumentSize}件のドキュメントです。他の結果を表示するには検索条件を絞ってください。",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.statusPanel.totalExecutions": "過去24時間で{executions, plural, other {# 件の実行}}",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleActionErrorLogFlyout.actionErrorsPlural": "{value, plural, other {個のエラーが発生したアクション}}",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleDetailsTitle": "{ruleName}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogDataGrid.erroredActionsCellPopover": "{value, plural, other {個のエラーが発生したアクション}}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogDataGrid.erroredActionsTooltip": "{value, plural, other {# 個のエラーが発生したアクション}}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResults": "{total, number} {type}件中{range}を表示しています",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsRange": "{start, number} - {end, number}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsType": "ログ{total, plural, other {エントリ}}",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleExecutionSummaryAndChart.loadSummaryError": "ルール概要を読み込めません：{message}",
     "xpack.triggersActionsUI.sections.ruleDetails.unableToLoadRuleMessage": "ルールを読み込めません：{message}",
     "xpack.triggersActionsUI.sections.ruleDetails.unableToLoadRulesMessage": "ルールを読み込めません：{message}",
@@ -35150,37 +35144,26 @@
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.activeAlerts": "アクティブアラート",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.apiError": "実行履歴を取得できませんでした",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.duration": "期間",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.erroredActions": "エラーのアクション",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.erroredActionsToolTip": "失敗したアクションの数。",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.esSearchDuration": "ES検索期間",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.id": "Id",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.message": "メッセージ",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.newAlerts": "新しいアラート",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.openActionErrorsFlyout": "アクションエラーフライアウトを開く",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.recoveredAlerts": "回復されたアラート",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.response": "応答",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.ruleId": "ルールID",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.ruleName": "ルール",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduledActions": "生成されたアクション",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduledActionsToolTip": "ルールの実行時に生成されたアクションの合計数。",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduleDelay": "遅延をスケジュール",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.searchPlaceholder": "検索イベントログメッセージ",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.showAll": "すべて表示",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.showOnlyFailures": "失敗のみを表示",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.spaceIds": "スペース",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.succeededActions": "成功したアクション",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.succeededActionsToolTip": "正常に完了したアクションの数。",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.timedOut": "タイムアウトしました",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.timestamp": "タイムスタンプ",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.totalSearchDuration": "合計検索期間",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.triggeredActions": "トリガーされたアクション",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.triggeredActionsToolTip": "実行される生成済みアクションのサブセット。",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.viewActionErrors": "アクションエラーを表示",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogStatusFilterLabel": "応答",
     "xpack.triggersActionsUI.sections.ruleDetails.manageLicensePlanBannerLinkTitle": "ライセンスの管理",
     "xpack.triggersActionsUI.sections.ruleDetails.popoverButtonTitle": "アクション",
     "xpack.triggersActionsUI.sections.ruleDetails.redirectObjectNoun": "ルール",
-    "xpack.triggersActionsUI.sections.ruleDetails.refineSearchPrompt.backToTop": "最上部へ戻る。",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.alertsTabText": "アラート",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.eventLogTabText": "履歴",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.ruleSummary.recoveredLabel": "回復済み",
@@ -35192,7 +35175,6 @@
     "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.alertsTooltip": "最大10,000件の直近のルール実行のアラートステータス。",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.apiError": "イベントログKPIを取得できませんでした。",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.responseTooltip": "最大10,000件の直近のルール実行の応答。",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsRangeNoResult": "0",
     "xpack.triggersActionsUI.sections.ruleDetails.rulesList.ruleLastExecutionDescription": "前回の応答",
     "xpack.triggersActionsUI.sections.ruleDetails.rulesList.status.active": "アクティブ",
     "xpack.triggersActionsUI.sections.ruleDetails.rulesList.status.inactive": "回復済み",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 41cd8383867afc..565b78843a818b 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -34863,15 +34863,9 @@
     "xpack.triggersActionsUI.sections.ruleApi.bulkEditResponse.failure": "无法更新 {failure, plural, other {# 个规则}}的 {property}。",
     "xpack.triggersActionsUI.sections.ruleApi.bulkEditResponse.someSuccess": "已更新 {success, plural, other {# 规则}}的 {property}，{failure, plural, other {# 个规则}}遇到错误。",
     "xpack.triggersActionsUI.sections.ruleApi.bulkEditResponse.success": "已更新 {total, plural, other {# 个规则}}的 {property}。",
-    "xpack.triggersActionsUI.sections.ruleDetails.refineSearchPrompt.prompt": "下面是与您的搜索匹配的前 {visibleDocumentSize} 个文档，请优化您的搜索以查看其他文档。",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.statusPanel.totalExecutions": "过去 24 小时中的 {executions, plural, other {# 次执行}}",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleActionErrorLogFlyout.actionErrorsPlural": "{value, plural, other {个错误操作}}",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleDetailsTitle": "{ruleName}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogDataGrid.erroredActionsCellPopover": "{value, plural, other {个错误操作}}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogDataGrid.erroredActionsTooltip": "{value, plural, other {# 个错误操作}}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResults": "正在显示第 {range} 个（共 {total, number} 个）{type}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsRange": "{start, number} - {end, number}",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsType": "日志{total, plural, other {条目}}",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleExecutionSummaryAndChart.loadSummaryError": "无法加载规则摘要：{message}",
     "xpack.triggersActionsUI.sections.ruleDetails.unableToLoadRuleMessage": "无法加载规则：{message}",
     "xpack.triggersActionsUI.sections.ruleDetails.unableToLoadRulesMessage": "无法加载规则：{message}",
@@ -35186,37 +35180,26 @@
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.activeAlerts": "活动告警",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.apiError": "无法提取执行历史记录",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.duration": "持续时间",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.erroredActions": "错误操作",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.erroredActionsToolTip": "失败的操作数。",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.esSearchDuration": "ES 搜索持续时间",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.id": "ID",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.message": "消息",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.newAlerts": "新告警",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.openActionErrorsFlyout": "打开操作错误浮出控件",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.recoveredAlerts": "已恢复告警",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.response": "响应",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.ruleId": "规则 ID",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.ruleName": "规则",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduledActions": "生成的操作",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduledActionsToolTip": "运行规则时生成的总操作数。",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduleDelay": "计划延迟",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.searchPlaceholder": "搜索事件日志消息",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.showAll": "全部显示",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.showOnlyFailures": "仅显示失败次数",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.spaceIds": "工作区",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.succeededActions": "成功的操作",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.succeededActionsToolTip": "已成功完成的操作数。",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.timedOut": "已超时",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.timestamp": "时间戳",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.totalSearchDuration": "搜索持续时间总计",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.triggeredActions": "已触发操作",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.triggeredActionsToolTip": "将运行的所生成操作的子集。",
     "xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.viewActionErrors": "查看操作错误",
-    "xpack.triggersActionsUI.sections.ruleDetails.eventLogStatusFilterLabel": "响应",
     "xpack.triggersActionsUI.sections.ruleDetails.manageLicensePlanBannerLinkTitle": "管理许可证",
     "xpack.triggersActionsUI.sections.ruleDetails.popoverButtonTitle": "操作",
     "xpack.triggersActionsUI.sections.ruleDetails.redirectObjectNoun": "规则",
-    "xpack.triggersActionsUI.sections.ruleDetails.refineSearchPrompt.backToTop": "返回顶部。",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.alertsTabText": "告警",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.eventLogTabText": "历史记录",
     "xpack.triggersActionsUI.sections.ruleDetails.rule.ruleSummary.recoveredLabel": "已恢复",
@@ -35228,7 +35211,6 @@
     "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.alertsTooltip": "多达 10,000 次最近规则运行的告警状态。",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.apiError": "无法提取事件日志 KPI。",
     "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.responseTooltip": "多达 10,000 次最近规则运行的响应。",
-    "xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsRangeNoResult": "0",
     "xpack.triggersActionsUI.sections.ruleDetails.rulesList.ruleLastExecutionDescription": "上次响应",
     "xpack.triggersActionsUI.sections.ruleDetails.rulesList.status.active": "活动",
     "xpack.triggersActionsUI.sections.ruleDetails.rulesList.status.inactive": "已恢复",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/connectors_app.tsx b/x-pack/plugins/triggers_actions_ui/public/application/connectors_app.tsx
index 78b2559cc3dec1..86993635219835 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/connectors_app.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/connectors_app.tsx
@@ -6,7 +6,7 @@
  */
 
 import React, { lazy } from 'react';
-import { Switch, Route, Router } from 'react-router-dom';
+import { Switch, Route, Router, Redirect } from 'react-router-dom';
 import { ChromeBreadcrumb, CoreStart, CoreTheme, ScopedHistory } from '@kbn/core/public';
 import { render, unmountComponentAtNode } from 'react-dom';
 import { I18nProvider } from '@kbn/i18n-react';
@@ -35,9 +35,10 @@ import {
 import { setDataViewsService } from '../common/lib/data_apis';
 import { KibanaContextProvider, useKibana } from '../common/lib/kibana';
 import { ConnectorProvider } from './context/connector_context';
+import { Section } from './constants';
 
-const ActionsConnectorsList = lazy(
-  () => import('./sections/actions_connectors_list/components/actions_connectors_list')
+const ActionsConnectorsHome = lazy(
+  () => import('./sections/actions_connectors_list/components/actions_connectors_home')
 );
 
 export interface TriggersAndActionsUiServices extends CoreStart {
@@ -72,6 +73,8 @@ export const renderApp = (deps: TriggersAndActionsUiServices) => {
 export const App = ({ deps }: { deps: TriggersAndActionsUiServices }) => {
   const { dataViews, uiSettings, theme$ } = deps;
   const isDarkMode = useObservable<boolean>(uiSettings.get$('theme:darkMode'));
+  const sections: Section[] = ['connectors', 'logs'];
+  const sectionsRegex = sections.join('|');
 
   setDataViewsService(dataViews);
   return (
@@ -80,7 +83,7 @@ export const App = ({ deps }: { deps: TriggersAndActionsUiServices }) => {
         <KibanaThemeProvider theme$={theme$}>
           <KibanaContextProvider services={{ ...deps }}>
             <Router history={deps.history}>
-              <AppWithoutRouter />
+              <AppWithoutRouter sectionsRegex={sectionsRegex} />
             </Router>
           </KibanaContextProvider>
         </KibanaThemeProvider>
@@ -89,7 +92,7 @@ export const App = ({ deps }: { deps: TriggersAndActionsUiServices }) => {
   );
 };
 
-export const AppWithoutRouter = () => {
+export const AppWithoutRouter = ({ sectionsRegex }: { sectionsRegex: string }) => {
   const {
     actions: { validateEmailAddresses },
   } = useKibana().services;
@@ -97,7 +100,12 @@ export const AppWithoutRouter = () => {
   return (
     <ConnectorProvider value={{ services: { validateEmailAddresses } }}>
       <Switch>
-        <Route path={'/'} component={suspendedComponentWithProps(ActionsConnectorsList, 'xl')} />
+        <Route
+          path={`/:section(${sectionsRegex})`}
+          component={suspendedComponentWithProps(ActionsConnectorsHome, 'xl')}
+        />
+
+        <Redirect from={'/'} to="connectors" />
       </Switch>
     </ConnectorProvider>
   );
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts
index f5a94022456305..2ce268be6c58e9 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts
@@ -88,3 +88,22 @@ export const LOCKED_COLUMNS = [
 export const RULE_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS = [...LOCKED_COLUMNS.slice(1)];
 export const GLOBAL_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS = ['rule_name', ...LOCKED_COLUMNS];
 export const DEFAULT_NUMBER_FORMAT = 'format:number:defaultPattern';
+
+export const CONNECTOR_EXECUTION_LOG_COLUMN_IDS = [
+  'connector_id',
+  'space_ids',
+  'id',
+  'timestamp',
+  'status',
+  'connector_name',
+  'message',
+  'execution_duration',
+  'schedule_delay',
+  'timed_out',
+] as const;
+
+export const CONNECTOR_LOCKED_COLUMNS = ['timestamp', 'status', 'connector_name', 'message'];
+
+export const GLOBAL_CONNECTOR_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS = [
+  ...CONNECTOR_LOCKED_COLUMNS,
+];
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/hooks/use_multiple_spaces.ts b/x-pack/plugins/triggers_actions_ui/public/application/hooks/use_multiple_spaces.ts
new file mode 100644
index 00000000000000..3edba4c454bf03
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/hooks/use_multiple_spaces.ts
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useCallback, useMemo } from 'react';
+import { useSpacesData } from '../../common/lib/kibana';
+
+interface UseMultipleSpacesProps {
+  setShowFromAllSpaces: React.Dispatch<React.SetStateAction<boolean>>;
+  showFromAllSpaces: boolean;
+  visibleColumns: string[];
+  setVisibleColumns: React.Dispatch<React.SetStateAction<string[]>>;
+}
+
+export const useMultipleSpaces = (props: UseMultipleSpacesProps) => {
+  const { setShowFromAllSpaces, showFromAllSpaces, visibleColumns, setVisibleColumns } = props;
+
+  const spacesData = useSpacesData();
+
+  const onShowAllSpacesChange = useCallback(() => {
+    setShowFromAllSpaces((prev) => !prev);
+    const nextShowFromAllSpaces = !showFromAllSpaces;
+
+    if (nextShowFromAllSpaces && !visibleColumns.includes('space_ids')) {
+      const connectorNameIndex = visibleColumns.findIndex((c) => c === 'connector_name');
+      const newVisibleColumns = [...visibleColumns];
+      newVisibleColumns.splice(connectorNameIndex + 1, 0, 'space_ids');
+      setVisibleColumns(newVisibleColumns);
+    } else if (!nextShowFromAllSpaces && visibleColumns.includes('space_ids')) {
+      setVisibleColumns(visibleColumns.filter((c) => c !== 'space_ids'));
+    }
+  }, [setShowFromAllSpaces, showFromAllSpaces, visibleColumns, setVisibleColumns]);
+
+  const accessibleSpaceIds = useMemo(
+    () => (spacesData ? [...spacesData.spacesMap.values()].map((e) => e.id) : []),
+    [spacesData]
+  );
+  const canAccessMultipleSpaces = useMemo(
+    () => accessibleSpaceIds.length > 1,
+    [accessibleSpaceIds]
+  );
+  const namespaces = useMemo(
+    () => (showFromAllSpaces && spacesData ? accessibleSpaceIds : undefined),
+    [showFromAllSpaces, spacesData, accessibleSpaceIds]
+  );
+  const activeSpace = useMemo(
+    () => spacesData?.spacesMap.get(spacesData?.activeSpaceId),
+    [spacesData]
+  );
+
+  return {
+    onShowAllSpacesChange,
+    canAccessMultipleSpaces,
+    namespaces,
+    activeSpace,
+  };
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/index.ts
index 7cc4f1df6a7353..01b4ca62845fa0 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/index.ts
@@ -11,3 +11,7 @@ export { createActionConnector } from './create';
 export { deleteActions } from './delete';
 export { executeAction } from './execute';
 export { updateActionConnector } from './update';
+export type { LoadGlobalConnectorExecutionLogAggregationsProps } from './load_execution_log_aggregations';
+export { loadGlobalConnectorExecutionLogAggregations } from './load_execution_log_aggregations';
+export type { LoadGlobalConnectorExecutionKPIAggregationsProps } from './load_execution_kpi_aggregations';
+export { loadGlobalConnectorExecutionKPIAggregations } from './load_execution_kpi_aggregations';
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_kpi_aggregations.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_kpi_aggregations.test.ts
new file mode 100644
index 00000000000000..8eb0da02cca8c0
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_kpi_aggregations.test.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { httpServiceMock } from '@kbn/core/public/mocks';
+import { loadGlobalConnectorExecutionKPIAggregations } from './load_execution_kpi_aggregations';
+
+const http = httpServiceMock.createStartContract();
+
+const mockResponse = {
+  failure: 0,
+  success: 1,
+  unknown: 0,
+  warning: 0,
+};
+
+describe('loadGlobalConnectorExecutionKPIAggregations', () => {
+  test('should call load execution kpi aggregation API', async () => {
+    http.post.mockResolvedValueOnce(mockResponse);
+
+    const result = await loadGlobalConnectorExecutionKPIAggregations({
+      dateStart: '2022-03-23T16:17:53.482Z',
+      dateEnd: '2022-03-23T16:17:53.482Z',
+      outcomeFilter: ['success', 'warning'],
+      message: 'test-message',
+      http,
+    });
+
+    expect(result).toEqual({
+      ...mockResponse,
+    });
+
+    expect(http.post.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "/internal/actions/_global_connector_execution_kpi",
+        Object {
+          "body": "{\\"filter\\":\\"(message: \\\\\\"test-message\\\\\\" OR error.message: \\\\\\"test-message\\\\\\") and (kibana.alerting.outcome:success OR (event.outcome: success AND NOT kibana.alerting.outcome:*) OR kibana.alerting.outcome: warning)\\",\\"date_start\\":\\"2022-03-23T16:17:53.482Z\\",\\"date_end\\":\\"2022-03-23T16:17:53.482Z\\"}",
+        },
+      ]
+    `);
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_kpi_aggregations.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_kpi_aggregations.ts
new file mode 100644
index 00000000000000..34e4fca1916737
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_kpi_aggregations.ts
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { HttpSetup } from '@kbn/core/public';
+import { IExecutionKPIResult } from '@kbn/actions-plugin/common';
+import { INTERNAL_BASE_ACTION_API_PATH } from '../../constants';
+import { getFilter } from '../rule_api';
+
+export interface LoadGlobalConnectorExecutionKPIAggregationsProps {
+  outcomeFilter?: string[];
+  message?: string;
+  dateStart: string;
+  dateEnd?: string;
+  namespaces?: Array<string | undefined>;
+}
+
+export const loadGlobalConnectorExecutionKPIAggregations = ({
+  http,
+  outcomeFilter,
+  message,
+  dateStart,
+  dateEnd,
+  namespaces,
+}: LoadGlobalConnectorExecutionKPIAggregationsProps & { http: HttpSetup }) => {
+  const filter = getFilter({ outcomeFilter, message });
+
+  return http.post<IExecutionKPIResult>(
+    `${INTERNAL_BASE_ACTION_API_PATH}/_global_connector_execution_kpi`,
+    {
+      body: JSON.stringify({
+        filter: filter.length ? filter.join(' and ') : undefined,
+        date_start: dateStart,
+        date_end: dateEnd,
+        namespaces: namespaces ? JSON.stringify(namespaces) : namespaces,
+      }),
+    }
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_log_aggregations.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_log_aggregations.test.ts
new file mode 100644
index 00000000000000..5e8faffd56f172
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_log_aggregations.test.ts
@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { httpServiceMock } from '@kbn/core/public/mocks';
+import {
+  loadGlobalConnectorExecutionLogAggregations,
+  SortField,
+} from './load_execution_log_aggregations';
+
+const http = httpServiceMock.createStartContract();
+
+const mockResponse = {
+  data: [
+    {
+      connector_name: 'test connector',
+      duration_ms: 1,
+      id: '8b3af07e-7593-4c40-b704-9c06d3b06e58',
+      message: 'action executed: .server-log:6709f660-8d11-11ed-bae5-bd32cbc9eaaa: test connector',
+      schedule_delay_ms: 2783,
+      space_ids: ['default'],
+      status: 'success',
+      timestamp: '2023-01-05T15:55:50.495Z',
+      version: '8.7.0',
+    },
+  ],
+  total: 1,
+};
+
+describe('loadGlobalConnectorExecutionLogAggregations', () => {
+  test('should call load execution log aggregation API', async () => {
+    http.post.mockResolvedValueOnce(mockResponse);
+
+    const sortTimestamp = {
+      timestamp: {
+        order: 'asc',
+      },
+    } as SortField;
+
+    const result = await loadGlobalConnectorExecutionLogAggregations({
+      dateStart: '2022-03-23T16:17:53.482Z',
+      dateEnd: '2022-03-23T16:17:53.482Z',
+      outcomeFilter: ['success', 'warning'],
+      message: 'test-message',
+      perPage: 10,
+      page: 0,
+      sort: [sortTimestamp],
+      http,
+    });
+
+    expect(result).toEqual({
+      ...mockResponse,
+      data: [
+        {
+          connector_name: 'test connector',
+          execution_duration: 1,
+          id: '8b3af07e-7593-4c40-b704-9c06d3b06e58',
+          message:
+            'action executed: .server-log:6709f660-8d11-11ed-bae5-bd32cbc9eaaa: test connector',
+          schedule_delay: 2783,
+          space_ids: ['default'],
+          status: 'success',
+          timestamp: '2023-01-05T15:55:50.495Z',
+          version: '8.7.0',
+        },
+      ],
+    });
+
+    expect(http.post.mock.calls[0]).toMatchInlineSnapshot(`
+      Array [
+        "/internal/actions/_global_connector_execution_logs",
+        Object {
+          "body": "{\\"date_start\\":\\"2022-03-23T16:17:53.482Z\\",\\"date_end\\":\\"2022-03-23T16:17:53.482Z\\",\\"filter\\":\\"(message: \\\\\\"test-message\\\\\\" OR error.message: \\\\\\"test-message\\\\\\") and (kibana.alerting.outcome:success OR (event.outcome: success AND NOT kibana.alerting.outcome:*) OR kibana.alerting.outcome: warning)\\",\\"per_page\\":10,\\"page\\":1,\\"sort\\":\\"[{\\\\\\"timestamp\\\\\\":{\\\\\\"order\\\\\\":\\\\\\"asc\\\\\\"}}]\\"}",
+        },
+      ]
+    `);
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_log_aggregations.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_log_aggregations.ts
new file mode 100644
index 00000000000000..210fe3ed310b3c
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_connector_api/load_execution_log_aggregations.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/* eslint-disable @typescript-eslint/naming-convention */
+
+import { HttpSetup } from '@kbn/core/public';
+import type { SortOrder } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import {
+  IExecutionLog,
+  ExecutionLogSortFields,
+  IExecutionLogResult,
+  AsApiContract,
+  INTERNAL_BASE_ACTION_API_PATH,
+  RewriteRequestCase,
+} from '@kbn/actions-plugin/common';
+import { getFilter } from '../rule_api';
+
+const getRenamedLog = (data: IExecutionLog) => {
+  const { duration_ms, schedule_delay_ms, ...rest } = data;
+
+  return {
+    execution_duration: data.duration_ms,
+    schedule_delay: data.schedule_delay_ms,
+    ...rest,
+  };
+};
+
+const rewriteBodyRes: RewriteRequestCase<IExecutionLogResult> = ({ data, ...rest }: any) => ({
+  data: data.map((log: IExecutionLog) => getRenamedLog(log)),
+  ...rest,
+});
+
+export type SortField = Record<
+  ExecutionLogSortFields,
+  {
+    order: SortOrder;
+  }
+>;
+
+export interface LoadGlobalConnectorExecutionLogAggregationsProps {
+  dateStart: string;
+  dateEnd?: string;
+  outcomeFilter?: string[];
+  message?: string;
+  perPage?: number;
+  page?: number;
+  sort?: SortField[];
+  namespaces?: Array<string | undefined>;
+}
+
+export const loadGlobalConnectorExecutionLogAggregations = async ({
+  http,
+  dateStart,
+  dateEnd,
+  outcomeFilter,
+  message,
+  perPage = 10,
+  page = 0,
+  sort = [],
+  namespaces,
+}: LoadGlobalConnectorExecutionLogAggregationsProps & { http: HttpSetup }) => {
+  const sortField: any[] = sort;
+  const filter = getFilter({ outcomeFilter, message });
+
+  const result = await http.post<AsApiContract<IExecutionLogResult>>(
+    `${INTERNAL_BASE_ACTION_API_PATH}/_global_connector_execution_logs`,
+    {
+      body: JSON.stringify({
+        date_start: dateStart,
+        date_end: dateEnd,
+        filter: filter.length ? filter.join(' and ') : undefined,
+        per_page: perPage,
+        // Need to add the + 1 for pages because APIs are 1 indexed,
+        // whereas data grid sorts are 0 indexed.
+        page: page + 1,
+        sort: sortField.length ? JSON.stringify(sortField) : undefined,
+        namespaces: namespaces ? JSON.stringify(namespaces) : undefined,
+      }),
+    }
+  );
+
+  return rewriteBodyRes(result);
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/index.ts
index 74157ac200ce7a..75fc27e86e7734 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/index.ts
@@ -46,5 +46,6 @@ export { runSoon } from './run_soon';
 export { bulkDeleteRules } from './bulk_delete';
 export { bulkEnableRules } from './bulk_enable';
 export { bulkDisableRules } from './bulk_disable';
+export { getFilter } from './get_filter';
 export { getFlappingSettings } from './get_flapping_settings';
 export { updateFlappingSettings } from './update_flapping_settings';
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_kpi.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_kpi.test.tsx
new file mode 100644
index 00000000000000..485a4dbdb695d5
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_kpi.test.tsx
@@ -0,0 +1,133 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { act } from 'react-dom/test-utils';
+import { mountWithIntl, nextTick } from '@kbn/test-jest-helpers';
+import { loadGlobalConnectorExecutionKPIAggregations } from '../../../lib/action_connector_api/load_execution_kpi_aggregations';
+import { ConnectorEventLogListKPI } from './actions_connectors_event_log_list_kpi';
+import { getIsExperimentalFeatureEnabled } from '../../../../common/get_experimental_features';
+
+jest.mock('../../../../common/lib/kibana', () => ({
+  useKibana: jest.fn().mockReturnValue({
+    services: {
+      notifications: { toast: { addDanger: jest.fn() } },
+    },
+  }),
+}));
+
+jest.mock('../../../lib/action_connector_api/load_execution_kpi_aggregations', () => ({
+  loadGlobalConnectorExecutionKPIAggregations: jest.fn(),
+}));
+
+jest.mock('../../../../common/get_experimental_features', () => ({
+  getIsExperimentalFeatureEnabled: jest.fn(),
+}));
+
+const mockKpiResponse = {
+  success: 4,
+  unknown: 0,
+  failure: 60,
+  warning: 10,
+};
+
+const loadGlobalExecutionKPIAggregationsMock =
+  loadGlobalConnectorExecutionKPIAggregations as unknown as jest.MockedFunction<any>;
+
+describe('actions_connectors_event_log_list_kpi', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (getIsExperimentalFeatureEnabled as jest.Mock<any, any>).mockImplementation(() => false);
+    loadGlobalExecutionKPIAggregationsMock.mockResolvedValue(mockKpiResponse);
+  });
+
+  it('renders correctly', async () => {
+    const wrapper = mountWithIntl(
+      <ConnectorEventLogListKPI
+        dateStart="now-24h"
+        dateEnd="now"
+        loadGlobalConnectorExecutionKPIAggregations={loadGlobalExecutionKPIAggregationsMock}
+      />
+    );
+
+    expect(
+      wrapper
+        .find('[data-test-subj="connectorEventLogKpi-successOutcome"] .euiStat__title')
+        .first()
+        .text()
+    ).toEqual('--');
+    expect(
+      wrapper
+        .find('[data-test-subj="connectorEventLogKpi-warningOutcome"] .euiStat__title')
+        .first()
+        .text()
+    ).toEqual('--');
+    expect(
+      wrapper
+        .find('[data-test-subj="connectorEventLogKpi-failureOutcome"] .euiStat__title')
+        .first()
+        .text()
+    ).toEqual('--');
+
+    // Let the load resolve
+    await act(async () => {
+      await nextTick();
+      wrapper.update();
+    });
+
+    expect(loadGlobalConnectorExecutionKPIAggregations).toHaveBeenCalledWith(
+      expect.objectContaining({
+        message: undefined,
+        outcomeFilter: undefined,
+      })
+    );
+
+    expect(
+      wrapper
+        .find('[data-test-subj="connectorEventLogKpi-successOutcome"] .euiStat__title')
+        .first()
+        .text()
+    ).toEqual(`${mockKpiResponse.success}`);
+    expect(
+      wrapper
+        .find('[data-test-subj="connectorEventLogKpi-warningOutcome"] .euiStat__title')
+        .first()
+        .text()
+    ).toEqual(`${mockKpiResponse.warning}`);
+    expect(
+      wrapper
+        .find('[data-test-subj="connectorEventLogKpi-failureOutcome"] .euiStat__title')
+        .first()
+        .text()
+    ).toEqual(`${mockKpiResponse.failure}`);
+  });
+
+  it('calls KPI API with filters', async () => {
+    const wrapper = mountWithIntl(
+      <ConnectorEventLogListKPI
+        dateStart="now-24h"
+        dateEnd="now"
+        message="test"
+        outcomeFilter={['status: 123', 'test:456']}
+        loadGlobalConnectorExecutionKPIAggregations={loadGlobalExecutionKPIAggregationsMock}
+      />
+    );
+
+    // Let the load resolve
+    await act(async () => {
+      await nextTick();
+      wrapper.update();
+    });
+
+    expect(loadGlobalExecutionKPIAggregationsMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        message: 'test',
+        outcomeFilter: ['status: 123', 'test:456'],
+      })
+    );
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_kpi.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_kpi.tsx
new file mode 100644
index 00000000000000..611138d6bc0f3d
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_kpi.tsx
@@ -0,0 +1,187 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useEffect, useState, useMemo, useRef } from 'react';
+import { i18n } from '@kbn/i18n';
+import datemath from '@kbn/datemath';
+import { EuiFlexGroup, EuiFlexItem, EuiStat, EuiSpacer } from '@elastic/eui';
+import { IExecutionKPIResult } from '@kbn/actions-plugin/common';
+import {
+  ComponentOpts as ConnectorApis,
+  withActionOperations,
+} from '../../common/components/with_actions_api_operations';
+import { getIsExperimentalFeatureEnabled } from '../../../../common/get_experimental_features';
+import { useKibana } from '../../../../common/lib/kibana';
+import { EventLogListStatus, EventLogStat } from '../../common/components/event_log';
+
+const getParsedDate = (date: string) => {
+  if (date.includes('now')) {
+    return datemath.parse(date)?.format() || date;
+  }
+  return date;
+};
+
+const API_FAILED_MESSAGE = i18n.translate(
+  'xpack.triggersActionsUI.sections.connectorEventLogListKpi.apiError',
+  {
+    defaultMessage: 'Failed to fetch event log KPI.',
+  }
+);
+
+const RESPONSE_TOOLTIP = i18n.translate(
+  'xpack.triggersActionsUI.sections.connectorEventLogListKpi.responseTooltip',
+  {
+    defaultMessage: 'The responses for up to 10,000 most recent actions triggered.',
+  }
+);
+
+export type ConnectorEventLogListKPIProps = {
+  dateStart: string;
+  dateEnd: string;
+  outcomeFilter?: string[];
+  message?: string;
+  refreshToken?: number;
+  namespaces?: Array<string | undefined>;
+} & Pick<ConnectorApis, 'loadGlobalConnectorExecutionKPIAggregations'>;
+
+export const ConnectorEventLogListKPI = (props: ConnectorEventLogListKPIProps) => {
+  const {
+    dateStart,
+    dateEnd,
+    outcomeFilter,
+    message,
+    refreshToken,
+    namespaces,
+    loadGlobalConnectorExecutionKPIAggregations,
+  } = props;
+  const {
+    notifications: { toasts },
+  } = useKibana().services;
+
+  const isInitialized = useRef(false);
+  const isUsingExecutionStatus = getIsExperimentalFeatureEnabled('ruleUseExecutionStatus');
+
+  const [isLoading, setIsLoading] = useState<boolean>(false);
+  const [kpi, setKpi] = useState<IExecutionKPIResult>();
+
+  const loadKPIFn = useMemo(() => {
+    return loadGlobalConnectorExecutionKPIAggregations;
+  }, [loadGlobalConnectorExecutionKPIAggregations]);
+
+  const loadKPIs = async () => {
+    setIsLoading(true);
+    try {
+      const newKpi = await loadKPIFn({
+        dateStart: getParsedDate(dateStart),
+        dateEnd: getParsedDate(dateEnd),
+        outcomeFilter,
+        message,
+        ...(namespaces ? { namespaces } : {}),
+      });
+      setKpi(newKpi);
+    } catch (e) {
+      toasts.addDanger({
+        title: API_FAILED_MESSAGE,
+        text: e.body?.message ?? e,
+      });
+    }
+    setIsLoading(false);
+  };
+
+  useEffect(() => {
+    loadKPIs();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [dateStart, dateEnd, outcomeFilter, message, namespaces]);
+
+  useEffect(() => {
+    if (isInitialized.current) {
+      loadKPIs();
+    }
+    isInitialized.current = true;
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [refreshToken]);
+
+  const isLoadingData = useMemo(() => isLoading || !kpi, [isLoading, kpi]);
+
+  const getStatDescription = (element: React.ReactNode) => {
+    return (
+      <>
+        {element}
+        <EuiSpacer size="s" />
+      </>
+    );
+  };
+
+  return (
+    <EuiFlexGroup>
+      <EuiFlexItem grow={4}>
+        <EventLogStat title="Responses" tooltip={RESPONSE_TOOLTIP}>
+          <EuiFlexGroup>
+            <EuiFlexItem>
+              <EuiStat
+                data-test-subj="connectorEventLogKpi-successOutcome"
+                description={getStatDescription(
+                  <EventLogListStatus
+                    status="success"
+                    useExecutionStatus={isUsingExecutionStatus}
+                  />
+                )}
+                titleSize="s"
+                title={kpi?.success ?? 0}
+                isLoading={isLoadingData}
+              />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiStat
+                data-test-subj="connectorEventLogKpi-warningOutcome"
+                description={getStatDescription(
+                  <EventLogListStatus
+                    status="warning"
+                    useExecutionStatus={isUsingExecutionStatus}
+                  />
+                )}
+                titleSize="s"
+                title={kpi?.warning ?? 0}
+                isLoading={isLoadingData}
+              />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiStat
+                data-test-subj="connectorEventLogKpi-failureOutcome"
+                description={getStatDescription(
+                  <EventLogListStatus
+                    status="failure"
+                    useExecutionStatus={isUsingExecutionStatus}
+                  />
+                )}
+                titleSize="s"
+                title={kpi?.failure ?? 0}
+                isLoading={isLoadingData}
+              />
+            </EuiFlexItem>
+            <EuiFlexItem>
+              <EuiStat
+                data-test-subj="connectorEventLogKpi-unknownOutcome"
+                description={getStatDescription(
+                  <EventLogListStatus
+                    status="unknown"
+                    useExecutionStatus={isUsingExecutionStatus}
+                  />
+                )}
+                titleSize="s"
+                title={kpi?.unknown ?? 0}
+                isLoading={isLoadingData}
+              />
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EventLogStat>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+export const ConnectorEventLogListKPIWithApi = withActionOperations(ConnectorEventLogListKPI);
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_table.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_table.test.tsx
new file mode 100644
index 00000000000000..6707a27b7e701d
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_table.test.tsx
@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { act } from 'react-dom/test-utils';
+import { mountWithIntl, nextTick } from '@kbn/test-jest-helpers';
+import { loadGlobalConnectorExecutionLogAggregations } from '../../../lib/action_connector_api/load_execution_log_aggregations';
+import { ConnectorEventLogListTable } from './actions_connectors_event_log_list_table';
+import { getIsExperimentalFeatureEnabled } from '../../../../common/get_experimental_features';
+
+jest.mock('../../../../common/lib/kibana', () => ({
+  ...jest.requireActual('../../../../common/lib/kibana'),
+  useKibana: jest.fn().mockReturnValue({
+    services: {
+      notifications: { toasts: { addDanger: jest.fn() } },
+    },
+  }),
+}));
+
+jest.mock('../../../../common/get_experimental_features', () => ({
+  getIsExperimentalFeatureEnabled: jest.fn(),
+}));
+
+jest.mock('../../../lib/action_connector_api/load_execution_log_aggregations', () => ({
+  loadGlobalConnectorExecutionLogAggregations: jest.fn(),
+}));
+
+const mockResponse = {
+  total: 1,
+  data: [
+    {
+      connector_id: '86020b10-9b3b-11ed-8422-2f5a388a317d',
+      connector_name: 'test connector',
+      duration_ms: 0,
+      id: '3895f21e-8de8-416f-9ab2-6ca5f8a4b294',
+      message: 'action executed: .server-log:86020b10-9b3b-11ed-8422-2f5a388a317d: test',
+      schedule_delay_ms: 2923,
+      space_ids: ['default'],
+      status: 'success',
+      timed_out: false,
+      timestamp: '2023-01-23T16:41:01.260Z',
+      version: '8.7.0',
+    },
+  ],
+};
+
+const loadGlobalExecutionLogAggregationsMock =
+  loadGlobalConnectorExecutionLogAggregations as unknown as jest.MockedFunction<any>;
+
+describe('actions_connectors_event_log_list_table', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (getIsExperimentalFeatureEnabled as jest.Mock<any, any>).mockImplementation(() => false);
+    loadGlobalExecutionLogAggregationsMock.mockResolvedValue(mockResponse);
+  });
+
+  it('renders correctly', async () => {
+    const wrapper = mountWithIntl(
+      <ConnectorEventLogListTable
+        refreshToken={0}
+        initialPageSize={50}
+        hasConnectorNames={true}
+        hasAllSpaceSwitch={true}
+        loadGlobalConnectorExecutionLogAggregations={loadGlobalExecutionLogAggregationsMock}
+      />
+    );
+
+    expect(wrapper.find('[data-test-subj="connectorEventLogListProgressBar"]')).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="connectorEventLogListDatePicker"]')).toBeTruthy();
+    expect(wrapper.find('[data-test-subj="connectorEventLogListKpi"]')).toBeTruthy();
+
+    // Let the load resolve
+    await act(async () => {
+      await nextTick();
+      wrapper.update();
+    });
+
+    expect(loadGlobalConnectorExecutionLogAggregations).toHaveBeenCalledWith(
+      expect.objectContaining({
+        message: '',
+        namespaces: undefined,
+        outcomeFilter: [],
+        page: 0,
+        perPage: 50,
+        sort: [],
+      })
+    );
+
+    expect(wrapper.find('[data-test-subj="connectorEventLogListProgressBar"]')).toEqual({});
+    expect(
+      wrapper
+        .find('[data-gridcell-column-id="timestamp"] .euiDataGridRowCell__truncate')
+        .first()
+        .text()
+    ).toBeTruthy();
+    expect(
+      wrapper
+        .find('[data-gridcell-column-id="status"] .euiDataGridRowCell__truncate')
+        .first()
+        .text()
+    ).toEqual('succeeded');
+    expect(
+      wrapper
+        .find('[data-gridcell-column-id="connector_name"] .euiDataGridRowCell__truncate')
+        .first()
+        .text()
+    ).toEqual('test connector');
+    expect(
+      wrapper
+        .find('[data-gridcell-column-id="message"] .euiDataGridRowCell__truncate')
+        .first()
+        .text()
+    ).toEqual('action executed: .server-log:86020b10-9b3b-11ed-8422-2f5a388a317d: test');
+  });
+});
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_table.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_table.tsx
new file mode 100644
index 00000000000000..53b7d99483049f
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_event_log_list_table.tsx
@@ -0,0 +1,597 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useEffect, useState, useMemo, useRef } from 'react';
+import { i18n } from '@kbn/i18n';
+import datemath from '@kbn/datemath';
+import {
+  EuiFieldSearch,
+  EuiFlexItem,
+  EuiFlexGroup,
+  EuiProgress,
+  EuiSpacer,
+  EuiDataGridSorting,
+  Pagination,
+  EuiSuperDatePicker,
+  OnTimeChangeProps,
+  EuiSwitch,
+  EuiDataGridColumn,
+} from '@elastic/eui';
+import { SpacesContextProps } from '@kbn/spaces-plugin/public';
+import { IExecutionLog } from '@kbn/actions-plugin/common';
+import { useKibana } from '../../../../common/lib/kibana';
+import {
+  GLOBAL_CONNECTOR_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS,
+  CONNECTOR_LOCKED_COLUMNS,
+} from '../../../constants';
+import { CenterJustifiedSpinner } from '../../../components/center_justified_spinner';
+import { LoadGlobalConnectorExecutionLogAggregationsProps } from '../../../lib/action_connector_api';
+import {
+  ComponentOpts as ConnectorApis,
+  withActionOperations,
+} from '../../common/components/with_actions_api_operations';
+import { RefineSearchPrompt } from '../../common/components/refine_search_prompt';
+import { ConnectorEventLogListKPIWithApi as ConnectorEventLogListKPI } from './actions_connectors_event_log_list_kpi';
+import {
+  EventLogDataGrid,
+  EventLogListStatusFilter,
+  getIsColumnSortable,
+} from '../../common/components/event_log';
+import { useMultipleSpaces } from '../../../hooks/use_multiple_spaces';
+
+const getEmptyFunctionComponent: React.FC<SpacesContextProps> = ({ children }) => <>{children}</>;
+
+const getParsedDate = (date: string) => {
+  if (date.includes('now')) {
+    return datemath.parse(date)?.format() || date;
+  }
+  return date;
+};
+
+const API_FAILED_MESSAGE = i18n.translate(
+  'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.apiError',
+  {
+    defaultMessage: 'Failed to fetch execution history',
+  }
+);
+
+const SEARCH_PLACEHOLDER = i18n.translate(
+  'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.searchPlaceholder',
+  {
+    defaultMessage: 'Search event log message',
+  }
+);
+
+const CONNECTOR_EVENT_LOG_LIST_STORAGE_KEY =
+  'xpack.triggersActionsUI.connectorEventLogList.initialColumns';
+
+const getDefaultColumns = (columns: string[]) => {
+  const columnsWithoutLockedColumn = columns.filter(
+    (column) => !CONNECTOR_LOCKED_COLUMNS.includes(column)
+  );
+  return [...CONNECTOR_LOCKED_COLUMNS, ...columnsWithoutLockedColumn];
+};
+
+const ALL_SPACES_LABEL = i18n.translate(
+  'xpack.triggersActionsUI.connectorEventLogList.showAllSpacesToggle',
+  {
+    defaultMessage: 'Show connectors from all spaces',
+  }
+);
+
+const updateButtonProps = {
+  iconOnly: true,
+  fill: false,
+};
+
+const MAX_RESULTS = 1000;
+
+export type ConnectorEventLogListOptions = 'stackManagement' | 'default';
+
+export type ConnectorEventLogListCommonProps = {
+  localStorageKey?: string;
+  refreshToken?: number;
+  initialPageSize?: number;
+  hasConnectorNames?: boolean;
+  hasAllSpaceSwitch?: boolean;
+} & Pick<ConnectorApis, 'loadGlobalConnectorExecutionLogAggregations'>;
+
+export type ConnectorEventLogListTableProps<T extends ConnectorEventLogListOptions = 'default'> =
+  T extends 'default'
+    ? ConnectorEventLogListCommonProps
+    : T extends 'stackManagement'
+    ? ConnectorEventLogListCommonProps
+    : never;
+
+export const ConnectorEventLogListTable = <T extends ConnectorEventLogListOptions>(
+  props: ConnectorEventLogListTableProps<T>
+) => {
+  const {
+    localStorageKey = CONNECTOR_EVENT_LOG_LIST_STORAGE_KEY,
+    refreshToken,
+    loadGlobalConnectorExecutionLogAggregations,
+    initialPageSize = 10,
+    hasConnectorNames = false,
+    hasAllSpaceSwitch = false,
+  } = props;
+
+  const { uiSettings, notifications } = useKibana().services;
+
+  const [searchText, setSearchText] = useState<string>('');
+  const [search, setSearch] = useState<string>('');
+  const [internalRefreshToken, setInternalRefreshToken] = useState<number | undefined>(
+    refreshToken
+  );
+  const [showFromAllSpaces, setShowFromAllSpaces] = useState(false);
+
+  // Data grid states
+  const [logs, setLogs] = useState<IExecutionLog[]>();
+  const [visibleColumns, setVisibleColumns] = useState<string[]>(() => {
+    return getDefaultColumns(GLOBAL_CONNECTOR_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS);
+  });
+  const [sortingColumns, setSortingColumns] = useState<EuiDataGridSorting['columns']>([]);
+  const [filter, setFilter] = useState<string[]>([]);
+  const [actualTotalItemCount, setActualTotalItemCount] = useState<number>(0);
+  const [pagination, setPagination] = useState<Pagination>({
+    pageIndex: 0,
+    pageSize: initialPageSize,
+    totalItemCount: 0,
+  });
+
+  // Date related states
+  const [isLoading, setIsLoading] = useState<boolean>(false);
+  const [dateStart, setDateStart] = useState<string>('now-24h');
+  const [dateEnd, setDateEnd] = useState<string>('now');
+  const [dateFormat] = useState(() => uiSettings?.get('dateFormat'));
+  const [commonlyUsedRanges] = useState(() => {
+    return (
+      uiSettings
+        ?.get('timepicker:quickRanges')
+        ?.map(({ from, to, display }: { from: string; to: string; display: string }) => ({
+          start: from,
+          end: to,
+          label: display,
+        })) || []
+    );
+  });
+
+  const { onShowAllSpacesChange, canAccessMultipleSpaces, namespaces } = useMultipleSpaces({
+    setShowFromAllSpaces,
+    showFromAllSpaces,
+    visibleColumns,
+    setVisibleColumns,
+  });
+
+  const isInitialized = useRef(false);
+
+  const isOnLastPage = useMemo(() => {
+    const { pageIndex, pageSize } = pagination;
+    return (pageIndex + 1) * pageSize >= MAX_RESULTS;
+  }, [pagination]);
+
+  // Formats the sort columns to be consumed by the API endpoint
+  const formattedSort = useMemo(() => {
+    return sortingColumns.map(({ id: sortId, direction }) => ({
+      [sortId]: {
+        order: direction,
+      },
+    }));
+  }, [sortingColumns]);
+
+  const loadEventLogs = async () => {
+    if (!loadGlobalConnectorExecutionLogAggregations) {
+      return;
+    }
+    setIsLoading(true);
+    try {
+      const result = await loadGlobalConnectorExecutionLogAggregations({
+        sort: formattedSort as LoadGlobalConnectorExecutionLogAggregationsProps['sort'],
+        outcomeFilter: filter,
+        message: searchText,
+        dateStart: getParsedDate(dateStart),
+        dateEnd: getParsedDate(dateEnd),
+        page: pagination.pageIndex,
+        perPage: pagination.pageSize,
+        namespaces,
+      });
+      setLogs(result.data);
+      setPagination({
+        ...pagination,
+        totalItemCount: Math.min(result.total, MAX_RESULTS),
+      });
+      setActualTotalItemCount(result.total);
+    } catch (e) {
+      notifications.toasts.addDanger({
+        title: API_FAILED_MESSAGE,
+        text: e.body?.message ?? e,
+      });
+    }
+    setIsLoading(false);
+  };
+
+  const onChangeItemsPerPage = useCallback(
+    (pageSize: number) => {
+      setPagination((prevPagination) => ({
+        ...prevPagination,
+        pageIndex: 0,
+        pageSize,
+      }));
+    },
+    [setPagination]
+  );
+
+  const onChangePage = useCallback(
+    (pageIndex: number) => {
+      setPagination((prevPagination) => ({
+        ...prevPagination,
+        pageIndex,
+      }));
+    },
+    [setPagination]
+  );
+
+  const onTimeChange = useCallback(
+    ({ start, end, isInvalid }: OnTimeChangeProps) => {
+      if (isInvalid) {
+        return;
+      }
+      setDateStart(start);
+      setDateEnd(end);
+    },
+    [setDateStart, setDateEnd]
+  );
+
+  const onRefresh = () => {
+    setInternalRefreshToken(Date.now());
+    loadEventLogs();
+  };
+
+  const onFilterChange = useCallback(
+    (newFilter: string[]) => {
+      setPagination((prevPagination) => ({
+        ...prevPagination,
+        pageIndex: 0,
+      }));
+      setFilter(newFilter);
+    },
+    [setPagination, setFilter]
+  );
+
+  const onSearchChange = useCallback(
+    (e) => {
+      if (e.target.value === '') {
+        setSearchText('');
+      }
+      setSearch(e.target.value);
+    },
+    [setSearchText, setSearch]
+  );
+
+  const onKeyUp = useCallback(
+    (e) => {
+      if (e.key === 'Enter') {
+        setSearchText(search);
+      }
+    },
+    [search, setSearchText]
+  );
+
+  const columns: EuiDataGridColumn[] = useMemo(
+    () => [
+      {
+        id: 'connector_id',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.connectorId',
+          {
+            defaultMessage: 'Connector Id',
+          }
+        ),
+        isSortable: getIsColumnSortable('connector_id'),
+      },
+      {
+        id: 'id',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.id',
+          {
+            defaultMessage: 'Execution Id',
+          }
+        ),
+        isSortable: getIsColumnSortable('id'),
+      },
+      {
+        id: 'timestamp',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.timestamp',
+          {
+            defaultMessage: 'Timestamp',
+          }
+        ),
+        isSortable: getIsColumnSortable('timestamp'),
+        isResizable: false,
+        actions: {
+          showHide: false,
+        },
+        initialWidth: 250,
+      },
+      {
+        id: 'status',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.response',
+          {
+            defaultMessage: 'Response',
+          }
+        ),
+        actions: {
+          showHide: false,
+          showSortAsc: false,
+          showSortDesc: false,
+          additional: [
+            {
+              iconType: 'annotation',
+              label: i18n.translate(
+                'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.showOnlyFailures',
+                {
+                  defaultMessage: 'Show only failures',
+                }
+              ),
+              onClick: () => onFilterChange(['failure']),
+              size: 'xs',
+            },
+            {
+              iconType: 'annotation',
+              label: i18n.translate(
+                'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.showAll',
+                {
+                  defaultMessage: 'Show all',
+                }
+              ),
+              onClick: () => onFilterChange([]),
+              size: 'xs',
+            },
+          ],
+        },
+        isSortable: getIsColumnSortable('status'),
+        isResizable: false,
+        initialWidth: 150,
+      },
+      ...(hasConnectorNames
+        ? [
+            {
+              id: 'connector_name',
+              displayAsText: i18n.translate(
+                'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.connectorName',
+                {
+                  defaultMessage: 'Connector',
+                }
+              ),
+              isSortable: getIsColumnSortable('connector_name'),
+              actions: {
+                showSortAsc: false,
+                showSortDesc: false,
+                showHide: false,
+              },
+            },
+          ]
+        : []),
+      {
+        id: 'message',
+        actions: {
+          showSortAsc: false,
+          showSortDesc: false,
+        },
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.message',
+          {
+            defaultMessage: 'Message',
+          }
+        ),
+        isSortable: getIsColumnSortable('message'),
+        cellActions: [],
+      },
+      {
+        id: 'execution_duration',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.duration',
+          {
+            defaultMessage: 'Duration',
+          }
+        ),
+        isSortable: getIsColumnSortable('execution_duration'),
+        isResizable: false,
+        actions: {
+          showHide: false,
+        },
+        initialWidth: 100,
+      },
+      {
+        id: 'schedule_delay',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.scheduleDelay',
+          {
+            defaultMessage: 'Schedule delay',
+          }
+        ),
+        isSortable: getIsColumnSortable('schedule_delay'),
+      },
+      {
+        id: 'timed_out',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.timedOut',
+          {
+            defaultMessage: 'Timed out',
+          }
+        ),
+        isSortable: getIsColumnSortable('timed_out'),
+      },
+      ...(showFromAllSpaces
+        ? [
+            {
+              id: 'space_ids',
+              displayAsText: i18n.translate(
+                'xpack.triggersActionsUI.sections.connectorEventLogList.eventLogColumn.spaceIds',
+                {
+                  defaultMessage: 'Space',
+                }
+              ),
+              isSortable: getIsColumnSortable('space_ids'),
+              actions: {
+                showSortAsc: false,
+                showSortDesc: false,
+                showHide: false,
+              },
+            },
+          ]
+        : []),
+    ],
+    [onFilterChange, hasConnectorNames, showFromAllSpaces]
+  );
+
+  const renderList = () => {
+    if (!logs) {
+      return <CenterJustifiedSpinner />;
+    }
+    return (
+      <>
+        {isLoading && (
+          <EuiProgress size="xs" color="accent" data-test-subj="connectorEventLogListProgressBar" />
+        )}
+        <EventLogDataGrid
+          columns={columns}
+          logs={logs}
+          pagination={pagination}
+          sortingColumns={sortingColumns}
+          visibleColumns={visibleColumns}
+          dateFormat={dateFormat}
+          onChangeItemsPerPage={onChangeItemsPerPage}
+          onChangePage={onChangePage}
+          setVisibleColumns={setVisibleColumns}
+          setSortingColumns={setSortingColumns}
+        />
+      </>
+    );
+  };
+
+  useEffect(() => {
+    loadEventLogs();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [
+    sortingColumns,
+    dateStart,
+    dateEnd,
+    filter,
+    pagination.pageIndex,
+    pagination.pageSize,
+    searchText,
+    showFromAllSpaces,
+  ]);
+
+  useEffect(() => {
+    if (isInitialized.current) {
+      loadEventLogs();
+    }
+    isInitialized.current = true;
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [refreshToken]);
+
+  useEffect(() => {
+    localStorage.setItem(localStorageKey, JSON.stringify(visibleColumns));
+  }, [localStorageKey, visibleColumns]);
+
+  useEffect(() => {
+    setInternalRefreshToken(refreshToken);
+  }, [refreshToken]);
+
+  return (
+    <EuiFlexGroup gutterSize="none" direction="column">
+      <EuiFlexItem grow={false}>
+        <EuiFlexGroup alignItems="center">
+          <EuiFlexItem grow={false}>
+            <EuiFieldSearch
+              fullWidth
+              isClearable
+              value={search}
+              onChange={onSearchChange}
+              onKeyUp={onKeyUp}
+              placeholder={SEARCH_PLACEHOLDER}
+            />
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EventLogListStatusFilter selectedOptions={filter} onChange={onFilterChange} />
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <EuiSuperDatePicker
+              data-test-subj="connectorEventLogListDatePicker"
+              width="auto"
+              isLoading={isLoading}
+              start={dateStart}
+              end={dateEnd}
+              onTimeChange={onTimeChange}
+              onRefresh={onRefresh}
+              dateFormat={dateFormat}
+              commonlyUsedRanges={commonlyUsedRanges}
+              updateButtonProps={updateButtonProps}
+            />
+          </EuiFlexItem>
+          {hasAllSpaceSwitch && canAccessMultipleSpaces && (
+            <EuiFlexItem data-test-subj="showAllSpacesSwitch">
+              <EuiSwitch
+                label={ALL_SPACES_LABEL}
+                checked={showFromAllSpaces}
+                onChange={onShowAllSpacesChange}
+              />
+            </EuiFlexItem>
+          )}
+        </EuiFlexGroup>
+        <EuiSpacer />
+      </EuiFlexItem>
+      <EuiFlexItem grow={false}>
+        <ConnectorEventLogListKPI
+          data-test-subj="connectorEventLogListKpi"
+          dateStart={dateStart}
+          dateEnd={dateEnd}
+          outcomeFilter={filter}
+          message={searchText}
+          refreshToken={internalRefreshToken}
+          namespaces={namespaces}
+        />
+        <EuiSpacer />
+      </EuiFlexItem>
+      <EuiFlexItem>
+        {renderList()}
+        {isOnLastPage && (
+          <RefineSearchPrompt
+            documentSize={actualTotalItemCount}
+            visibleDocumentSize={MAX_RESULTS}
+            backToTopAnchor="logs"
+          />
+        )}
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
+
+const ConnectorEventLogListTableWithSpaces: React.FC<ConnectorEventLogListTableProps> = (props) => {
+  const { spaces } = useKibana().services;
+
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  const SpacesContextWrapper = useCallback(
+    spaces ? spaces.ui.components.getSpacesContextProvider : getEmptyFunctionComponent,
+    [spaces]
+  );
+  return (
+    <SpacesContextWrapper feature="triggersActions">
+      <ConnectorEventLogListTable {...props} />
+    </SpacesContextWrapper>
+  );
+};
+
+export const ConnectorEventLogListTableWithApi = withActionOperations(
+  ConnectorEventLogListTableWithSpaces
+);
+
+// eslint-disable-next-line import/no-default-export
+export { ConnectorEventLogListTableWithApi as default };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_home.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_home.tsx
new file mode 100644
index 00000000000000..c45c14513a2743
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_home.tsx
@@ -0,0 +1,137 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { lazy, useCallback, useEffect } from 'react';
+import { Route, RouteComponentProps, Switch } from 'react-router-dom';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { i18n } from '@kbn/i18n';
+import { EuiSpacer, EuiButtonEmpty, EuiPageHeader, EuiPageTemplate } from '@elastic/eui';
+import { routeToConnectors, routeToLogs, Section } from '../../../constants';
+import { getAlertingSectionBreadcrumb } from '../../../lib/breadcrumb';
+import { getCurrentDocTitle } from '../../../lib/doc_title';
+import { suspendedComponentWithProps } from '../../../lib/suspended_component_with_props';
+import { HealthContextProvider } from '../../../context/health_context';
+import { HealthCheck } from '../../../components/health_check';
+import { useKibana } from '../../../../common/lib/kibana';
+import ConnectorEventLogListTableWithApi from './actions_connectors_event_log_list_table';
+
+const ConnectorsList = lazy(() => import('./actions_connectors_list'));
+
+export interface MatchParams {
+  section: Section;
+}
+
+export const ActionsConnectorsHome: React.FunctionComponent<RouteComponentProps<MatchParams>> = ({
+  match: {
+    params: { section },
+  },
+  history,
+}) => {
+  const { chrome, setBreadcrumbs, docLinks } = useKibana().services;
+
+  const tabs: Array<{
+    id: Section;
+    name: React.ReactNode;
+  }> = [];
+  tabs.push({
+    id: 'connectors',
+    name: (
+      <FormattedMessage
+        id="xpack.triggersActionsUI.connectors.home.connectorsTabTitle"
+        defaultMessage="Connectors"
+      />
+    ),
+  });
+  tabs.push({
+    id: 'logs',
+    name: (
+      <FormattedMessage
+        id="xpack.triggersActionsUI.connectors.home.logsTabTitle"
+        defaultMessage="Logs"
+      />
+    ),
+  });
+
+  const onSectionChange = (newSection: Section) => {
+    history.push(`/${newSection}`);
+  };
+
+  // Set breadcrumb and page title
+  useEffect(() => {
+    setBreadcrumbs([getAlertingSectionBreadcrumb(section || 'connectors')]);
+    chrome.docTitle.change(getCurrentDocTitle(section || 'connectors'));
+  }, [section, chrome, setBreadcrumbs]);
+
+  const renderLogsList = useCallback(() => {
+    return (
+      <EuiPageTemplate.Section grow={false} paddingSize="none">
+        {suspendedComponentWithProps(
+          ConnectorEventLogListTableWithApi,
+          'xl'
+        )({
+          refreshToken: 0,
+          initialPageSize: 50,
+          hasConnectorNames: true,
+          hasAllSpaceSwitch: true,
+        })}
+      </EuiPageTemplate.Section>
+    );
+  }, []);
+
+  return (
+    <>
+      <EuiPageHeader
+        bottomBorder
+        paddingSize="none"
+        pageTitle={i18n.translate('xpack.triggersActionsUI.connectors.home.appTitle', {
+          defaultMessage: 'Connectors',
+        })}
+        description={i18n.translate('xpack.triggersActionsUI.connectors.home.description', {
+          defaultMessage: 'Connect third-party software with your alerting data.',
+        })}
+        rightSideItems={[
+          <EuiButtonEmpty
+            data-test-subj="documentationButton"
+            key="documentation-button"
+            href={docLinks.links.alerting.actionTypes}
+            iconType="help"
+          >
+            <FormattedMessage
+              id="xpack.triggersActionsUI.connectors.home.documentationButtonLabel"
+              defaultMessage="Documentation"
+            />
+          </EuiButtonEmpty>,
+        ]}
+        tabs={tabs.map((tab) => ({
+          label: tab.name,
+          onClick: () => onSectionChange(tab.id),
+          isSelected: tab.id === section,
+          key: tab.id,
+          'data-test-subj': `${tab.id}Tab`,
+        }))}
+      />
+
+      <EuiSpacer size="l" />
+
+      <HealthContextProvider>
+        <HealthCheck waitForCheck={true}>
+          <Switch>
+            <Route exact path={routeToLogs} component={renderLogsList} />
+            <Route
+              exact
+              path={routeToConnectors}
+              component={suspendedComponentWithProps(ConnectorsList, 'xl')}
+            />
+          </Switch>
+        </HealthCheck>
+      </HealthContextProvider>
+    </>
+  );
+};
+
+// eslint-disable-next-line import/no-default-export
+export { ActionsConnectorsHome as default };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
index 55885aa3c14c3a..fbdef9f7c4e92c 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx
@@ -9,7 +9,6 @@ import { ClassNames } from '@emotion/react';
 import React, { useState, useEffect } from 'react';
 import {
   EuiInMemoryTable,
-  EuiSpacer,
   EuiButton,
   EuiLink,
   EuiIconTip,
@@ -412,57 +411,41 @@ const ActionsConnectorsList: React.FunctionComponent = () => {
             options: actionTypesList,
           },
         ],
-        toolsLeft:
-          selectedItems.length === 0 || !canDelete
-            ? []
-            : [
-                <EuiButton
-                  key="delete"
-                  iconType="trash"
-                  color="danger"
-                  data-test-subj="bulkDelete"
-                  onClick={() => onDelete(selectedItems)}
-                  title={
-                    canDelete
-                      ? undefined
-                      : i18n.translate(
-                          'xpack.triggersActionsUI.sections.actionsConnectorsList.buttons.deleteDisabledTitle',
-                          { defaultMessage: 'Unable to delete connectors' }
-                        )
-                  }
-                >
-                  <FormattedMessage
-                    id="xpack.triggersActionsUI.sections.actionsConnectorsList.buttons.deleteLabel"
-                    defaultMessage="Delete {count}"
-                    values={{
-                      count: selectedItems.length,
-                    }}
-                  />
-                </EuiButton>,
-              ],
-      }}
-    />
-  );
-
-  return (
-    <>
-      {actionConnectorTableItems.length !== 0 && (
-        <EuiPageTemplate.Header
-          paddingSize="none"
-          pageTitle={i18n.translate('xpack.triggersActionsUI.connectors.home.appTitle', {
-            defaultMessage: 'Connectors',
-          })}
-          description={i18n.translate('xpack.triggersActionsUI.connectors.home.description', {
-            defaultMessage: 'Connect third-party software with your alerting data.',
-          })}
-          rightSideItems={(canSave
+        toolsLeft: (selectedItems.length === 0 || !canDelete
+          ? []
+          : [
+              <EuiButton
+                key="delete"
+                iconType="trash"
+                color="danger"
+                data-test-subj="bulkDelete"
+                onClick={() => onDelete(selectedItems)}
+                title={
+                  canDelete
+                    ? undefined
+                    : i18n.translate(
+                        'xpack.triggersActionsUI.sections.actionsConnectorsList.buttons.deleteDisabledTitle',
+                        { defaultMessage: 'Unable to delete connectors' }
+                      )
+                }
+              >
+                <FormattedMessage
+                  id="xpack.triggersActionsUI.sections.actionsConnectorsList.buttons.deleteLabel"
+                  defaultMessage="Delete {count}"
+                  values={{
+                    count: selectedItems.length,
+                  }}
+                />
+              </EuiButton>,
+            ]
+        ).concat(
+          canSave
             ? [
                 <EuiButton
                   data-test-subj="createActionButton"
                   key="create-action"
                   fill
                   onClick={() => setAddFlyoutVisibility(true)}
-                  iconType="plusInCircle"
                 >
                   <FormattedMessage
                     id="xpack.triggersActionsUI.sections.actionsConnectorsList.addActionButtonLabel"
@@ -471,21 +454,13 @@ const ActionsConnectorsList: React.FunctionComponent = () => {
                 </EuiButton>,
               ]
             : []
-          ).concat([
-            <EuiButtonEmpty
-              data-test-subj="documentationButton"
-              key="documentation-button"
-              href={docLinks.links.alerting.connectors}
-              iconType="help"
-            >
-              <FormattedMessage
-                id="xpack.triggersActionsUI.sections.actionsConnectorsList.documentationButtonLabel"
-                defaultMessage="Documentation"
-              />
-            </EuiButtonEmpty>,
-          ])}
-        />
-      )}
+        ),
+      }}
+    />
+  );
+
+  return (
+    <>
       <EuiPageTemplate.Section
         paddingSize="none"
         data-test-subj="actionsList"
@@ -535,7 +510,6 @@ const ActionsConnectorsList: React.FunctionComponent = () => {
           setIsLoadingState={(isLoading: boolean) => setIsLoadingActionTypes(isLoading)}
         />
 
-        <EuiSpacer size="m" />
         {/* Render the view based on if there's data or if they can save */}
         {(isLoadingActions || isLoadingActionTypes) && <CenterJustifiedSpinner />}
         {actionConnectorTableItems.length !== 0 && table}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_data_grid.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_data_grid.tsx
new file mode 100644
index 00000000000000..3cc13e012f20ee
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_data_grid.tsx
@@ -0,0 +1,373 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useMemo, useCallback } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n-react';
+import {
+  EuiDataGrid,
+  EuiDataGridStyle,
+  Pagination,
+  EuiDataGridCellValueElementProps,
+  EuiDataGridSorting,
+  EuiDataGridColumn,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSpacer,
+  EuiBadge,
+  EuiDataGridCellPopoverElementProps,
+  useEuiTheme,
+  EuiToolTip,
+  EuiText,
+  EuiIcon,
+} from '@elastic/eui';
+import {
+  IExecutionLog,
+  executionLogSortableColumns,
+  ExecutionLogSortFields,
+} from '@kbn/alerting-plugin/common';
+import { IExecutionLog as IConnectorsExecutionLog } from '@kbn/actions-plugin/common';
+import { get } from 'lodash';
+import { getIsExperimentalFeatureEnabled } from '../../../../../common/get_experimental_features';
+import { EventLogListCellRenderer, ColumnId, EventLogPaginationStatus } from '.';
+import { RuleActionErrorBadge } from '../../../rule_details/components/rule_action_error_badge';
+import './event_log_list.scss';
+
+export const getIsColumnSortable = (columnId: string) => {
+  return executionLogSortableColumns.includes(columnId as ExecutionLogSortFields);
+};
+
+const getErroredActionsTranslation = (errors: number) => {
+  return i18n.translate('xpack.triggersActionsUI.sections.eventLogDataGrid.erroredActionsTooltip', {
+    defaultMessage: '{value, plural, one {# errored action} other {# errored actions}}',
+    values: { value: errors },
+  });
+};
+
+const PAGE_SIZE_OPTIONS = [10, 50, 100];
+
+type ExecutionLog = IExecutionLog | IConnectorsExecutionLog;
+
+export interface EventLogDataGrid {
+  columns: EuiDataGridColumn[];
+  logs: ExecutionLog[];
+  pagination: Pagination;
+  sortingColumns: EuiDataGridSorting['columns'];
+  visibleColumns: string[];
+  dateFormat: string;
+  pageSizeOptions?: number[];
+  selectedRunLog?: ExecutionLog;
+  onChangeItemsPerPage: (pageSize: number) => void;
+  onChangePage: (pageIndex: number) => void;
+  onFlyoutOpen?: (runLog: IExecutionLog) => void;
+  setVisibleColumns: (visibleColumns: string[]) => void;
+  setSortingColumns: (sortingColumns: EuiDataGridSorting['columns']) => void;
+}
+
+export const numTriggeredActionsDisplay = i18n.translate(
+  'xpack.triggersActionsUI.sections.eventLogColumn.triggeredActions',
+  {
+    defaultMessage: 'Triggered actions',
+  }
+);
+const numTriggeredActionsToolTip = i18n.translate(
+  'xpack.triggersActionsUI.sections.eventLogColumn.triggeredActionsToolTip',
+  {
+    defaultMessage: 'The subset of generated actions that will run.',
+  }
+);
+
+export const numGeneratedActionsDisplay = i18n.translate(
+  'xpack.triggersActionsUI.sections.eventLogColumn.scheduledActions',
+  {
+    defaultMessage: 'Generated actions',
+  }
+);
+const numGeneratedActionsToolTip = i18n.translate(
+  'xpack.triggersActionsUI.sections.eventLogColumn.scheduledActionsToolTip',
+  {
+    defaultMessage: 'The total number of actions generated when the rule ran.',
+  }
+);
+
+export const numSucceededActionsDisplay = i18n.translate(
+  'xpack.triggersActionsUI.sections.eventLogColumn.succeededActions',
+  {
+    defaultMessage: 'Succeeded actions',
+  }
+);
+const numSucceededActionsToolTip = i18n.translate(
+  'xpack.triggersActionsUI.sections.eventLogColumn.succeededActionsToolTip',
+  {
+    defaultMessage: 'The number of actions that were completed successfully.',
+  }
+);
+
+export const numErroredActionsDisplay = i18n.translate(
+  'xpack.triggersActionsUI.sections.eventLogColumn.erroredActions',
+  {
+    defaultMessage: 'Errored actions',
+  }
+);
+const numErroredActionsToolTip = i18n.translate(
+  'xpack.triggersActionsUI.sections.eventLogColumn.erroredActionsToolTip',
+  {
+    defaultMessage: 'The number of failed actions.',
+  }
+);
+
+const columnsWithToolTipMap: Record<string, Record<string, string>> = {
+  num_triggered_actions: {
+    display: numTriggeredActionsDisplay,
+    toolTip: numTriggeredActionsToolTip,
+  },
+  num_generated_actions: {
+    display: numGeneratedActionsDisplay,
+    toolTip: numGeneratedActionsToolTip,
+  },
+  num_succeeded_actions: {
+    display: numSucceededActionsDisplay,
+    toolTip: numSucceededActionsToolTip,
+  },
+  num_errored_actions: {
+    display: numErroredActionsDisplay,
+    toolTip: numErroredActionsToolTip,
+  },
+};
+
+export const ColumnHeaderWithToolTip = ({ id }: { id: string }) => {
+  return (
+    <EuiToolTip content={columnsWithToolTipMap[id].toolTip}>
+      <EuiFlexGroup gutterSize="xs" alignItems="center">
+        <EuiFlexItem>{columnsWithToolTipMap[id].display}</EuiFlexItem>
+        <EuiFlexItem>
+          <EuiIcon size="s" color="subdued" type="questionInCircle" className="eui-alignTop" />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiToolTip>
+  );
+};
+
+export const EventLogDataGrid = (props: EventLogDataGrid) => {
+  const {
+    columns,
+    logs = [],
+    sortingColumns,
+    pageSizeOptions = PAGE_SIZE_OPTIONS,
+    pagination,
+    dateFormat,
+    visibleColumns,
+    selectedRunLog,
+    setVisibleColumns,
+    setSortingColumns,
+    onChangeItemsPerPage,
+    onChangePage,
+    onFlyoutOpen,
+  } = props;
+
+  const { euiTheme } = useEuiTheme();
+
+  const isRuleUsingExecutionStatus = getIsExperimentalFeatureEnabled('ruleUseExecutionStatus');
+
+  const getPaginatedRowIndex = useCallback(
+    (rowIndex: number) => {
+      const { pageIndex, pageSize } = pagination;
+      return rowIndex - pageIndex * pageSize;
+    },
+    [pagination]
+  );
+
+  const columnVisibilityProps = useMemo(() => {
+    return {
+      visibleColumns,
+      setVisibleColumns,
+    };
+  }, [visibleColumns, setVisibleColumns]);
+
+  const sortingProps = useMemo(
+    () => ({
+      onSort: setSortingColumns,
+      columns: sortingColumns,
+    }),
+    [setSortingColumns, sortingColumns]
+  );
+
+  const paginationProps = useMemo(
+    () => ({
+      ...pagination,
+      pageSizeOptions,
+      onChangeItemsPerPage,
+      onChangePage,
+    }),
+    [pagination, pageSizeOptions, onChangeItemsPerPage, onChangePage]
+  );
+
+  const rowClasses = useMemo(() => {
+    if (!selectedRunLog) {
+      return {};
+    }
+    const index = logs.findIndex((log) => log.id === selectedRunLog.id);
+    return {
+      [index]: 'ruleEventLogDataGrid--rowClassSelected',
+    };
+  }, [selectedRunLog, logs]);
+
+  const gridStyles: EuiDataGridStyle = useMemo(() => {
+    return {
+      border: 'horizontal',
+      header: 'underline',
+      rowClasses,
+    };
+  }, [rowClasses]);
+
+  const renderMessageWithActionError = (
+    columnId: string,
+    errors: number,
+    showTooltip: boolean = false
+  ) => {
+    if (columnId !== 'message') {
+      return null;
+    }
+    if (!errors) {
+      return null;
+    }
+    return (
+      <EuiFlexItem grow={false}>
+        {showTooltip ? (
+          <EuiToolTip content={getErroredActionsTranslation(errors)}>
+            <RuleActionErrorBadge totalErrors={errors} showIcon />
+          </EuiToolTip>
+        ) : (
+          <RuleActionErrorBadge totalErrors={errors} showIcon />
+        )}
+      </EuiFlexItem>
+    );
+  };
+
+  // Renders the cell popover for runs with errored actions
+  const renderCellPopover = (cellPopoverProps: EuiDataGridCellPopoverElementProps) => {
+    const { columnId, rowIndex, cellActions, DefaultCellPopover } = cellPopoverProps;
+
+    if (columnId !== 'message') {
+      return <DefaultCellPopover {...cellPopoverProps} />;
+    }
+
+    const pagedRowIndex = getPaginatedRowIndex(rowIndex);
+    const runLog = logs[pagedRowIndex];
+
+    if (!runLog) {
+      return null;
+    }
+
+    const value = runLog[columnId as keyof ExecutionLog] as string;
+    const actionErrors = get(runLog, 'num_errored_actions', 0 as number);
+
+    return (
+      <div style={{ width: '100%' }}>
+        <EuiSpacer size="s" />
+        <div>
+          <EuiText size="m">{value}</EuiText>
+        </div>
+        <EuiSpacer size="s" />
+        {actionErrors > 0 && (
+          <>
+            <EuiSpacer size="l" />
+            <EuiFlexGroup gutterSize="none" alignItems="center">
+              <EuiFlexItem grow={false}>
+                {renderMessageWithActionError(columnId, actionErrors)}
+              </EuiFlexItem>
+              <EuiFlexItem>
+                &nbsp;
+                <FormattedMessage
+                  id="xpack.triggersActionsUI.sections.eventLogDataGrid.erroredActionsCellPopover"
+                  defaultMessage="{value, plural, one {errored action} other {errored actions}}"
+                  values={{
+                    value: actionErrors,
+                  }}
+                />
+              </EuiFlexItem>
+            </EuiFlexGroup>
+            <EuiSpacer size="s" />
+            {cellActions}
+          </>
+        )}
+      </div>
+    );
+  };
+
+  // Main cell renderer, renders durations, statuses, etc.
+  const renderCell = ({ rowIndex, columnId }: EuiDataGridCellValueElementProps) => {
+    const pagedRowIndex = getPaginatedRowIndex(rowIndex);
+
+    const runLog = logs[pagedRowIndex];
+    const value = logs[pagedRowIndex]?.[columnId as keyof ExecutionLog] as string;
+    const actionErrors = get(logs[pagedRowIndex], 'num_errored_actions', 0 as number);
+    const version = logs?.[pagedRowIndex]?.version;
+    const ruleId = get(runLog, 'rule_id');
+    const spaceIds = runLog?.space_ids;
+
+    if (columnId === 'num_errored_actions' && runLog && onFlyoutOpen) {
+      return (
+        <EuiBadge
+          data-test-subj="eventLogDataGridErroredActionBadge"
+          style={{
+            cursor: 'pointer',
+            borderRadius: euiTheme.border.radius.medium,
+          }}
+          color="hollow"
+          onClick={() => onFlyoutOpen(runLog as IExecutionLog)}
+          onClickAriaLabel={i18n.translate(
+            'xpack.triggersActionsUI.sections.eventLogColumn.openActionErrorsFlyout',
+            {
+              defaultMessage: 'Open action errors flyout',
+            }
+          )}
+        >
+          {value}
+        </EuiBadge>
+      );
+    }
+    return (
+      <EuiFlexGroup gutterSize="s" alignItems="center">
+        {renderMessageWithActionError(columnId, actionErrors, true)}
+        <EuiFlexItem>
+          <EventLogListCellRenderer
+            columnId={columnId as ColumnId}
+            value={value}
+            version={version}
+            dateFormat={dateFormat}
+            ruleId={ruleId}
+            spaceIds={spaceIds}
+            useExecutionStatus={isRuleUsingExecutionStatus}
+          />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    );
+  };
+
+  return (
+    <>
+      <EventLogPaginationStatus
+        pageIndex={pagination.pageIndex}
+        pageSize={pagination.pageSize}
+        totalItemCount={pagination.totalItemCount}
+      />
+      <EuiDataGrid
+        aria-label="event log"
+        data-test-subj="eventLogList"
+        columns={columns}
+        rowCount={pagination.totalItemCount}
+        renderCellValue={renderCell}
+        columnVisibility={columnVisibilityProps}
+        sorting={sortingProps}
+        pagination={paginationProps}
+        gridStyle={gridStyles}
+        renderCellPopover={renderCellPopover}
+      />
+    </>
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.scss b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list.scss
similarity index 100%
rename from x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.scss
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list.scss
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_cell_renderer.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_cell_renderer.test.tsx
similarity index 69%
rename from x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_cell_renderer.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_cell_renderer.test.tsx
index 08362962890e59..0ec383c84f6e64 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_cell_renderer.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_cell_renderer.test.tsx
@@ -9,12 +9,9 @@ import React from 'react';
 import moment from 'moment';
 import { EuiIcon, EuiLink } from '@elastic/eui';
 import { shallow, mount } from 'enzyme';
-import {
-  RuleEventLogListCellRenderer,
-  DEFAULT_DATE_FORMAT,
-} from './rule_event_log_list_cell_renderer';
-import { RuleEventLogListStatus } from './rule_event_log_list_status';
-import { RuleDurationFormat } from '../../rules_list/components/rule_duration_format';
+import { EventLogListCellRenderer, DEFAULT_DATE_FORMAT } from './event_log_list_cell_renderer';
+import { EventLogListStatus } from './event_log_list_status';
+import { RuleDurationFormat } from '../../../rules_list/components/rule_duration_format';
 
 jest.mock('react-router-dom', () => ({
   useHistory: () => ({
@@ -24,7 +21,7 @@ jest.mock('react-router-dom', () => ({
   }),
 }));
 
-jest.mock('../../../../common/lib/kibana', () => ({
+jest.mock('../../../../../common/lib/kibana', () => ({
   useSpacesData: () => ({
     spacesMap: new Map([
       ['space1', { id: 'space1' }],
@@ -64,20 +61,20 @@ describe('rule_event_log_list_cell_renderer', () => {
   });
 
   it('renders primitive values correctly', () => {
-    const wrapper = mount(<RuleEventLogListCellRenderer columnId="message" value="test" />);
+    const wrapper = mount(<EventLogListCellRenderer columnId="message" value="test" />);
 
     expect(wrapper.text()).toEqual('test');
   });
 
   it('renders undefined correctly', () => {
-    const wrapper = shallow(<RuleEventLogListCellRenderer columnId="message" />);
+    const wrapper = shallow(<EventLogListCellRenderer columnId="message" />);
 
     expect(wrapper.text()).toBeFalsy();
   });
 
   it('renders date duration correctly', () => {
     const wrapper = shallow(
-      <RuleEventLogListCellRenderer columnId="execution_duration" value="100000" />
+      <EventLogListCellRenderer columnId="execution_duration" value="100000" />
     );
 
     expect(wrapper.find(RuleDurationFormat).exists()).toBeTruthy();
@@ -86,7 +83,7 @@ describe('rule_event_log_list_cell_renderer', () => {
 
   it('renders alert count correctly', () => {
     const wrapper = shallow(
-      <RuleEventLogListCellRenderer columnId="num_new_alerts" value="3" version="8.3.0" />
+      <EventLogListCellRenderer columnId="num_new_alerts" value="3" version="8.3.0" />
     );
 
     expect(wrapper.text()).toEqual('3');
@@ -94,29 +91,29 @@ describe('rule_event_log_list_cell_renderer', () => {
 
   it('renders timestamps correctly', () => {
     const time = '2022-03-20T07:40:44-07:00';
-    const wrapper = shallow(<RuleEventLogListCellRenderer columnId="timestamp" value={time} />);
+    const wrapper = shallow(<EventLogListCellRenderer columnId="timestamp" value={time} />);
 
     expect(wrapper.text()).toEqual(moment(time).format(DEFAULT_DATE_FORMAT));
   });
 
   it('renders alert status correctly', () => {
-    const wrapper = shallow(<RuleEventLogListCellRenderer columnId="status" value="success" />);
+    const wrapper = shallow(<EventLogListCellRenderer columnId="status" value="success" />);
 
-    expect(wrapper.find(RuleEventLogListStatus).exists()).toBeTruthy();
-    expect(wrapper.find(RuleEventLogListStatus).props().status).toEqual('success');
+    expect(wrapper.find(EventLogListStatus).exists()).toBeTruthy();
+    expect(wrapper.find(EventLogListStatus).props().status).toEqual('success');
   });
 
   it('unaccounted status will still render, but with the unknown color', () => {
-    const wrapper = mount(<RuleEventLogListCellRenderer columnId="status" value="newOutcome" />);
+    const wrapper = mount(<EventLogListCellRenderer columnId="status" value="newOutcome" />);
 
-    expect(wrapper.find(RuleEventLogListStatus).exists()).toBeTruthy();
-    expect(wrapper.find(RuleEventLogListStatus).text()).toEqual('newOutcome');
+    expect(wrapper.find(EventLogListStatus).exists()).toBeTruthy();
+    expect(wrapper.find(EventLogListStatus).text()).toEqual('newOutcome');
     expect(wrapper.find(EuiIcon).props().color).toEqual('gray');
   });
 
   it('links to rules on the correct space', () => {
     const wrapper1 = shallow(
-      <RuleEventLogListCellRenderer
+      <EventLogListCellRenderer
         columnId="rule_name"
         value="Rule"
         ruleId="1"
@@ -126,7 +123,7 @@ describe('rule_event_log_list_cell_renderer', () => {
     // @ts-ignore data-href is not a native EuiLink prop
     expect(wrapper1.find(EuiLink).props()['data-href']).toEqual('/rule/1');
     const wrapper2 = shallow(
-      <RuleEventLogListCellRenderer
+      <EventLogListCellRenderer
         columnId="rule_name"
         value="Rule"
         ruleId="1"
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_cell_renderer.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_cell_renderer.tsx
similarity index 82%
rename from x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_cell_renderer.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_cell_renderer.tsx
index 63a62d2bc4503e..4fe281c933b958 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_cell_renderer.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_cell_renderer.tsx
@@ -11,21 +11,24 @@ import { EuiLink } from '@elastic/eui';
 import { RuleAlertingOutcome } from '@kbn/alerting-plugin/common';
 import { useHistory } from 'react-router-dom';
 import { getRuleDetailsRoute } from '@kbn/rule-data-utils';
-import { formatRuleAlertCount } from '../../../../common/lib/format_rule_alert_count';
-import { useKibana, useSpacesData } from '../../../../common/lib/kibana';
-import { RuleEventLogListStatus } from './rule_event_log_list_status';
-import { RuleDurationFormat } from '../../rules_list/components/rule_duration_format';
+import { formatRuleAlertCount } from '../../../../../common/lib/format_rule_alert_count';
+import { useKibana, useSpacesData } from '../../../../../common/lib/kibana';
+import { EventLogListStatus } from './event_log_list_status';
+import { RuleDurationFormat } from '../../../rules_list/components/rule_duration_format';
 import {
   RULE_EXECUTION_LOG_COLUMN_IDS,
   RULE_EXECUTION_LOG_DURATION_COLUMNS,
   RULE_EXECUTION_LOG_ALERT_COUNT_COLUMNS,
-} from '../../../constants';
+  CONNECTOR_EXECUTION_LOG_COLUMN_IDS,
+} from '../../../../constants';
 
 export const DEFAULT_DATE_FORMAT = 'MMM D, YYYY @ HH:mm:ss.SSS';
 
-export type ColumnId = typeof RULE_EXECUTION_LOG_COLUMN_IDS[number];
+export type ColumnId =
+  | typeof RULE_EXECUTION_LOG_COLUMN_IDS[number]
+  | typeof CONNECTOR_EXECUTION_LOG_COLUMN_IDS[number];
 
-interface RuleEventLogListCellRendererProps {
+interface EventLogListCellRendererProps {
   columnId: ColumnId;
   version?: string;
   value?: string | string[];
@@ -35,7 +38,7 @@ interface RuleEventLogListCellRendererProps {
   useExecutionStatus?: boolean;
 }
 
-export const RuleEventLogListCellRenderer = (props: RuleEventLogListCellRendererProps) => {
+export const EventLogListCellRenderer = (props: EventLogListCellRendererProps) => {
   const {
     columnId,
     value,
@@ -97,7 +100,7 @@ export const RuleEventLogListCellRenderer = (props: RuleEventLogListCellRenderer
 
   if (columnId === 'status') {
     return (
-      <RuleEventLogListStatus
+      <EventLogListStatus
         status={value as RuleAlertingOutcome}
         useExecutionStatus={useExecutionStatus}
       />
@@ -129,5 +132,9 @@ export const RuleEventLogListCellRenderer = (props: RuleEventLogListCellRenderer
     return <RuleDurationFormat duration={parseInt(value as string, 10)} />;
   }
 
+  if (columnId === 'timed_out') {
+    return <>{value ? 'true' : 'false'}</>;
+  }
+
   return <>{value}</>;
 };
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_status.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_status.tsx
similarity index 90%
rename from x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_status.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_status.tsx
index 2e4098c5738325..44b72072f836df 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_status.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_status.tsx
@@ -13,9 +13,9 @@ import {
   RULE_LAST_RUN_OUTCOME_FAILED,
   RULE_LAST_RUN_OUTCOME_WARNING,
   ALERT_STATUS_UNKNOWN,
-} from '../../rules_list/translations';
+} from '../../../rules_list/translations';
 
-interface RuleEventLogListStatusProps {
+interface EventLogListStatusProps {
   status: RuleAlertingOutcome;
   useExecutionStatus?: boolean;
 }
@@ -44,7 +44,7 @@ const STATUS_TO_OUTCOME: Record<RuleAlertingOutcome, string> = {
   unknown: ALERT_STATUS_UNKNOWN,
 };
 
-export const RuleEventLogListStatus = (props: RuleEventLogListStatusProps) => {
+export const EventLogListStatus = (props: EventLogListStatusProps) => {
   const { status, useExecutionStatus = true } = props;
   const color = STATUS_TO_COLOR[status] || 'gray';
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_status_filter.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_status_filter.test.tsx
similarity index 79%
rename from x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_status_filter.test.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_status_filter.test.tsx
index e79959bd6ae497..d3e8b38a8a557b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_status_filter.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_status_filter.test.tsx
@@ -8,10 +8,10 @@
 import React from 'react';
 import { mountWithIntl } from '@kbn/test-jest-helpers';
 import { EuiFilterButton, EuiFilterSelectItem } from '@elastic/eui';
-import { RuleEventLogListStatusFilter } from './rule_event_log_list_status_filter';
-import { getIsExperimentalFeatureEnabled } from '../../../../common/get_experimental_features';
+import { EventLogListStatusFilter } from './event_log_list_status_filter';
+import { getIsExperimentalFeatureEnabled } from '../../../../../common/get_experimental_features';
 
-jest.mock('../../../../common/get_experimental_features', () => ({
+jest.mock('../../../../../common/get_experimental_features', () => ({
   getIsExperimentalFeatureEnabled: jest.fn(),
 }));
 
@@ -21,14 +21,14 @@ beforeEach(() => {
 
 const onChangeMock = jest.fn();
 
-describe('rule_event_log_list_status_filter', () => {
+describe('event_log_list_status_filter', () => {
   beforeEach(() => {
     onChangeMock.mockReset();
   });
 
   it('renders correctly', () => {
     const wrapper = mountWithIntl(
-      <RuleEventLogListStatusFilter selectedOptions={[]} onChange={onChangeMock} />
+      <EventLogListStatusFilter selectedOptions={[]} onChange={onChangeMock} />
     );
 
     expect(wrapper.find(EuiFilterSelectItem).exists()).toBeFalsy();
@@ -39,7 +39,7 @@ describe('rule_event_log_list_status_filter', () => {
 
   it('can open the popover correctly', () => {
     const wrapper = mountWithIntl(
-      <RuleEventLogListStatusFilter selectedOptions={[]} onChange={onChangeMock} />
+      <EventLogListStatusFilter selectedOptions={[]} onChange={onChangeMock} />
     );
 
     wrapper.find(EuiFilterButton).simulate('click');
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_status_filter.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_status_filter.tsx
similarity index 81%
rename from x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_status_filter.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_status_filter.tsx
index 26bc5fc78b1618..29c2e8a0f4b88c 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_status_filter.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_list_status_filter.tsx
@@ -9,17 +9,17 @@ import React, { useState, useCallback } from 'react';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { RuleAlertingOutcome } from '@kbn/alerting-plugin/common';
 import { EuiFilterButton, EuiPopover, EuiFilterGroup, EuiFilterSelectItem } from '@elastic/eui';
-import { getIsExperimentalFeatureEnabled } from '../../../../common/get_experimental_features';
-import { RuleEventLogListStatus } from './rule_event_log_list_status';
+import { getIsExperimentalFeatureEnabled } from '../../../../../common/get_experimental_features';
+import { EventLogListStatus } from './event_log_list_status';
 
 const statusFilters: RuleAlertingOutcome[] = ['success', 'failure', 'warning', 'unknown'];
 
-interface RuleEventLogListStatusFilterProps {
+interface EventLogListStatusFilterProps {
   selectedOptions: string[];
   onChange: (selectedValues: string[]) => void;
 }
 
-export const RuleEventLogListStatusFilter = (props: RuleEventLogListStatusFilterProps) => {
+export const EventLogListStatusFilter = (props: EventLogListStatusFilterProps) => {
   const { selectedOptions = [], onChange = () => {} } = props;
 
   const isRuleUsingExecutionStatus = getIsExperimentalFeatureEnabled('ruleUseExecutionStatus');
@@ -48,7 +48,7 @@ export const RuleEventLogListStatusFilter = (props: RuleEventLogListStatusFilter
         closePopover={() => setIsPopoverOpen(false)}
         button={
           <EuiFilterButton
-            data-test-subj="ruleEventLogStatusFilterButton"
+            data-test-subj="eventLogStatusFilterButton"
             iconType="arrowDown"
             hasActiveFilters={selectedOptions.length > 0}
             numActiveFilters={selectedOptions.length}
@@ -56,7 +56,7 @@ export const RuleEventLogListStatusFilter = (props: RuleEventLogListStatusFilter
             onClick={onClick}
           >
             <FormattedMessage
-              id="xpack.triggersActionsUI.sections.ruleDetails.eventLogStatusFilterLabel"
+              id="xpack.triggersActionsUI.sections.eventLogStatusFilterLabel"
               defaultMessage="Response"
             />
           </EuiFilterButton>
@@ -67,11 +67,11 @@ export const RuleEventLogListStatusFilter = (props: RuleEventLogListStatusFilter
             return (
               <EuiFilterSelectItem
                 key={status}
-                data-test-subj={`ruleEventLogStatusFilter-${status}`}
+                data-test-subj={`eventLogStatusFilter-${status}`}
                 onClick={onFilterItemClick(status)}
                 checked={selectedOptions.includes(status) ? 'on' : undefined}
               >
-                <RuleEventLogListStatus
+                <EventLogListStatus
                   status={status}
                   useExecutionStatus={isRuleUsingExecutionStatus}
                 />
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_pagination_status.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_pagination_status.tsx
similarity index 70%
rename from x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_pagination_status.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_pagination_status.tsx
index 4782f9a8ea6d06..f1968b6aa1666b 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_pagination_status.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_pagination_status.tsx
@@ -9,12 +9,12 @@ import React, { useMemo } from 'react';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { Pagination, EuiText } from '@elastic/eui';
 
-export type RuleEventLogPaginationStatusProps = Pick<
+export type EventLogPaginationStatusProps = Pick<
   Pagination,
   'pageIndex' | 'pageSize' | 'totalItemCount'
 >;
 
-export const RuleEventLogPaginationStatus = (props: RuleEventLogPaginationStatusProps) => {
+export const EventLogPaginationStatus = (props: EventLogPaginationStatusProps) => {
   const { pageIndex, pageSize, totalItemCount } = props;
 
   const paginationStatusRange = useMemo(() => {
@@ -22,7 +22,7 @@ export const RuleEventLogPaginationStatus = (props: RuleEventLogPaginationStatus
       return (
         <strong>
           <FormattedMessage
-            id="xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsRangeNoResult"
+            id="xpack.triggersActionsUI.sections.eventLogPaginationStatus.paginationResultsRangeNoResult"
             defaultMessage="0"
           />
         </strong>
@@ -33,7 +33,7 @@ export const RuleEventLogPaginationStatus = (props: RuleEventLogPaginationStatus
     return (
       <strong>
         <FormattedMessage
-          id="xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsRange"
+          id="xpack.triggersActionsUI.sections.eventLogPaginationStatus.paginationResultsRange"
           defaultMessage="{start, number} - {end, number}"
           values={{
             start: pageIndex * pageSize + 1,
@@ -45,9 +45,9 @@ export const RuleEventLogPaginationStatus = (props: RuleEventLogPaginationStatus
   }, [pageSize, pageIndex, totalItemCount]);
 
   return (
-    <EuiText data-test-subj="ruleEventLogPaginationStatus" size="xs">
+    <EuiText data-test-subj="eventLogPaginationStatus" size="xs">
       <FormattedMessage
-        id="xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResults"
+        id="xpack.triggersActionsUI.sections.eventLogPaginationStatus.paginationResults"
         defaultMessage="Showing {range} of {total, number} {type}"
         values={{
           range: paginationStatusRange,
@@ -55,7 +55,7 @@ export const RuleEventLogPaginationStatus = (props: RuleEventLogPaginationStatus
           type: (
             <strong>
               <FormattedMessage
-                id="xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogPaginationStatus.paginationResultsType"
+                id="xpack.triggersActionsUI.sections.eventLogPaginationStatus.paginationResultsType"
                 defaultMessage="log {total, plural, one {entry} other {entries}}"
                 values={{ total: totalItemCount }}
               />
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_stat.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_stat.tsx
new file mode 100644
index 00000000000000..d4d1c1cadd13ae
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/event_log_stat.tsx
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { EuiPanel, EuiFlexGroup, EuiFlexItem, EuiIconTip, EuiSpacer } from '@elastic/eui';
+
+export const EventLogStat = ({
+  title,
+  tooltip,
+  children,
+}: {
+  title: string;
+  tooltip: string;
+  children?: JSX.Element;
+}) => {
+  return (
+    <EuiPanel color="subdued">
+      <EuiFlexGroup gutterSize="xs">
+        <EuiFlexItem grow={false}>
+          <b>{title}</b>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiIconTip content={tooltip} position="top" />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer />
+      {children}
+    </EuiPanel>
+  );
+};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/index.ts
new file mode 100644
index 00000000000000..65f3f6037970d7
--- /dev/null
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/event_log/index.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { EventLogListCellRenderer } from './event_log_list_cell_renderer';
+export type { ColumnId } from './event_log_list_cell_renderer';
+export { EventLogListStatusFilter } from './event_log_list_status_filter';
+export { EventLogListStatus } from './event_log_list_status';
+export { EventLogPaginationStatus } from './event_log_pagination_status';
+export {
+  EventLogDataGrid,
+  getIsColumnSortable,
+  ColumnHeaderWithToolTip,
+  numTriggeredActionsDisplay,
+  numGeneratedActionsDisplay,
+  numSucceededActionsDisplay,
+  numErroredActionsDisplay,
+} from './event_log_data_grid';
+export { EventLogStat } from './event_log_stat';
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/refine_search_prompt.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/refine_search_prompt.tsx
similarity index 89%
rename from x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/refine_search_prompt.tsx
rename to x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/refine_search_prompt.tsx
index 781176f1882e47..381fc9ca6d26fb 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/refine_search_prompt.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/refine_search_prompt.tsx
@@ -42,14 +42,14 @@ export const RefineSearchPrompt = (props: RefineSearchFooterProps) => {
   return (
     <EuiText style={textStyles} textAlign="center" size="s">
       <FormattedMessage
-        id="xpack.triggersActionsUI.sections.ruleDetails.refineSearchPrompt.prompt"
+        id="xpack.triggersActionsUI.sections.refineSearchPrompt.prompt"
         defaultMessage="These are the first {visibleDocumentSize} documents matching your search, refine your search to see others."
         values={{ visibleDocumentSize }}
       />
       &nbsp;
       <EuiLink href={`#${backToTopAnchor}`}>
         <FormattedMessage
-          id="xpack.triggersActionsUI.sections.ruleDetails.refineSearchPrompt.backToTop"
+          id="xpack.triggersActionsUI.sections.refineSearchPrompt.backToTop"
           defaultMessage="Back to top."
         />
       </EuiLink>
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_actions_api_operations.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_actions_api_operations.tsx
index 590cdc0a172835..ebb36c1d4f385e 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_actions_api_operations.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/with_actions_api_operations.tsx
@@ -7,12 +7,25 @@
 
 import React from 'react';
 
+import { IExecutionLogResult, IExecutionKPIResult } from '@kbn/actions-plugin/common';
 import { ActionType } from '../../../../types';
-import { loadActionTypes } from '../../../lib/action_connector_api';
+import {
+  loadActionTypes,
+  LoadGlobalConnectorExecutionLogAggregationsProps,
+  loadGlobalConnectorExecutionLogAggregations,
+  LoadGlobalConnectorExecutionKPIAggregationsProps,
+  loadGlobalConnectorExecutionKPIAggregations,
+} from '../../../lib/action_connector_api';
 import { useKibana } from '../../../../common/lib/kibana';
 
 export interface ComponentOpts {
   loadActionTypes: () => Promise<ActionType[]>;
+  loadGlobalConnectorExecutionLogAggregations: (
+    props: LoadGlobalConnectorExecutionLogAggregationsProps
+  ) => Promise<IExecutionLogResult>;
+  loadGlobalConnectorExecutionKPIAggregations: (
+    props: LoadGlobalConnectorExecutionKPIAggregationsProps
+  ) => Promise<IExecutionKPIResult>;
 }
 
 export type PropsWithOptionalApiHandlers<T> = Omit<T, keyof ComponentOpts> & Partial<ComponentOpts>;
@@ -23,7 +36,26 @@ export function withActionOperations<T>(
   return (props: PropsWithOptionalApiHandlers<T>) => {
     const { http } = useKibana().services;
     return (
-      <WrappedComponent {...(props as T)} loadActionTypes={async () => loadActionTypes({ http })} />
+      <WrappedComponent
+        {...(props as T)}
+        loadActionTypes={async () => loadActionTypes({ http })}
+        loadGlobalConnectorExecutionLogAggregations={async (
+          loadProps: LoadGlobalConnectorExecutionLogAggregationsProps
+        ) =>
+          loadGlobalConnectorExecutionLogAggregations({
+            ...loadProps,
+            http,
+          })
+        }
+        loadGlobalConnectorExecutionKPIAggregations={async (
+          loadGlobalExecutionKPIAggregationsProps: LoadGlobalConnectorExecutionKPIAggregationsProps
+        ) =>
+          loadGlobalConnectorExecutionKPIAggregations({
+            ...loadGlobalExecutionKPIAggregationsProps,
+            http,
+          })
+        }
+      />
     );
   };
 }
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.test.tsx
index 192cf39929c888..20114096699d1f 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.test.tsx
@@ -12,7 +12,7 @@ import { useKibana } from '../../../../common/lib/kibana';
 
 import { EuiSuperDatePicker } from '@elastic/eui';
 import { Rule } from '../../../../types';
-import { RefineSearchPrompt } from '../refine_search_prompt';
+import { RefineSearchPrompt } from '../../common/components/refine_search_prompt';
 import { RuleErrorLog } from './rule_error_log';
 
 const useKibanaMock = useKibana as jest.Mocked<typeof useKibana>;
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.tsx
index e07dd0ce5f6ed9..b5940e9d4b1e3f 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_error_log.tsx
@@ -24,12 +24,12 @@ import {
 import { IExecutionErrors } from '@kbn/alerting-plugin/common';
 import { useKibana } from '../../../../common/lib/kibana';
 
-import { RefineSearchPrompt } from '../refine_search_prompt';
+import { RefineSearchPrompt } from '../../common/components/refine_search_prompt';
 import {
   ComponentOpts as RuleApis,
   withBulkRuleOperations,
 } from '../../common/components/with_bulk_rule_api_operations';
-import { RuleEventLogListCellRenderer } from './rule_event_log_list_cell_renderer';
+import { EventLogListCellRenderer } from '../../common/components/event_log';
 
 const getParsedDate = (date: string) => {
   if (date.includes('now')) {
@@ -203,7 +203,7 @@ export const RuleErrorLog = (props: RuleErrorLogProps) => {
           }
         ),
         render: (date: string) => (
-          <RuleEventLogListCellRenderer columnId="timestamp" value={date} dateFormat={dateFormat} />
+          <EventLogListCellRenderer columnId="timestamp" value={date} dateFormat={dateFormat} />
         ),
         sortable: true,
         width: '250px',
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_data_grid.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_data_grid.tsx
deleted file mode 100644
index 24a3c3fe3b8bdb..00000000000000
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_data_grid.tsx
+++ /dev/null
@@ -1,655 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import React, { useMemo, useCallback } from 'react';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n-react';
-import {
-  EuiDataGrid,
-  EuiDataGridStyle,
-  Pagination,
-  EuiDataGridCellValueElementProps,
-  EuiDataGridSorting,
-  EuiDataGridColumn,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiSpacer,
-  EuiBadge,
-  EuiDataGridCellPopoverElementProps,
-  useEuiTheme,
-  EuiToolTip,
-  EuiText,
-  EuiIcon,
-} from '@elastic/eui';
-import {
-  IExecutionLog,
-  executionLogSortableColumns,
-  ExecutionLogSortFields,
-} from '@kbn/alerting-plugin/common';
-import { getIsExperimentalFeatureEnabled } from '../../../../common/get_experimental_features';
-import { RuleEventLogListCellRenderer, ColumnId } from './rule_event_log_list_cell_renderer';
-import { RuleEventLogPaginationStatus } from './rule_event_log_pagination_status';
-import { RuleActionErrorBadge } from './rule_action_error_badge';
-import './rule_event_log_list.scss';
-
-const getIsColumnSortable = (columnId: string) => {
-  return executionLogSortableColumns.includes(columnId as ExecutionLogSortFields);
-};
-
-const getErroredActionsTranslation = (errors: number) => {
-  return i18n.translate(
-    'xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogDataGrid.erroredActionsTooltip',
-    {
-      defaultMessage: '{value, plural, one {# errored action} other {# errored actions}}',
-      values: { value: errors },
-    }
-  );
-};
-
-const PAGE_SIZE_OPTIONS = [10, 50, 100];
-
-export interface RuleEventLogDataGrid {
-  logs: IExecutionLog[];
-  pagination: Pagination;
-  sortingColumns: EuiDataGridSorting['columns'];
-  visibleColumns: string[];
-  dateFormat: string;
-  pageSizeOptions?: number[];
-  selectedRunLog?: IExecutionLog;
-  showRuleNameAndIdColumns?: boolean;
-  showSpaceColumns?: boolean;
-  onChangeItemsPerPage: (pageSize: number) => void;
-  onChangePage: (pageIndex: number) => void;
-  onFilterChange: (filter: string[]) => void;
-  onFlyoutOpen: (runLog: IExecutionLog) => void;
-  setVisibleColumns: (visibleColumns: string[]) => void;
-  setSortingColumns: (sortingColumns: EuiDataGridSorting['columns']) => void;
-}
-
-const numTriggeredActionsDisplay = i18n.translate(
-  'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.triggeredActions',
-  {
-    defaultMessage: 'Triggered actions',
-  }
-);
-const numTriggeredActionsToolTip = i18n.translate(
-  'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.triggeredActionsToolTip',
-  {
-    defaultMessage: 'The subset of generated actions that will run.',
-  }
-);
-
-const numGeneratedActionsDisplay = i18n.translate(
-  'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduledActions',
-  {
-    defaultMessage: 'Generated actions',
-  }
-);
-const numGeneratedActionsToolTip = i18n.translate(
-  'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduledActionsToolTip',
-  {
-    defaultMessage: 'The total number of actions generated when the rule ran.',
-  }
-);
-
-const numSucceededActionsDisplay = i18n.translate(
-  'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.succeededActions',
-  {
-    defaultMessage: 'Succeeded actions',
-  }
-);
-const numSucceededActionsToolTip = i18n.translate(
-  'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.succeededActionsToolTip',
-  {
-    defaultMessage: 'The number of actions that were completed successfully.',
-  }
-);
-
-const numErroredActionsDisplay = i18n.translate(
-  'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.erroredActions',
-  {
-    defaultMessage: 'Errored actions',
-  }
-);
-const numErroredActionsToolTip = i18n.translate(
-  'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.erroredActionsToolTip',
-  {
-    defaultMessage: 'The number of failed actions.',
-  }
-);
-
-const columnsWithToolTipMap: Record<string, Record<string, string>> = {
-  num_triggered_actions: {
-    display: numTriggeredActionsDisplay,
-    toolTip: numTriggeredActionsToolTip,
-  },
-  num_generated_actions: {
-    display: numGeneratedActionsDisplay,
-    toolTip: numGeneratedActionsToolTip,
-  },
-  num_succeeded_actions: {
-    display: numSucceededActionsDisplay,
-    toolTip: numSucceededActionsToolTip,
-  },
-  num_errored_actions: {
-    display: numErroredActionsDisplay,
-    toolTip: numErroredActionsToolTip,
-  },
-};
-
-const ColumnHeaderWithToolTip = ({ id }: { id: string }) => {
-  return (
-    <EuiToolTip content={columnsWithToolTipMap[id].toolTip}>
-      <EuiFlexGroup gutterSize="xs" alignItems="center">
-        <EuiFlexItem>{columnsWithToolTipMap[id].display}</EuiFlexItem>
-        <EuiFlexItem>
-          <EuiIcon size="s" color="subdued" type="questionInCircle" className="eui-alignTop" />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiToolTip>
-  );
-};
-
-export const RuleEventLogDataGrid = (props: RuleEventLogDataGrid) => {
-  const {
-    logs = [],
-    sortingColumns,
-    pageSizeOptions = PAGE_SIZE_OPTIONS,
-    pagination,
-    dateFormat,
-    visibleColumns,
-    selectedRunLog,
-    showRuleNameAndIdColumns = false,
-    showSpaceColumns = false,
-    setVisibleColumns,
-    setSortingColumns,
-    onChangeItemsPerPage,
-    onChangePage,
-    onFilterChange,
-    onFlyoutOpen,
-  } = props;
-
-  const { euiTheme } = useEuiTheme();
-
-  const isRuleUsingExecutionStatus = getIsExperimentalFeatureEnabled('ruleUseExecutionStatus');
-
-  const getPaginatedRowIndex = useCallback(
-    (rowIndex: number) => {
-      const { pageIndex, pageSize } = pagination;
-      return rowIndex - pageIndex * pageSize;
-    },
-    [pagination]
-  );
-
-  const columns: EuiDataGridColumn[] = useMemo(
-    () => [
-      ...(showRuleNameAndIdColumns
-        ? [
-            {
-              id: 'rule_id',
-              displayAsText: i18n.translate(
-                'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.ruleId',
-                {
-                  defaultMessage: 'Rule Id',
-                }
-              ),
-              isSortable: getIsColumnSortable('rule_id'),
-              actions: {
-                showSortAsc: false,
-                showSortDesc: false,
-              },
-            },
-            {
-              id: 'rule_name',
-              displayAsText: i18n.translate(
-                'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.ruleName',
-                {
-                  defaultMessage: 'Rule',
-                }
-              ),
-              isSortable: getIsColumnSortable('rule_name'),
-              actions: {
-                showSortAsc: false,
-                showSortDesc: false,
-                showHide: false,
-              },
-            },
-          ]
-        : []),
-      ...(showSpaceColumns
-        ? [
-            {
-              id: 'space_ids',
-              displayAsText: i18n.translate(
-                'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.spaceIds',
-                {
-                  defaultMessage: 'Space',
-                }
-              ),
-              isSortable: getIsColumnSortable('space_ids'),
-              actions: {
-                showSortAsc: false,
-                showSortDesc: false,
-                showHide: false,
-              },
-            },
-          ]
-        : []),
-      {
-        id: 'id',
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.id',
-          {
-            defaultMessage: 'Id',
-          }
-        ),
-        isSortable: getIsColumnSortable('id'),
-      },
-      {
-        id: 'timestamp',
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.timestamp',
-          {
-            defaultMessage: 'Timestamp',
-          }
-        ),
-        isSortable: getIsColumnSortable('timestamp'),
-        isResizable: false,
-        actions: {
-          showHide: false,
-        },
-        initialWidth: 250,
-      },
-      {
-        id: 'execution_duration',
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.duration',
-          {
-            defaultMessage: 'Duration',
-          }
-        ),
-        isSortable: getIsColumnSortable('execution_duration'),
-        isResizable: false,
-        actions: {
-          showHide: false,
-        },
-        initialWidth: 100,
-      },
-      {
-        id: 'status',
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.response',
-          {
-            defaultMessage: 'Response',
-          }
-        ),
-        actions: {
-          showHide: false,
-          showSortAsc: false,
-          showSortDesc: false,
-          additional: [
-            {
-              iconType: 'annotation',
-              label: i18n.translate(
-                'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.showOnlyFailures',
-                {
-                  defaultMessage: 'Show only failures',
-                }
-              ),
-              onClick: () => onFilterChange(['failure']),
-              size: 'xs',
-            },
-            {
-              iconType: 'annotation',
-              label: i18n.translate(
-                'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.showAll',
-                {
-                  defaultMessage: 'Show all',
-                }
-              ),
-              onClick: () => onFilterChange([]),
-              size: 'xs',
-            },
-          ],
-        },
-        isSortable: getIsColumnSortable('status'),
-        isResizable: false,
-        initialWidth: 150,
-      },
-      {
-        id: 'message',
-        actions: {
-          showSortAsc: false,
-          showSortDesc: false,
-        },
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.message',
-          {
-            defaultMessage: 'Message',
-          }
-        ),
-        isSortable: getIsColumnSortable('message'),
-        cellActions: [
-          ({ rowIndex, Component }) => {
-            const pagedRowIndex = getPaginatedRowIndex(rowIndex);
-            const runLog = logs[pagedRowIndex];
-            const actionErrors = runLog?.num_errored_actions as number;
-            if (actionErrors) {
-              return (
-                <Component onClick={() => onFlyoutOpen(runLog)} iconType="alert">
-                  <FormattedMessage
-                    id="xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.viewActionErrors"
-                    defaultMessage="View action errors"
-                  />
-                </Component>
-              );
-            }
-            return null;
-          },
-        ],
-      },
-      {
-        id: 'num_active_alerts',
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.activeAlerts',
-          {
-            defaultMessage: 'Active alerts',
-          }
-        ),
-        initialWidth: 140,
-        isSortable: getIsColumnSortable('num_active_alerts'),
-      },
-      {
-        id: 'num_new_alerts',
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.newAlerts',
-          {
-            defaultMessage: 'New alerts',
-          }
-        ),
-        initialWidth: 140,
-        isSortable: getIsColumnSortable('num_new_alerts'),
-      },
-      {
-        id: 'num_recovered_alerts',
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.recoveredAlerts',
-          {
-            defaultMessage: 'Recovered alerts',
-          }
-        ),
-        isSortable: getIsColumnSortable('num_recovered_alerts'),
-      },
-      {
-        id: 'num_triggered_actions',
-        displayAsText: numTriggeredActionsDisplay,
-        display: <ColumnHeaderWithToolTip id="num_triggered_actions" />,
-        isSortable: getIsColumnSortable('num_triggered_actions'),
-      },
-      {
-        id: 'num_generated_actions',
-        displayAsText: numGeneratedActionsDisplay,
-        display: <ColumnHeaderWithToolTip id="num_generated_actions" />,
-        isSortable: getIsColumnSortable('num_generated_actions'),
-      },
-      {
-        id: 'num_succeeded_actions',
-        displayAsText: numSucceededActionsDisplay,
-        display: <ColumnHeaderWithToolTip id="num_succeeded_actions" />,
-        isSortable: getIsColumnSortable('num_succeeded_actions'),
-      },
-      {
-        id: 'num_errored_actions',
-        actions: {
-          showSortAsc: false,
-          showSortDesc: false,
-        },
-        displayAsText: numErroredActionsDisplay,
-        display: <ColumnHeaderWithToolTip id="num_errored_actions" />,
-        isSortable: getIsColumnSortable('num_errored_actions'),
-      },
-      {
-        id: 'total_search_duration',
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.totalSearchDuration',
-          {
-            defaultMessage: 'Total search duration',
-          }
-        ),
-        isSortable: getIsColumnSortable('total_search_duration'),
-      },
-      {
-        id: 'es_search_duration',
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.esSearchDuration',
-          {
-            defaultMessage: 'ES search duration',
-          }
-        ),
-        isSortable: getIsColumnSortable('es_search_duration'),
-      },
-      {
-        id: 'schedule_delay',
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduleDelay',
-          {
-            defaultMessage: 'Schedule delay',
-          }
-        ),
-        isSortable: getIsColumnSortable('schedule_delay'),
-      },
-      {
-        id: 'timed_out',
-        displayAsText: i18n.translate(
-          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.timedOut',
-          {
-            defaultMessage: 'Timed out',
-          }
-        ),
-        isSortable: getIsColumnSortable('timed_out'),
-      },
-    ],
-    [
-      getPaginatedRowIndex,
-      onFlyoutOpen,
-      onFilterChange,
-      showRuleNameAndIdColumns,
-      showSpaceColumns,
-      logs,
-    ]
-  );
-
-  const columnVisibilityProps = useMemo(() => {
-    return {
-      visibleColumns,
-      setVisibleColumns,
-    };
-  }, [visibleColumns, setVisibleColumns]);
-
-  const sortingProps = useMemo(
-    () => ({
-      onSort: setSortingColumns,
-      columns: sortingColumns,
-    }),
-    [setSortingColumns, sortingColumns]
-  );
-
-  const paginationProps = useMemo(
-    () => ({
-      ...pagination,
-      pageSizeOptions,
-      onChangeItemsPerPage,
-      onChangePage,
-    }),
-    [pagination, pageSizeOptions, onChangeItemsPerPage, onChangePage]
-  );
-
-  const rowClasses = useMemo(() => {
-    if (!selectedRunLog) {
-      return {};
-    }
-    const index = logs.findIndex((log) => log.id === selectedRunLog.id);
-    return {
-      [index]: 'ruleEventLogDataGrid--rowClassSelected',
-    };
-  }, [selectedRunLog, logs]);
-
-  const gridStyles: EuiDataGridStyle = useMemo(() => {
-    return {
-      border: 'horizontal',
-      header: 'underline',
-      rowClasses,
-    };
-  }, [rowClasses]);
-
-  const renderMessageWithActionError = (
-    columnId: string,
-    errors: number,
-    showTooltip: boolean = false
-  ) => {
-    if (columnId !== 'message') {
-      return null;
-    }
-    if (!errors) {
-      return null;
-    }
-    return (
-      <EuiFlexItem grow={false}>
-        {showTooltip ? (
-          <EuiToolTip content={getErroredActionsTranslation(errors)}>
-            <RuleActionErrorBadge totalErrors={errors} showIcon />
-          </EuiToolTip>
-        ) : (
-          <RuleActionErrorBadge totalErrors={errors} showIcon />
-        )}
-      </EuiFlexItem>
-    );
-  };
-
-  // Renders the cell popover for runs with errored actions
-  const renderCellPopover = (cellPopoverProps: EuiDataGridCellPopoverElementProps) => {
-    const { columnId, rowIndex, cellActions, DefaultCellPopover } = cellPopoverProps;
-
-    if (columnId !== 'message') {
-      return <DefaultCellPopover {...cellPopoverProps} />;
-    }
-
-    const pagedRowIndex = getPaginatedRowIndex(rowIndex);
-    const runLog = logs[pagedRowIndex];
-
-    if (!runLog) {
-      return null;
-    }
-
-    const value = runLog[columnId as keyof IExecutionLog] as string;
-    const actionErrors = runLog.num_errored_actions || (0 as number);
-
-    return (
-      <div style={{ width: '100%' }}>
-        <EuiSpacer size="s" />
-        <div>
-          <EuiText size="m">{value}</EuiText>
-        </div>
-        <EuiSpacer size="s" />
-        {actionErrors > 0 && (
-          <>
-            <EuiSpacer size="l" />
-            <EuiFlexGroup gutterSize="none" alignItems="center">
-              <EuiFlexItem grow={false}>
-                {renderMessageWithActionError(columnId, actionErrors)}
-              </EuiFlexItem>
-              <EuiFlexItem>
-                &nbsp;
-                <FormattedMessage
-                  id="xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogDataGrid.erroredActionsCellPopover"
-                  defaultMessage="{value, plural, one {errored action} other {errored actions}}"
-                  values={{
-                    value: actionErrors,
-                  }}
-                />
-              </EuiFlexItem>
-            </EuiFlexGroup>
-            <EuiSpacer size="s" />
-            {cellActions}
-          </>
-        )}
-      </div>
-    );
-  };
-
-  // Main cell renderer, renders durations, statuses, etc.
-  const renderCell = ({ rowIndex, columnId }: EuiDataGridCellValueElementProps) => {
-    const pagedRowIndex = getPaginatedRowIndex(rowIndex);
-
-    const runLog = logs[pagedRowIndex];
-    const value = logs[pagedRowIndex]?.[columnId as keyof IExecutionLog] as string;
-    const actionErrors = logs[pagedRowIndex]?.num_errored_actions || (0 as number);
-    const version = logs?.[pagedRowIndex]?.version;
-    const ruleId = runLog?.rule_id;
-    const spaceIds = runLog?.space_ids;
-
-    if (columnId === 'num_errored_actions' && runLog) {
-      return (
-        <EuiBadge
-          data-test-subj="ruleEventLogDataGridErroredActionBadge"
-          style={{
-            cursor: 'pointer',
-            borderRadius: euiTheme.border.radius.medium,
-          }}
-          color="hollow"
-          onClick={() => onFlyoutOpen(runLog)}
-          onClickAriaLabel={i18n.translate(
-            'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.openActionErrorsFlyout',
-            {
-              defaultMessage: 'Open action errors flyout',
-            }
-          )}
-        >
-          {value}
-        </EuiBadge>
-      );
-    }
-    return (
-      <EuiFlexGroup gutterSize="s" alignItems="center">
-        {renderMessageWithActionError(columnId, actionErrors, true)}
-        <EuiFlexItem>
-          <RuleEventLogListCellRenderer
-            columnId={columnId as ColumnId}
-            value={value}
-            version={version}
-            dateFormat={dateFormat}
-            ruleId={ruleId}
-            spaceIds={spaceIds}
-            useExecutionStatus={isRuleUsingExecutionStatus}
-          />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    );
-  };
-
-  return (
-    <>
-      <RuleEventLogPaginationStatus
-        pageIndex={pagination.pageIndex}
-        pageSize={pagination.pageSize}
-        totalItemCount={pagination.totalItemCount}
-      />
-      <EuiDataGrid
-        aria-label="rule event log"
-        data-test-subj="ruleEventLogList"
-        columns={columns}
-        rowCount={pagination.totalItemCount}
-        renderCellValue={renderCell}
-        columnVisibility={columnVisibilityProps}
-        sorting={sortingProps}
-        pagination={paginationProps}
-        gridStyle={gridStyles}
-        renderCellPopover={renderCellPopover}
-      />
-    </>
-  );
-};
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.test.tsx
index 00e702fb42e75e..7a427de413ee0a 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list.test.tsx
@@ -12,9 +12,9 @@ import { mountWithIntl, nextTick } from '@kbn/test-jest-helpers';
 import { useKibana } from '../../../../common/lib/kibana';
 import { ActionGroup, ALERTS_FEATURE_ID } from '@kbn/alerting-plugin/common';
 import { EuiSuperDatePicker, EuiDataGrid } from '@elastic/eui';
-import { RuleEventLogListStatusFilter } from './rule_event_log_list_status_filter';
+import { EventLogListStatusFilter } from '../../common/components/event_log';
 import { RuleEventLogList } from './rule_event_log_list';
-import { RefineSearchPrompt } from '../refine_search_prompt';
+import { RefineSearchPrompt } from '../../common/components/refine_search_prompt';
 import {
   RULE_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS,
   GLOBAL_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS,
@@ -124,7 +124,7 @@ describe.skip('rule_event_log_list', () => {
 
     expect(wrapper.find(EuiSuperDatePicker).props().isLoading).toBeFalsy();
 
-    expect(wrapper.find(RuleEventLogListStatusFilter).exists()).toBeTruthy();
+    expect(wrapper.find(EventLogListStatusFilter).exists()).toBeTruthy();
     expect(wrapper.find('[data-gridcell-column-id="timestamp"]').length).toEqual(5);
     expect(wrapper.find(EuiDataGrid).props().rowCount).toEqual(mockLogResponse.total);
   });
@@ -252,9 +252,9 @@ describe.skip('rule_event_log_list', () => {
     });
 
     // Filter by success
-    wrapper.find('[data-test-subj="ruleEventLogStatusFilterButton"]').at(0).simulate('click');
+    wrapper.find('[data-test-subj="eventLogStatusFilterButton"]').at(0).simulate('click');
 
-    wrapper.find('[data-test-subj="ruleEventLogStatusFilter-success"]').at(0).simulate('click');
+    wrapper.find('[data-test-subj="eventLogStatusFilter-success"]').at(0).simulate('click');
 
     await act(async () => {
       await nextTick();
@@ -272,9 +272,9 @@ describe.skip('rule_event_log_list', () => {
     );
 
     // Filter by failure as well
-    wrapper.find('[data-test-subj="ruleEventLogStatusFilterButton"]').at(0).simulate('click');
+    wrapper.find('[data-test-subj="eventLogStatusFilterButton"]').at(0).simulate('click');
 
-    wrapper.find('[data-test-subj="ruleEventLogStatusFilter-failure"]').at(0).simulate('click');
+    wrapper.find('[data-test-subj="eventLogStatusFilter-failure"]').at(0).simulate('click');
 
     await act(async () => {
       await nextTick();
@@ -549,7 +549,7 @@ describe.skip('rule_event_log_list', () => {
       wrapper.update();
     });
 
-    expect(wrapper.find('[data-test-subj="ruleEventLogPaginationStatus"]').first().text()).toEqual(
+    expect(wrapper.find('[data-test-subj="eventLogPaginationStatus"]').first().text()).toEqual(
       'Showing 0 of 0 log entries'
     );
   });
@@ -576,7 +576,7 @@ describe.skip('rule_event_log_list', () => {
       wrapper.update();
     });
 
-    expect(wrapper.find('[data-test-subj="ruleEventLogPaginationStatus"]').first().text()).toEqual(
+    expect(wrapper.find('[data-test-subj="eventLogPaginationStatus"]').first().text()).toEqual(
       'Showing 1 - 1 of 1 log entry'
     );
   });
@@ -603,7 +603,7 @@ describe.skip('rule_event_log_list', () => {
       wrapper.update();
     });
 
-    expect(wrapper.find('[data-test-subj="ruleEventLogPaginationStatus"]').first().text()).toEqual(
+    expect(wrapper.find('[data-test-subj="eventLogPaginationStatus"]').first().text()).toEqual(
       'Showing 1 - 10 of 85 log entries'
     );
 
@@ -614,7 +614,7 @@ describe.skip('rule_event_log_list', () => {
       wrapper.update();
     });
 
-    expect(wrapper.find('[data-test-subj="ruleEventLogPaginationStatus"]').first().text()).toEqual(
+    expect(wrapper.find('[data-test-subj="eventLogPaginationStatus"]').first().text()).toEqual(
       'Showing 11 - 20 of 85 log entries'
     );
 
@@ -625,7 +625,7 @@ describe.skip('rule_event_log_list', () => {
       wrapper.update();
     });
 
-    expect(wrapper.find('[data-test-subj="ruleEventLogPaginationStatus"]').first().text()).toEqual(
+    expect(wrapper.find('[data-test-subj="eventLogPaginationStatus"]').first().text()).toEqual(
       'Showing 81 - 85 of 85 log entries'
     );
   });
@@ -674,10 +674,7 @@ describe.skip('rule_event_log_list', () => {
     expect(wrapper.find('[data-test-subj="ruleActionErrorBadge"]').first().text()).toEqual('4');
 
     // Click to open flyout
-    wrapper
-      .find('[data-test-subj="ruleEventLogDataGridErroredActionBadge"]')
-      .first()
-      .simulate('click');
+    wrapper.find('[data-test-subj="eventLogDataGridErroredActionBadge"]').first().simulate('click');
     expect(wrapper.find('[data-test-subj="ruleActionErrorLogFlyout"]').exists()).toBeTruthy();
   });
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_kpi.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_kpi.tsx
index 3f668df208df25..7ecf22c1b593af 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_kpi.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_kpi.tsx
@@ -8,7 +8,7 @@
 import React, { useEffect, useState, useMemo, useRef } from 'react';
 import { i18n } from '@kbn/i18n';
 import datemath from '@kbn/datemath';
-import { EuiFlexGroup, EuiFlexItem, EuiPanel, EuiIconTip, EuiStat, EuiSpacer } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiStat, EuiSpacer } from '@elastic/eui';
 import { IExecutionKPIResult } from '@kbn/alerting-plugin/common';
 import {
   ComponentOpts as RuleApis,
@@ -16,7 +16,7 @@ import {
 } from '../../common/components/with_bulk_rule_api_operations';
 import { getIsExperimentalFeatureEnabled } from '../../../../common/get_experimental_features';
 import { useKibana } from '../../../../common/lib/kibana';
-import { RuleEventLogListStatus } from './rule_event_log_list_status';
+import { EventLogListStatus, EventLogStat } from '../../common/components/event_log';
 
 const getParsedDate = (date: string) => {
   if (date.includes('now')) {
@@ -53,31 +53,6 @@ const ACTIONS_TOOLTIP = i18n.translate(
   }
 );
 
-const Stat = ({
-  title,
-  tooltip,
-  children,
-}: {
-  title: string;
-  tooltip: string;
-  children?: JSX.Element;
-}) => {
-  return (
-    <EuiPanel color="subdued">
-      <EuiFlexGroup justifyContent="spaceBetween">
-        <EuiFlexItem grow={false}>
-          <b>{title}</b>
-        </EuiFlexItem>
-        <EuiFlexItem grow={false}>
-          <EuiIconTip content={tooltip} position="top" />
-        </EuiFlexItem>
-      </EuiFlexGroup>
-      <EuiSpacer />
-      {children}
-    </EuiPanel>
-  );
-};
-
 export type RuleEventLogListKPIProps = {
   ruleId: string;
   dateStart: string;
@@ -165,13 +140,13 @@ export const RuleEventLogListKPI = (props: RuleEventLogListKPIProps) => {
   return (
     <EuiFlexGroup>
       <EuiFlexItem grow={4}>
-        <Stat title="Response" tooltip={RESPONSE_TOOLTIP}>
+        <EventLogStat title="Responses" tooltip={RESPONSE_TOOLTIP}>
           <EuiFlexGroup>
             <EuiFlexItem>
               <EuiStat
                 data-test-subj="ruleEventLogKpi-successOutcome"
                 description={getStatDescription(
-                  <RuleEventLogListStatus
+                  <EventLogListStatus
                     status="success"
                     useExecutionStatus={isRuleUsingExecutionStatus}
                   />
@@ -185,7 +160,7 @@ export const RuleEventLogListKPI = (props: RuleEventLogListKPIProps) => {
               <EuiStat
                 data-test-subj="ruleEventLogKpi-warningOutcome"
                 description={getStatDescription(
-                  <RuleEventLogListStatus
+                  <EventLogListStatus
                     status="warning"
                     useExecutionStatus={isRuleUsingExecutionStatus}
                   />
@@ -199,7 +174,7 @@ export const RuleEventLogListKPI = (props: RuleEventLogListKPIProps) => {
               <EuiStat
                 data-test-subj="ruleEventLogKpi-failureOutcome"
                 description={getStatDescription(
-                  <RuleEventLogListStatus
+                  <EventLogListStatus
                     status="failure"
                     useExecutionStatus={isRuleUsingExecutionStatus}
                   />
@@ -210,10 +185,10 @@ export const RuleEventLogListKPI = (props: RuleEventLogListKPIProps) => {
               />
             </EuiFlexItem>
           </EuiFlexGroup>
-        </Stat>
+        </EventLogStat>
       </EuiFlexItem>
       <EuiFlexItem grow={4}>
-        <Stat title="Alerts" tooltip={ALERTS_TOOLTIP}>
+        <EventLogStat title="Alerts" tooltip={ALERTS_TOOLTIP}>
           <EuiFlexGroup>
             <EuiFlexItem>
               <EuiStat
@@ -243,10 +218,10 @@ export const RuleEventLogListKPI = (props: RuleEventLogListKPIProps) => {
               />
             </EuiFlexItem>
           </EuiFlexGroup>
-        </Stat>
+        </EventLogStat>
       </EuiFlexItem>
       <EuiFlexItem grow={2}>
-        <Stat title="Actions" tooltip={ACTIONS_TOOLTIP}>
+        <EventLogStat title="Actions" tooltip={ACTIONS_TOOLTIP}>
           <EuiFlexGroup>
             <EuiFlexItem>
               <EuiStat
@@ -267,7 +242,7 @@ export const RuleEventLogListKPI = (props: RuleEventLogListKPIProps) => {
               />
             </EuiFlexItem>
           </EuiFlexGroup>
-        </Stat>
+        </EventLogStat>
       </EuiFlexItem>
     </EuiFlexGroup>
   );
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_table.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_table.tsx
index 4d8024f7ca3dc0..22cd7392b25d41 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_table.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/rule_details/components/rule_event_log_list_table.tsx
@@ -7,6 +7,7 @@
 
 import React, { useCallback, useEffect, useState, useMemo, useRef } from 'react';
 import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n-react';
 import datemath from '@kbn/datemath';
 import {
   EuiFieldSearch,
@@ -19,20 +20,29 @@ import {
   EuiSuperDatePicker,
   OnTimeChangeProps,
   EuiSwitch,
+  EuiDataGridColumn,
 } from '@elastic/eui';
 import { IExecutionLog } from '@kbn/alerting-plugin/common';
 import { SpacesContextProps } from '@kbn/spaces-plugin/public';
-import { useKibana, useSpacesData } from '../../../../common/lib/kibana';
+import { useKibana } from '../../../../common/lib/kibana';
 import {
   RULE_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS,
   GLOBAL_EXECUTION_DEFAULT_INITIAL_VISIBLE_COLUMNS,
   LOCKED_COLUMNS,
 } from '../../../constants';
-import { RuleEventLogListStatusFilter } from './rule_event_log_list_status_filter';
-import { RuleEventLogDataGrid } from './rule_event_log_data_grid';
+import {
+  EventLogDataGrid,
+  getIsColumnSortable,
+  ColumnHeaderWithToolTip,
+  numTriggeredActionsDisplay,
+  numGeneratedActionsDisplay,
+  numSucceededActionsDisplay,
+  numErroredActionsDisplay,
+  EventLogListStatusFilter,
+} from '../../common/components/event_log';
 import { CenterJustifiedSpinner } from '../../../components/center_justified_spinner';
 import { RuleActionErrorLogFlyout } from './rule_action_error_log_flyout';
-import { RefineSearchPrompt } from '../refine_search_prompt';
+import { RefineSearchPrompt } from '../../common/components/refine_search_prompt';
 import { RulesListDocLink } from '../../rules_list/components/rules_list_doc_link';
 import { LoadExecutionLogAggregationsProps } from '../../../lib/rule_api';
 import { RuleEventLogListKPIWithApi as RuleEventLogListKPI } from './rule_event_log_list_kpi';
@@ -40,6 +50,7 @@ import {
   ComponentOpts as RuleApis,
   withBulkRuleOperations,
 } from '../../common/components/with_bulk_rule_api_operations';
+import { useMultipleSpaces } from '../../../hooks/use_multiple_spaces';
 
 const getEmptyFunctionComponent: React.FC<SpacesContextProps> = ({ children }) => <>{children}</>;
 
@@ -170,23 +181,13 @@ export const RuleEventLogListTable = <T extends RuleEventLogListOptions>(
     );
   });
 
-  const spacesData = useSpacesData();
-  const accessibleSpaceIds = useMemo(
-    () => (spacesData ? [...spacesData.spacesMap.values()].map((e) => e.id) : []),
-    [spacesData]
-  );
-  const areMultipleSpacesAccessible = useMemo(
-    () => accessibleSpaceIds.length > 1,
-    [accessibleSpaceIds]
-  );
-  const namespaces = useMemo(
-    () => (showFromAllSpaces && spacesData ? accessibleSpaceIds : undefined),
-    [showFromAllSpaces, spacesData, accessibleSpaceIds]
-  );
-  const activeSpace = useMemo(
-    () => spacesData?.spacesMap.get(spacesData?.activeSpaceId),
-    [spacesData]
-  );
+  const { onShowAllSpacesChange, canAccessMultipleSpaces, namespaces, activeSpace } =
+    useMultipleSpaces({
+      setShowFromAllSpaces,
+      showFromAllSpaces,
+      visibleColumns,
+      setVisibleColumns,
+    });
 
   const isInitialized = useRef(false);
 
@@ -255,6 +256,14 @@ export const RuleEventLogListTable = <T extends RuleEventLogListOptions>(
     setIsLoading(false);
   };
 
+  const getPaginatedRowIndex = useCallback(
+    (rowIndex: number) => {
+      const { pageIndex, pageSize } = pagination;
+      return rowIndex - pageIndex * pageSize;
+    },
+    [pagination]
+  );
+
   const onChangeItemsPerPage = useCallback(
     (pageSize: number) => {
       setPagination((prevPagination) => ({
@@ -332,19 +341,277 @@ export const RuleEventLogListTable = <T extends RuleEventLogListOptions>(
     [search, setSearchText]
   );
 
-  const onShowAllSpacesChange = useCallback(() => {
-    setShowFromAllSpaces((prev) => !prev);
-    const nextShowFromAllSpaces = !showFromAllSpaces;
-
-    if (nextShowFromAllSpaces && !visibleColumns.includes('space_ids')) {
-      const ruleNameIndex = visibleColumns.findIndex((c) => c === 'rule_name');
-      const newVisibleColumns = [...visibleColumns];
-      newVisibleColumns.splice(ruleNameIndex + 1, 0, 'space_ids');
-      setVisibleColumns(newVisibleColumns);
-    } else if (!nextShowFromAllSpaces && visibleColumns.includes('space_ids')) {
-      setVisibleColumns(visibleColumns.filter((c) => c !== 'space_ids'));
-    }
-  }, [setShowFromAllSpaces, showFromAllSpaces, visibleColumns]);
+  const columns: EuiDataGridColumn[] = useMemo(
+    () => [
+      ...(hasRuleNames
+        ? [
+            {
+              id: 'rule_id',
+              displayAsText: i18n.translate(
+                'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.ruleId',
+                {
+                  defaultMessage: 'Rule Id',
+                }
+              ),
+              isSortable: getIsColumnSortable('rule_id'),
+              actions: {
+                showSortAsc: false,
+                showSortDesc: false,
+              },
+            },
+            {
+              id: 'rule_name',
+              displayAsText: i18n.translate(
+                'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.ruleName',
+                {
+                  defaultMessage: 'Rule',
+                }
+              ),
+              isSortable: getIsColumnSortable('rule_name'),
+              actions: {
+                showSortAsc: false,
+                showSortDesc: false,
+                showHide: false,
+              },
+            },
+          ]
+        : []),
+      ...(showFromAllSpaces
+        ? [
+            {
+              id: 'space_ids',
+              displayAsText: i18n.translate(
+                'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.spaceIds',
+                {
+                  defaultMessage: 'Space',
+                }
+              ),
+              isSortable: getIsColumnSortable('space_ids'),
+              actions: {
+                showSortAsc: false,
+                showSortDesc: false,
+                showHide: false,
+              },
+            },
+          ]
+        : []),
+      {
+        id: 'id',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.id',
+          {
+            defaultMessage: 'Id',
+          }
+        ),
+        isSortable: getIsColumnSortable('id'),
+      },
+      {
+        id: 'timestamp',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.timestamp',
+          {
+            defaultMessage: 'Timestamp',
+          }
+        ),
+        isSortable: getIsColumnSortable('timestamp'),
+        isResizable: false,
+        actions: {
+          showHide: false,
+        },
+        initialWidth: 250,
+      },
+      {
+        id: 'execution_duration',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.duration',
+          {
+            defaultMessage: 'Duration',
+          }
+        ),
+        isSortable: getIsColumnSortable('execution_duration'),
+        isResizable: false,
+        actions: {
+          showHide: false,
+        },
+        initialWidth: 100,
+      },
+      {
+        id: 'status',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.response',
+          {
+            defaultMessage: 'Response',
+          }
+        ),
+        actions: {
+          showHide: false,
+          showSortAsc: false,
+          showSortDesc: false,
+          additional: [
+            {
+              iconType: 'annotation',
+              label: i18n.translate(
+                'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.showOnlyFailures',
+                {
+                  defaultMessage: 'Show only failures',
+                }
+              ),
+              onClick: () => onFilterChange(['failure']),
+              size: 'xs',
+            },
+            {
+              iconType: 'annotation',
+              label: i18n.translate(
+                'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.showAll',
+                {
+                  defaultMessage: 'Show all',
+                }
+              ),
+              onClick: () => onFilterChange([]),
+              size: 'xs',
+            },
+          ],
+        },
+        isSortable: getIsColumnSortable('status'),
+        isResizable: false,
+        initialWidth: 150,
+      },
+      {
+        id: 'message',
+        actions: {
+          showSortAsc: false,
+          showSortDesc: false,
+        },
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.message',
+          {
+            defaultMessage: 'Message',
+          }
+        ),
+        isSortable: getIsColumnSortable('message'),
+        cellActions: [
+          ({ rowIndex, Component }) => {
+            const pagedRowIndex = getPaginatedRowIndex(rowIndex);
+            const eventLog = logs || [];
+            const runLog = eventLog[pagedRowIndex];
+            const actionErrors = runLog?.num_errored_actions as number;
+            if (actionErrors) {
+              return (
+                <Component onClick={() => onFlyoutOpen(runLog)} iconType="alert">
+                  <FormattedMessage
+                    id="xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.viewActionErrors"
+                    defaultMessage="View action errors"
+                  />
+                </Component>
+              );
+            }
+            return null;
+          },
+        ],
+      },
+      {
+        id: 'num_active_alerts',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.activeAlerts',
+          {
+            defaultMessage: 'Active alerts',
+          }
+        ),
+        initialWidth: 140,
+        isSortable: getIsColumnSortable('num_active_alerts'),
+      },
+      {
+        id: 'num_new_alerts',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.newAlerts',
+          {
+            defaultMessage: 'New alerts',
+          }
+        ),
+        initialWidth: 140,
+        isSortable: getIsColumnSortable('num_new_alerts'),
+      },
+      {
+        id: 'num_recovered_alerts',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.recoveredAlerts',
+          {
+            defaultMessage: 'Recovered alerts',
+          }
+        ),
+        isSortable: getIsColumnSortable('num_recovered_alerts'),
+      },
+      {
+        id: 'num_triggered_actions',
+        displayAsText: numTriggeredActionsDisplay,
+        display: <ColumnHeaderWithToolTip id="num_triggered_actions" />,
+        isSortable: getIsColumnSortable('num_triggered_actions'),
+      },
+      {
+        id: 'num_generated_actions',
+        displayAsText: numGeneratedActionsDisplay,
+        display: <ColumnHeaderWithToolTip id="num_generated_actions" />,
+        isSortable: getIsColumnSortable('num_generated_actions'),
+      },
+      {
+        id: 'num_succeeded_actions',
+        displayAsText: numSucceededActionsDisplay,
+        display: <ColumnHeaderWithToolTip id="num_succeeded_actions" />,
+        isSortable: getIsColumnSortable('num_succeeded_actions'),
+      },
+      {
+        id: 'num_errored_actions',
+        actions: {
+          showSortAsc: false,
+          showSortDesc: false,
+        },
+        displayAsText: numErroredActionsDisplay,
+        display: <ColumnHeaderWithToolTip id="num_errored_actions" />,
+        isSortable: getIsColumnSortable('num_errored_actions'),
+      },
+      {
+        id: 'total_search_duration',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.totalSearchDuration',
+          {
+            defaultMessage: 'Total search duration',
+          }
+        ),
+        isSortable: getIsColumnSortable('total_search_duration'),
+      },
+      {
+        id: 'es_search_duration',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.esSearchDuration',
+          {
+            defaultMessage: 'ES search duration',
+          }
+        ),
+        isSortable: getIsColumnSortable('es_search_duration'),
+      },
+      {
+        id: 'schedule_delay',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.scheduleDelay',
+          {
+            defaultMessage: 'Schedule delay',
+          }
+        ),
+        isSortable: getIsColumnSortable('schedule_delay'),
+      },
+      {
+        id: 'timed_out',
+        displayAsText: i18n.translate(
+          'xpack.triggersActionsUI.sections.ruleDetails.eventLogColumn.timedOut',
+          {
+            defaultMessage: 'Timed out',
+          }
+        ),
+        isSortable: getIsColumnSortable('timed_out'),
+      },
+    ],
+    [getPaginatedRowIndex, onFlyoutOpen, onFilterChange, hasRuleNames, showFromAllSpaces, logs]
+  );
 
   const renderList = () => {
     if (!logs) {
@@ -355,19 +622,17 @@ export const RuleEventLogListTable = <T extends RuleEventLogListOptions>(
         {isLoading && (
           <EuiProgress size="xs" color="accent" data-test-subj="ruleEventLogListProgressBar" />
         )}
-        <RuleEventLogDataGrid
+        <EventLogDataGrid
+          columns={columns}
           logs={logs}
           pagination={pagination}
           sortingColumns={sortingColumns}
           visibleColumns={visibleColumns}
           dateFormat={dateFormat}
           selectedRunLog={selectedRunLog}
-          showRuleNameAndIdColumns={hasRuleNames}
-          showSpaceColumns={showFromAllSpaces}
           onChangeItemsPerPage={onChangeItemsPerPage}
           onChangePage={onChangePage}
           onFlyoutOpen={onFlyoutOpen}
-          onFilterChange={setFilter}
           setVisibleColumns={setVisibleColumns}
           setSortingColumns={setSortingColumns}
         />
@@ -420,7 +685,7 @@ export const RuleEventLogListTable = <T extends RuleEventLogListOptions>(
             />
           </EuiFlexItem>
           <EuiFlexItem grow={false}>
-            <RuleEventLogListStatusFilter selectedOptions={filter} onChange={onFilterChange} />
+            <EventLogListStatusFilter selectedOptions={filter} onChange={onFilterChange} />
           </EuiFlexItem>
           <EuiFlexItem grow={false}>
             <EuiSuperDatePicker
@@ -436,7 +701,7 @@ export const RuleEventLogListTable = <T extends RuleEventLogListOptions>(
               updateButtonProps={updateButtonProps}
             />
           </EuiFlexItem>
-          {hasAllSpaceSwitch && areMultipleSpacesAccessible && (
+          {hasAllSpaceSwitch && canAccessMultipleSpaces && (
             <EuiFlexItem data-test-subj="showAllSpacesSwitch">
               <EuiSwitch
                 label={ALL_SPACES_LABEL}
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors/general.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors/general.ts
index bb6c01b6fd53fe..3f23faad58ce2f 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors/general.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors/general.ts
@@ -5,7 +5,10 @@
  * 2.0.
  */
 
+import { v4 as uuidv4 } from 'uuid';
+import moment from 'moment';
 import expect from '@kbn/expect';
+import { asyncForEach } from '@kbn/std';
 import { FtrProviderContext } from '../../../ftr_provider_context';
 import { ObjectRemover } from '../../../lib/object_remover';
 import { generateUniqueKey } from '../../../lib/get_test_data';
@@ -13,6 +16,8 @@ import {
   getConnectorByName,
   createSlackConnectorAndObjectRemover,
   createSlackConnector,
+  createRuleWithActionsAndParams,
+  getAlertSummary,
 } from './utils';
 
 export default ({ getPageObjects, getPageObject, getService }: FtrProviderContext) => {
@@ -291,6 +296,107 @@ export default ({ getPageObjects, getPageObject, getService }: FtrProviderContex
       expect(await testSubjects.exists('preconfiguredBadge')).to.be(true);
       expect(await testSubjects.exists('edit-connector-flyout-save-btn')).to.be(false);
     });
+
+    describe('Execution log', () => {
+      const testRunUuid = uuidv4();
+      let rule: any;
+
+      before(async () => {
+        await pageObjects.common.navigateToApp('triggersActions');
+
+        const connectorName = generateUniqueKey();
+        const createdAction = await createSlackConnector({ name: connectorName, getService });
+        objectRemover.add(createdAction.id, 'action', 'actions');
+
+        const alerts = [{ id: 'us-central' }];
+        rule = await createRuleWithActionsAndParams(
+          createdAction.id,
+          testRunUuid,
+          {
+            instances: alerts,
+          },
+          {
+            schedule: { interval: '1s' },
+          },
+          supertest
+        );
+        objectRemover.add(rule.id, 'alert', 'alerts');
+
+        // refresh to see rule
+        await browser.refresh();
+        await pageObjects.header.waitUntilLoadingHasFinished();
+
+        // click on first rule
+        await pageObjects.triggersActionsUI.clickOnAlertInAlertsList(rule.name);
+
+        // await first run to complete so we have an initial state
+        await retry.try(async () => {
+          const { alerts: alertInstances } = await getAlertSummary(rule.id, supertest);
+          expect(Object.keys(alertInstances).length).to.eql(alerts.length);
+        });
+      });
+
+      after(async () => {
+        await objectRemover.removeAll();
+      });
+
+      it('renders the event log list and can filter/sort', async () => {
+        await browser.refresh();
+        await (await testSubjects.find('logsTab')).click();
+
+        const tabbedContentExists = await testSubjects.exists('ruleDetailsTabbedContent');
+        if (!tabbedContentExists) {
+          return;
+        }
+
+        await new Promise((resolve) => setTimeout(resolve, 5000));
+
+        const refreshButton = await testSubjects.find('superDatePickerApplyTimeButton');
+        await refreshButton.click();
+
+        // List, date picker, and status picker all exists
+        await testSubjects.existOrFail('eventLogList');
+        await testSubjects.existOrFail('eventLogStatusFilterButton');
+
+        let statusFilter = await testSubjects.find('eventLogStatusFilterButton');
+        let statusNumber = await statusFilter.findByCssSelector('.euiNotificationBadge');
+
+        expect(statusNumber.getVisibleText()).to.eql(0);
+
+        await statusFilter.click();
+        await testSubjects.click('eventLogStatusFilter-success');
+        await statusFilter.click();
+
+        statusFilter = await testSubjects.find('eventLogStatusFilterButton');
+        statusNumber = await statusFilter.findByCssSelector('.euiNotificationBadge');
+
+        expect(statusNumber.getVisibleText()).to.eql(1);
+
+        const eventLogList = await find.byCssSelector('.euiDataGridRow');
+        const rows = await eventLogList.parseDomContent();
+        expect(rows.length).to.be.greaterThan(0);
+
+        await pageObjects.triggersActionsUI.ensureEventLogColumnExists('timestamp');
+
+        const timestampCells = await find.allByCssSelector(
+          '[data-gridcell-column-id="timestamp"][data-test-subj="dataGridRowCell"]'
+        );
+
+        let validTimestamps = 0;
+        await asyncForEach(timestampCells, async (cell) => {
+          const text = await cell.getVisibleText();
+          if (text.toLowerCase() !== 'invalid date') {
+            if (moment(text).isValid()) {
+              validTimestamps += 1;
+            }
+          }
+        });
+        expect(validTimestamps).to.be.greaterThan(0);
+
+        await pageObjects.triggersActionsUI.sortEventLogColumn('timestamp', 'asc');
+        await testSubjects.existOrFail('dataGridHeaderCellSortingIcon-timestamp');
+      });
+    });
   });
 
   async function createIndexConnector(connectorName: string, indexName: string) {
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors/utils.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors/utils.ts
index ffae007307fcdb..09dffef846cd53 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors/utils.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors/utils.ts
@@ -7,10 +7,10 @@
 
 import type SuperTest from 'supertest';
 import { findIndex } from 'lodash';
-
+import { RuleNotifyWhen } from '@kbn/alerting-plugin/common';
 import { ObjectRemover } from '../../../lib/object_remover';
 import { FtrProviderContext } from '../../../ftr_provider_context';
-import { getTestActionData } from '../../../lib/get_test_data';
+import { getTestActionData, getTestAlertData } from '../../../lib/get_test_data';
 
 export const createSlackConnectorAndObjectRemover = async ({
   getService,
@@ -59,3 +59,62 @@ export const getConnectorByName = async (
   const i = findIndex(body, (c: any) => c.name === name);
   return body[i];
 };
+
+export async function createRuleWithActionsAndParams(
+  connectorId: string,
+  testRunUuid: string,
+  params: Record<string, any> = {},
+  overwrites: Record<string, any> = {},
+  supertest: SuperTest.SuperTest<SuperTest.Test>
+) {
+  return await createAlwaysFiringRule(
+    {
+      name: `test-rule-${testRunUuid}`,
+      actions: [
+        {
+          id: connectorId,
+          group: 'default',
+          params: {
+            message: 'from alert 1s',
+            level: 'warn',
+          },
+          frequency: {
+            summary: false,
+            notify_when: RuleNotifyWhen.THROTTLE,
+            throttle: '1m',
+          },
+        },
+      ],
+      params,
+      ...overwrites,
+    },
+    supertest
+  );
+}
+
+async function createAlwaysFiringRule(
+  overwrites: Record<string, any> = {},
+  supertest: SuperTest.SuperTest<SuperTest.Test>
+) {
+  const { body: createdRule } = await supertest
+    .post(`/api/alerting/rule`)
+    .set('kbn-xsrf', 'foo')
+    .send(
+      getTestAlertData({
+        rule_type_id: 'test.always-firing',
+        ...overwrites,
+      })
+    )
+    .expect(200);
+  return createdRule;
+}
+
+export async function getAlertSummary(
+  ruleId: string,
+  supertest: SuperTest.SuperTest<SuperTest.Test>
+) {
+  const { body: summary } = await supertest
+    .get(`/internal/alerting/rule/${encodeURIComponent(ruleId)}/_alert_summary`)
+    .expect(200);
+  return summary;
+}
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
index 306f4c9e0af4c9..65a7d143127a90 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
@@ -1048,20 +1048,20 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         await refreshButton.click();
 
         // List, date picker, and status picker all exists
-        await testSubjects.existOrFail('ruleEventLogList');
+        await testSubjects.existOrFail('eventLogList');
         await testSubjects.existOrFail('ruleEventLogListDatePicker');
-        await testSubjects.existOrFail('ruleEventLogStatusFilterButton');
+        await testSubjects.existOrFail('eventLogStatusFilterButton');
 
-        let statusFilter = await testSubjects.find('ruleEventLogStatusFilterButton');
+        let statusFilter = await testSubjects.find('eventLogStatusFilterButton');
         let statusNumber = await statusFilter.findByCssSelector('.euiNotificationBadge');
 
         expect(statusNumber.getVisibleText()).to.eql(0);
 
         await statusFilter.click();
-        await testSubjects.click('ruleEventLogStatusFilter-success');
+        await testSubjects.click('eventLogStatusFilter-success');
         await statusFilter.click();
 
-        statusFilter = await testSubjects.find('ruleEventLogStatusFilterButton');
+        statusFilter = await testSubjects.find('eventLogStatusFilterButton');
         statusNumber = await statusFilter.findByCssSelector('.euiNotificationBadge');
 
         expect(statusNumber.getVisibleText()).to.eql(1);

From ace3de1504a9c46c13d5dcd4377697d4b52f0a31 Mon Sep 17 00:00:00 2001
From: Kevin Logan <56395104+kevinlog@users.noreply.github.com>
Date: Mon, 23 Jan 2023 17:37:22 -0500
Subject: [PATCH 27/54] [Security Solution] Add host.name and host.hostname to
 exceptionable Endpoint fields (#148920)

## Summary

Addresses this ticket: https://github.com/elastic/kibana/issues/148779

Allows `host.name` and `host.hostname` to be selected from the list of
available Endpoint fields.

<img width="1725" alt="image"
src="https://user-images.githubusercontent.com/56395104/212412004-0fd1bcbc-39f7-4c29-8016-7d6e8d418fb7.png">

<img width="1728" alt="image"
src="https://user-images.githubusercontent.com/56395104/212412048-826dccf1-131e-4dc2-a34d-c9f586e9e8a0.png">

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../rule_exceptions/utils/exceptionable_endpoint_fields.json    | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/exceptionable_endpoint_fields.json b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/exceptionable_endpoint_fields.json
index a4babfaaa538f1..faa73b290f3cb4 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/exceptionable_endpoint_fields.json
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/utils/exceptionable_endpoint_fields.json
@@ -70,7 +70,9 @@
   "group.id",
   "host.architecture",
   "host.domain",
+  "host.hostname",
   "host.id",
+  "host.name",
   "host.os.Ext.variant",
   "host.os.family",
   "host.os.kernel",

From 598843f7ca2b887beb6d91c525b438fd3bfe6531 Mon Sep 17 00:00:00 2001
From: Jon <jon@elastic.co>
Date: Mon, 23 Jan 2023 17:36:26 -0600
Subject: [PATCH 28/54] [artifacts/container-image] Trigger image tag update
 (#149143)

After a commit is merged, tested, and images are built and pushed to the
container registry we need to send a notification that a new tag is
available.

This triggers a promotion pipeline with the latest container tag when:
1) the branch is tracked (i.e. main, and not a personal branch)
1) ~triggered from our on-merge test pipeline.~
https://github.com/elastic/kibana/pull/149350 had to remove support for
this - we're triggering via REST now which removes the from trigger
environment variable.

Co-authored-by: Tiago Costa <tiago.costa@elastic.co>
---
 .../scripts/steps/artifacts/docker_image.sh   | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.buildkite/scripts/steps/artifacts/docker_image.sh b/.buildkite/scripts/steps/artifacts/docker_image.sh
index edd82152aae2a1..a47372359893e7 100755
--- a/.buildkite/scripts/steps/artifacts/docker_image.sh
+++ b/.buildkite/scripts/steps/artifacts/docker_image.sh
@@ -65,3 +65,23 @@ buildkite-agent artifact upload "kibana-$BASE_VERSION-docker-image.tar.gz"
 buildkite-agent artifact upload "kibana-$BASE_VERSION-docker-image-aarch64.tar.gz"
 buildkite-agent artifact upload "dependencies-$GIT_ABBREV_COMMIT.csv"
 cd -
+
+echo "--- Trigger image tag update"
+if [[ "$BUILDKITE_BRANCH" == "$KIBANA_BASE_BRANCH" ]]; then
+
+  cat << EOF | buildkite-agent pipeline upload
+steps:
+  - trigger: k8s-gitops-update-image-tag
+    label: "Update image tag for deployment-api"
+    branches: main
+    build:
+      env:
+        MODE: sed
+        TARGET_FILE: app-config-controllers.yaml
+        IMAGE_TAG: "$KIBANA_IMAGE"
+        SERVICE: app-config-controllers
+EOF
+
+else
+  echo "Skipping update for untracked branch $BUILDKITE_BRANCH"
+fi

From bbc909b34795480163f3649f7e245739f47f37f4 Mon Sep 17 00:00:00 2001
From: Lisa Cawley <lcawley@elastic.co>
Date: Mon, 23 Jan 2023 16:14:00 -0800
Subject: [PATCH 29/54] [RAM] [Flapping] Edit flapping rule settings UI text
 (#149086)

Co-authored-by: Jiawei Wu <jiawei.wu@cmd.com>
---
 .../alerting/server/rules_settings_feature.ts |  2 +-
 .../rules_settings_flapping_form_section.tsx  | 21 +++++++++++++++--
 .../rules_setting/rules_settings_modal.tsx    | 23 ++++++++++++-------
 3 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/x-pack/plugins/alerting/server/rules_settings_feature.ts b/x-pack/plugins/alerting/server/rules_settings_feature.ts
index c207d337a2b204..5c420fd32bd3c7 100644
--- a/x-pack/plugins/alerting/server/rules_settings_feature.ts
+++ b/x-pack/plugins/alerting/server/rules_settings_feature.ts
@@ -55,7 +55,7 @@ export const rulesSettingsFeature: KibanaFeatureConfig = {
   subFeatures: [
     {
       name: i18n.translate('xpack.alerting.feature.flappingSettingsSubFeatureName', {
-        defaultMessage: 'Flapping Detection',
+        defaultMessage: 'Flapping detection',
       }),
       privilegeGroups: [
         {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/rules_setting/rules_settings_flapping_form_section.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/rules_setting/rules_settings_flapping_form_section.tsx
index bfde62591f6266..ef915eae6869bf 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/rules_setting/rules_settings_flapping_form_section.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/rules_setting/rules_settings_flapping_form_section.tsx
@@ -39,6 +39,13 @@ const lookBackWindowLabel = i18n.translate(
   }
 );
 
+const lookBackWindowHelp = i18n.translate(
+  'xpack.triggersActionsUI.rulesSettings.flapping.lookBackWindowHelp',
+  {
+    defaultMessage: 'The minimum number of runs in which the threshold must be met.',
+  }
+);
+
 const statusChangeThresholdLabel = i18n.translate(
   'xpack.triggersActionsUI.rulesSettings.flapping.statusChangeThresholdLabel',
   {
@@ -46,6 +53,14 @@ const statusChangeThresholdLabel = i18n.translate(
   }
 );
 
+const statusChangeThresholdHelp = i18n.translate(
+  'xpack.triggersActionsUI.rulesSettings.flapping.statusChangeThresholdHelp',
+  {
+    defaultMessage:
+      'The minimum number of times an alert must switch states in the look back window.',
+  }
+);
+
 const getLookBackWindowLabelRuleRuns = (amount: number) => {
   return i18n.translate(
     'xpack.triggersActionsUI.rulesSettings.flapping.lookBackWindowLabelRuleRuns',
@@ -82,7 +97,7 @@ export const RulesSettingsFlappingTitle = () => {
       <h5>
         <FormattedMessage
           id="xpack.triggersActionsUI.rulesSettings.flapping.alertFlappingDetection"
-          defaultMessage="Alert Flapping Detection"
+          defaultMessage="Alert flapping detection"
         />
       </h5>
     </EuiTitle>
@@ -177,6 +192,7 @@ export const RulesSettingsFlappingFormSection = memo(
             value={lookBackWindow}
             onChange={(e) => onChange('lookBackWindow', parseInt(e.currentTarget.value, 10))}
             label={lookBackWindowLabel}
+            labelPopoverText={lookBackWindowHelp}
             disabled={!canWriteFlappingSettings}
           />
         </EuiFlexItem>
@@ -188,6 +204,7 @@ export const RulesSettingsFlappingFormSection = memo(
             value={statusChangeThreshold}
             onChange={(e) => onChange('statusChangeThreshold', parseInt(e.currentTarget.value, 10))}
             label={statusChangeThresholdLabel}
+            labelPopoverText={statusChangeThresholdHelp}
             disabled={!canWriteFlappingSettings}
           />
         </EuiFlexItem>
@@ -196,7 +213,7 @@ export const RulesSettingsFlappingFormSection = memo(
             <EuiText size="s">
               <FormattedMessage
                 id="xpack.triggersActionsUI.rulesSettings.flapping.flappingSettingsDescription"
-                defaultMessage="An alert will be considered flapping if it changes status {statusChangeThreshold} within the last {lookBackWindow}."
+                defaultMessage="An alert is flapping if it changes status at least {statusChangeThreshold} in the last {lookBackWindow}."
                 values={{
                   lookBackWindow: <b>{getLookBackWindowLabelRuleRuns(lookBackWindow)}</b>,
                   statusChangeThreshold: (
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/rules_setting/rules_settings_modal.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/rules_setting/rules_settings_modal.tsx
index 3b9e5d9ecf0ae9..702fbad50a85cf 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/rules_setting/rules_settings_modal.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/rules_setting/rules_settings_modal.tsx
@@ -43,14 +43,21 @@ const flappingDescription = i18n.translate(
   'xpack.triggersActionsUI.rulesSettings.modal.flappingDetectionDescription',
   {
     defaultMessage:
-      'Alerts that go quickly go between active and recovered are considered flapping. Detecting these changes and minimizing new alert generation can help reduce unwanted noise in your alerting system.',
+      'Detect alerts that switch quickly between active and recovered states and reduce unwanted noise for these flapping alerts.',
   }
 );
 
-const flappingEnableLabel = i18n.translate(
-  'xpack.triggersActionsUI.rulesSettings.modal.enableFlappingLabel',
+const flappingOnLabel = i18n.translate(
+  'xpack.triggersActionsUI.rulesSettings.modal.flappingOnLabel',
   {
-    defaultMessage: 'Enabled flapping detection (recommended)',
+    defaultMessage: 'On (recommended)',
+  }
+);
+
+const flappingOffLabel = i18n.translate(
+  'xpack.triggersActionsUI.rulesSettings.modal.flappingOffLabel',
+  {
+    defaultMessage: 'Off',
   }
 );
 
@@ -100,7 +107,7 @@ export const RulesSettingsModalFormLeft = memo((props: RulesSettingsModalFormLef
         <EuiFlexItem grow={false}>
           <EuiSwitch
             data-test-subj="rulesSettingsModalEnableSwitch"
-            label={flappingEnableLabel}
+            label={settings!.enabled ? flappingOnLabel : flappingOffLabel}
             checked={settings!.enabled}
             disabled={isSwitchDisabled}
             onChange={onChange}
@@ -129,7 +136,7 @@ export const RulesSettingsModalFormRight = memo((props: RulesSettingsModalFormRi
           <EuiText size="s">
             <FormattedMessage
               id="xpack.triggersActionsUI.rulesSettings.flapping.flappingSettingsOffDescription"
-              defaultMessage="Alert flapping detection is off. Alerts will be generated based on the rule interval. This may result in higher alert volume."
+              defaultMessage="Alert flapping detection is off. Alerts will be generated based on the rule interval, which might result in higher alert volumes."
             />
           </EuiText>
         </EuiPanel>
@@ -258,7 +265,7 @@ export const RulesSettingsModal = memo((props: RulesSettingsModalProps) => {
           <h3>
             <FormattedMessage
               id="xpack.triggersActionsUI.rulesSettings.modal.title"
-              defaultMessage="Rule Settings"
+              defaultMessage="Rule settings"
             />
           </h3>
         </EuiModalHeaderTitle>
@@ -267,7 +274,7 @@ export const RulesSettingsModal = memo((props: RulesSettingsModalProps) => {
         <EuiCallOut
           size="s"
           title={i18n.translate('xpack.triggersActionsUI.rulesSettings.modal.calloutMessage', {
-            defaultMessage: 'Applies to all rules within the current space',
+            defaultMessage: 'Apply to all rules within the current space.',
           })}
         />
         <EuiHorizontalRule />

From 4c626f16c0bfc333bf0591f586b082f6c09dd3b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez=20Haro?=
 <alejandro.haro@elastic.co>
Date: Tue, 24 Jan 2023 02:33:53 +0100
Subject: [PATCH 30/54] Unskip Execution Context FTRs (#149070)

Resolves https://github.com/elastic/kibana/issues/112102
---
 .../src/execution_context_service.test.ts     |   2 +
 .../src/execution_context_service.ts          |   1 +
 .../test_utils.ts                             | 106 ++++-
 .../tests/browser.ts                          | 365 +++++++++++-------
 .../tests/index.ts                            |  10 +
 .../tests/log_correlation.ts                  |   6 +-
 .../tests/server.ts                           |   4 +-
 7 files changed, 339 insertions(+), 155 deletions(-)

diff --git a/packages/core/execution-context/core-execution-context-browser-internal/src/execution_context_service.test.ts b/packages/core/execution-context/core-execution-context-browser-internal/src/execution_context_service.test.ts
index 767d3aa3e2dd89..115931632f5832 100644
--- a/packages/core/execution-context/core-execution-context-browser-internal/src/execution_context_service.test.ts
+++ b/packages/core/execution-context/core-execution-context-browser-internal/src/execution_context_service.test.ts
@@ -87,6 +87,7 @@ describe('ExecutionContextService', () => {
       `
       Object {
         "name": "app2",
+        "type": "application",
         "url": "/",
       }
     `
@@ -244,6 +245,7 @@ describe('ExecutionContextService', () => {
     execContext.clear();
     expect(sub).toHaveBeenCalledWith({
       name: 'app1',
+      type: 'application',
       url: '/',
     });
 
diff --git a/packages/core/execution-context/core-execution-context-browser-internal/src/execution_context_service.ts b/packages/core/execution-context/core-execution-context-browser-internal/src/execution_context_service.ts
index c54747f43c21a9..e09de53c78727f 100644
--- a/packages/core/execution-context/core-execution-context-browser-internal/src/execution_context_service.ts
+++ b/packages/core/execution-context/core-execution-context-browser-internal/src/execution_context_service.ts
@@ -98,6 +98,7 @@ export class ExecutionContextService
 
   private getDefaultContext() {
     return {
+      type: 'application',
       name: this.appId,
       url: window.location.pathname,
     };
diff --git a/x-pack/test/functional_execution_context/test_utils.ts b/x-pack/test/functional_execution_context/test_utils.ts
index 6cf1af27b0bb2a..65d0d7ece02c4c 100644
--- a/x-pack/test/functional_execution_context/test_utils.ts
+++ b/x-pack/test/functional_execution_context/test_utils.ts
@@ -9,17 +9,26 @@ import Path from 'path';
 import { isEqualWith } from 'lodash';
 import type { Ecs, KibanaExecutionContext } from '@kbn/core/server';
 import type { RetryService } from '@kbn/ftr-common-functional-services';
+import { concatMap, defer, filter, firstValueFrom, ReplaySubject, scan, timeout } from 'rxjs';
 
 export const logFilePath = Path.resolve(__dirname, './kibana.log');
 export const ANY = Symbol('any');
 
+let logstream$: ReplaySubject<Ecs> | undefined;
+
+export function getExecutionContextFromLogRecord(record: Ecs | undefined): KibanaExecutionContext {
+  if (record?.log?.logger !== 'execution_context' || !record?.message) {
+    throw new Error(`The record is not an entry of execution context`);
+  }
+  return JSON.parse(record.message);
+}
+
 export function isExecutionContextLog(
-  record: string | undefined,
+  record: Ecs | undefined,
   executionContext: KibanaExecutionContext
 ) {
-  if (!record) return false;
   try {
-    const object = JSON.parse(record);
+    const object = getExecutionContextFromLogRecord(record);
     return isEqualWith(object, executionContext, function customizer(obj1: any, obj2: any) {
       if (obj2 === ANY) return true;
     });
@@ -41,12 +50,89 @@ export async function assertLogContains({
 }): Promise<void> {
   // logs are written to disk asynchronously. I sacrificed performance to reduce flakiness.
   await retry.waitFor(description, async () => {
-    const logsStr = await Fs.readFile(logFilePath, 'utf-8');
-    const normalizedRecords = logsStr
-      .split(endOfLine)
-      .filter(Boolean)
-      .map((s) => JSON.parse(s));
-
-    return normalizedRecords.some(predicate);
+    if (!logstream$) {
+      logstream$ = getLogstream$();
+    }
+    try {
+      await firstValueFrom(logstream$.pipe(filter(predicate), timeout(5_000)));
+      return true;
+    } catch (err) {
+      return false;
+    }
   });
 }
+
+/**
+ * Creates an observable that continuously tails the log file.
+ */
+function getLogstream$(): ReplaySubject<Ecs> {
+  const stream$ = new ReplaySubject<Ecs>();
+
+  defer(async function* () {
+    const fd = await Fs.open(logFilePath, 'rs');
+    while (!stream$.isStopped) {
+      const { bytesRead, buffer } = await fd.read();
+      if (bytesRead) {
+        yield buffer.toString('utf8', 0, bytesRead);
+      }
+    }
+    await fd.close();
+  })
+    .pipe(
+      scan<string, { buffer: string; records: Ecs[] }>(
+        ({ buffer }, chunk) => {
+          const logString = buffer.concat(chunk);
+          const lines = logString.split(endOfLine);
+          const lastLine = lines.pop();
+          const records = lines.map((s) => JSON.parse(s));
+
+          let leftover = '';
+          if (lastLine) {
+            try {
+              const validRecord = JSON.parse(lastLine);
+              records.push(validRecord);
+            } catch (err) {
+              leftover = lastLine;
+            }
+          }
+
+          return { buffer: leftover, records };
+        },
+        {
+          records: [], // The ECS entries in the logs
+          buffer: '', // Accumulated leftovers from the previous operation
+        }
+      ),
+      concatMap(({ records }) => records)
+    )
+    .subscribe(stream$);
+
+  // let the content start flowing
+  stream$.subscribe();
+
+  return stream$;
+}
+
+export function closeLogstream() {
+  logstream$?.complete();
+  logstream$ = undefined;
+}
+
+/**
+ * Truncates the log file to avoid tests looking at the logs from previous executions.
+ */
+export async function clearLogFile() {
+  closeLogstream();
+  await Fs.writeFile(logFilePath, '', 'utf8');
+  await forceSyncLogFile();
+  logstream$ = getLogstream$();
+}
+
+/**
+ * Force the completion of all the pending I/O operations in the OS related to the log file.
+ */
+export async function forceSyncLogFile() {
+  const fileDescriptor = await Fs.open(logFilePath);
+  await fileDescriptor.datasync();
+  await fileDescriptor.close();
+}
diff --git a/x-pack/test/functional_execution_context/tests/browser.ts b/x-pack/test/functional_execution_context/tests/browser.ts
index aa990dccda86cd..1265fa205f7bc7 100644
--- a/x-pack/test/functional_execution_context/tests/browser.ts
+++ b/x-pack/test/functional_execution_context/tests/browser.ts
@@ -5,15 +5,15 @@
  * 2.0.
  */
 
+import type { Ecs, KibanaExecutionContext } from '@kbn/core/server';
 import type { FtrProviderContext } from '../ftr_provider_context';
-import { assertLogContains, isExecutionContextLog } from '../test_utils';
+import { assertLogContains, forceSyncLogFile, isExecutionContextLog } from '../test_utils';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const PageObjects = getPageObjects(['common', 'dashboard', 'header', 'home']);
   const retry = getService('retry');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/125743
-  describe.skip('Browser apps', () => {
+  describe('Browser apps', () => {
     before(async () => {
       await PageObjects.common.navigateToUrl('home', '/tutorial_directory/sampleData', {
         useActualUrl: true,
@@ -34,8 +34,20 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       before(async () => {
         await PageObjects.common.navigateToApp('discover');
         await PageObjects.header.waitUntilLoadingHasFinished();
+        await forceSyncLogFile();
       });
 
+      function checkExecutionContextEntry(expectedExecutionContext: KibanaExecutionContext) {
+        return (record: Ecs) =>
+          isExecutionContextLog(record, expectedExecutionContext) ||
+          isExecutionContextLog(record, {
+            ...expectedExecutionContext,
+            // There is a race condition that makes these 2 fields to show up some times
+            page: 'app',
+            id: 'new',
+          });
+      }
+
       it('propagates context for Discover', async () => {
         await assertLogContains({
           description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
@@ -45,29 +57,46 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         });
 
         await assertLogContains({
-          description: 'execution context propagates to Kibana logs',
-          predicate: (record) =>
-            isExecutionContextLog(record?.message, {
-              description: 'fetch documents',
-              id: '',
+          description: 'execution context propagates to Kibana logs (fetch documents)',
+          predicate: checkExecutionContextEntry({
+            type: 'application',
+            name: 'discover',
+            url: '/app/discover',
+            child: {
               name: 'discover',
-              type: 'application',
-              // discovery doesn't have an URL since one of from the example dataset is not saved separately
               url: '/app/discover',
-            }),
+              type: 'application',
+              page: 'app',
+              id: 'new',
+              description: 'fetch documents',
+            },
+          }),
           retry,
         });
 
         await assertLogContains({
-          description: 'execution context propagates to Kibana logs',
-          predicate: (record) =>
-            isExecutionContextLog(record?.message, {
-              description: 'fetch chart data and total hits',
-              id: '',
+          description:
+            'execution context propagates to Kibana logs (fetch chart data and total hits)',
+          predicate: checkExecutionContextEntry({
+            type: 'application',
+            name: 'discover',
+            url: '/app/discover',
+            child: {
               name: 'discover',
-              type: 'application',
               url: '/app/discover',
-            }),
+              type: 'application',
+              page: 'app',
+              id: 'new',
+              description: 'fetch chart data and total hits',
+              child: {
+                type: 'lens',
+                name: 'lnsXY',
+                id: 'unifiedHistogramLensComponent',
+                description: 'Edit visualization',
+                url: '/app/lens#/edit_by_value',
+              },
+            },
+          }),
           retry,
         });
       });
@@ -79,30 +108,76 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.dashboard.loadSavedDashboard('[Flights] Global Flight Dashboard');
         await PageObjects.dashboard.waitForRenderComplete();
         await PageObjects.header.waitUntilLoadingHasFinished();
+        await forceSyncLogFile();
       });
 
+      function checkHttpRequestId(suffix: string) {
+        return (record: Ecs): boolean =>
+          Boolean(
+            [
+              'kibana:application:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;',
+              // Race conditions may miss the dashboard ID at the top level
+              'kibana:application:dashboards:;',
+              // Race conditions may assign the dashboard type to the top level
+              'kibana:dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;',
+            ].some((prefix) => record.http?.request?.id?.includes(`${prefix}${suffix}`))
+          );
+      }
+
+      function checkExecutionContextEntry(expectedExecutionContext: KibanaExecutionContext) {
+        return (record: Ecs) =>
+          isExecutionContextLog(record, expectedExecutionContext) ||
+          isExecutionContextLog(record, { ...expectedExecutionContext, page: 'list' }) ||
+          isExecutionContextLog(record, { ...expectedExecutionContext, page: 'app' }) ||
+          isExecutionContextLog(record, {
+            ...expectedExecutionContext,
+            // There is a race condition that makes this field to be missed sometimes
+            page: 'app',
+            id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
+          }) ||
+          isExecutionContextLog(record, {
+            ...expectedExecutionContext,
+            // There is a race condition that makes the top context to match the child one
+            page: 'app',
+            type: 'dashboard',
+            id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
+          }) ||
+          isExecutionContextLog(record, {
+            ...expectedExecutionContext,
+            // There is a race condition that makes the top context to match the child one
+            page: 'app',
+            type: 'dashboard',
+            id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
+            description: '[Flights] Global Flight Dashboard',
+          }) ||
+          // Some race conditions misses one nested step
+          (!!expectedExecutionContext.child &&
+            isExecutionContextLog(record, expectedExecutionContext.child));
+      }
+
       describe('propagates context for Lens visualizations', () => {
         it('lnsXY', async () => {
           await assertLogContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-            predicate: (record) =>
-              Boolean(
-                record.http?.request?.id?.includes(
-                  'kibana:application:dashboard:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsXY:086ac2e9-dd16-4b45-92b8-1e43ff7e3f65'
-                )
-              ),
+            predicate: checkHttpRequestId(
+              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsXY:086ac2e9-dd16-4b45-92b8-1e43ff7e3f65'
+            ),
             retry,
           });
 
           await assertLogContains({
             description: 'execution context propagates to Kibana logs',
-            predicate: (record) =>
-              isExecutionContextLog(record?.message, {
-                type: 'application',
-                name: 'dashboard',
+            predicate: checkExecutionContextEntry({
+              type: 'application',
+              name: 'dashboards',
+              url: '/app/dashboards',
+              child: {
+                name: 'dashboards',
+                url: '/app/dashboards',
+                type: 'dashboard',
+                page: 'app',
                 id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
                 description: '[Flights] Global Flight Dashboard',
-                url: '/view/7adfa750-4c81-11e8-b3d7-01146121b73d',
                 child: {
                   type: 'lens',
                   name: 'lnsXY',
@@ -110,7 +185,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                   description: '[Flights] Flight count',
                   url: '/app/lens#/edit_by_value',
                 },
-              }),
+              },
+            }),
             retry,
           });
         });
@@ -118,32 +194,34 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         it('lnsMetric', async () => {
           await assertLogContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-            predicate: (record) =>
-              Boolean(
-                record.http?.request?.id?.includes(
-                  'kibana:application:dashboard:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsMetric:b766e3b8-4544-46ed-99e6-9ecc4847e2a2'
-                )
-              ),
+            predicate: checkHttpRequestId(
+              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsLegacyMetric:b766e3b8-4544-46ed-99e6-9ecc4847e2a2'
+            ),
             retry,
           });
 
           await assertLogContains({
             description: 'execution context propagates to Kibana logs',
-            predicate: (record) =>
-              isExecutionContextLog(record?.message, {
-                type: 'application',
-                name: 'dashboard',
+            predicate: checkExecutionContextEntry({
+              name: 'dashboards',
+              url: '/app/dashboards',
+              type: 'application',
+              child: {
+                name: 'dashboards',
+                url: '/app/dashboards',
+                type: 'dashboard',
+                page: 'app',
                 id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
                 description: '[Flights] Global Flight Dashboard',
-                url: '/view/7adfa750-4c81-11e8-b3d7-01146121b73d',
                 child: {
                   type: 'lens',
-                  name: 'lnsMetric',
-                  id: '2e33ade5-96e5-40b4-b460-493e5d4fa834',
+                  name: 'lnsLegacyMetric',
+                  id: 'b766e3b8-4544-46ed-99e6-9ecc4847e2a2',
                   description: '',
                   url: '/app/lens#/edit_by_value',
                 },
-              }),
+              },
+            }),
             retry,
           });
         });
@@ -151,24 +229,25 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         it('lnsDatatable', async () => {
           await assertLogContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-            predicate: (record) =>
-              Boolean(
-                record.http?.request?.id?.includes(
-                  'kibana:application:dashboard:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsDatatable:fb86b32f-fb7a-45cf-9511-f366fef51bbd'
-                )
-              ),
+            predicate: checkHttpRequestId(
+              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsDatatable:fb86b32f-fb7a-45cf-9511-f366fef51bbd'
+            ),
             retry,
           });
 
           await assertLogContains({
             description: 'execution context propagates to Kibana logs',
-            predicate: (record) =>
-              isExecutionContextLog(record?.message, {
-                type: 'application',
-                name: 'dashboard',
+            predicate: checkExecutionContextEntry({
+              name: 'dashboards',
+              url: '/app/dashboards',
+              type: 'application',
+              child: {
+                name: 'dashboards',
+                url: '/app/dashboards',
+                type: 'dashboard',
+                page: 'app',
                 id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
                 description: '[Flights] Global Flight Dashboard',
-                url: '/view/7adfa750-4c81-11e8-b3d7-01146121b73d',
                 child: {
                   type: 'lens',
                   name: 'lnsDatatable',
@@ -176,7 +255,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                   description: 'Cities by delay, cancellation',
                   url: '/app/lens#/edit_by_value',
                 },
-              }),
+              },
+            }),
             retry,
           });
         });
@@ -184,23 +264,24 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         it('lnsPie', async () => {
           await assertLogContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-            predicate: (record) =>
-              Boolean(
-                record.http?.request?.id?.includes(
-                  'kibana:application:dashboard:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsPie:5d53db36-2d5a-4adc-af7b-cec4c1a294e0'
-                )
-              ),
+            predicate: checkHttpRequestId(
+              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsPie:5d53db36-2d5a-4adc-af7b-cec4c1a294e0'
+            ),
             retry,
           });
           await assertLogContains({
             description: 'execution context propagates to Kibana logs',
-            predicate: (record) =>
-              isExecutionContextLog(record?.message, {
-                type: 'application',
-                name: 'dashboard',
+            predicate: checkExecutionContextEntry({
+              name: 'dashboards',
+              url: '/app/dashboards',
+              type: 'application',
+              child: {
+                name: 'dashboards',
+                url: '/app/dashboards',
+                type: 'dashboard',
+                page: 'app',
                 id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
                 description: '[Flights] Global Flight Dashboard',
-                url: '/view/7adfa750-4c81-11e8-b3d7-01146121b73d',
                 child: {
                   type: 'lens',
                   name: 'lnsPie',
@@ -208,7 +289,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                   description: '[Flights] Delay Type',
                   url: '/app/lens#/edit_by_value',
                 },
-              }),
+              },
+            }),
             retry,
           });
         });
@@ -217,23 +299,24 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       it('propagates context for built-in Discover', async () => {
         await assertLogContains({
           description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-          predicate: (record) =>
-            Boolean(
-              record.http?.request?.id?.includes(
-                'application:dashboard:7adfa750-4c81-11e8-b3d7-01146121b73d;search:discover:571aaf70-4c88-11e8-b3d7-01146121b73d'
-              )
-            ),
+          predicate: checkHttpRequestId(
+            'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;search:discover:571aaf70-4c88-11e8-b3d7-01146121b73d'
+          ),
           retry,
         });
         await assertLogContains({
           description: 'execution context propagates to Kibana logs',
-          predicate: (record) =>
-            isExecutionContextLog(record?.message, {
-              type: 'application',
-              name: 'dashboard',
+          predicate: checkExecutionContextEntry({
+            type: 'application',
+            name: 'dashboards',
+            url: '/app/dashboards',
+            child: {
+              type: 'dashboard',
+              name: 'dashboards',
+              url: '/app/dashboards',
+              page: 'app',
               id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
               description: '[Flights] Global Flight Dashboard',
-              url: '/view/7adfa750-4c81-11e8-b3d7-01146121b73d',
               child: {
                 type: 'search',
                 name: 'discover',
@@ -241,7 +324,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                 description: '[Flights] Flight Log',
                 url: '/app/discover#/view/571aaf70-4c88-11e8-b3d7-01146121b73d',
               },
-            }),
+            },
+          }),
           retry,
         });
       });
@@ -249,66 +333,61 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       it('propagates context for TSVB visualizations', async () => {
         await assertLogContains({
           description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-          predicate: (record) =>
-            Boolean(
-              record.http?.request?.id?.includes(
-                'kibana:application:dashboard:7adfa750-4c81-11e8-b3d7-01146121b73d;visualization:metrics:bcb63b50-4c89-11e8-b3d7-01146121b73d'
-              )
-            ),
+          predicate: checkHttpRequestId('agg_based:metrics:bcb63b50-4c89-11e8-b3d7-01146121b73d'),
           retry,
         });
 
         await assertLogContains({
           description: 'execution context propagates to Kibana logs',
-          predicate: (record) =>
-            isExecutionContextLog(record?.message, {
-              type: 'application',
-              name: 'dashboard',
-              id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
-              description: '[Flights] Global Flight Dashboard',
-              url: '/view/7adfa750-4c81-11e8-b3d7-01146121b73d',
-              child: {
-                type: 'visualization',
-                name: 'metrics',
-                id: 'bcb63b50-4c89-11e8-b3d7-01146121b73d',
-                description: '[Flights] Delays & Cancellations',
-                url: '/app/visualize#/edit/bcb63b50-4c89-11e8-b3d7-01146121b73d',
-              },
-            }),
+          predicate: checkExecutionContextEntry({
+            name: 'dashboards',
+            url: '/app/dashboards',
+            type: 'application',
+            page: 'app',
+            description: '[Flights] Global Flight Dashboard',
+            child: {
+              type: 'agg_based',
+              name: 'metrics',
+              id: 'bcb63b50-4c89-11e8-b3d7-01146121b73d',
+              description: '[Flights] Delays & Cancellations',
+              url: '/app/visualize#/edit/bcb63b50-4c89-11e8-b3d7-01146121b73d',
+            },
+          }),
           retry,
         });
       });
 
-      // application:dashboard:7adfa750-4c81-11e8-b3d7-01146121b73d;visualization:vega:ed78a660-53a0-11e8-acbd-0be0ad9d822b
       it('propagates context for Vega visualizations', async () => {
         await assertLogContains({
           description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-          predicate: (record) =>
-            Boolean(
-              record.http?.request?.id?.includes(
-                'kibana:application:dashboard:7adfa750-4c81-11e8-b3d7-01146121b73d;visualization:vega:ed78a660-53a0-11e8-acbd-0be0ad9d822b'
-              )
-            ),
+          predicate: checkHttpRequestId(
+            'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:vega:ed78a660-53a0-11e8-acbd-0be0ad9d822b'
+          ),
           retry,
         });
 
         await assertLogContains({
           description: 'execution context propagates to Kibana logs',
-          predicate: (record) =>
-            isExecutionContextLog(record?.message, {
-              type: 'application',
-              name: 'dashboard',
+          predicate: checkExecutionContextEntry({
+            name: 'dashboards',
+            url: '/app/dashboards',
+            type: 'application',
+            child: {
+              name: 'dashboards',
+              url: '/app/dashboards',
+              type: 'dashboard',
+              page: 'app',
               id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
               description: '[Flights] Global Flight Dashboard',
-              url: '/view/7adfa750-4c81-11e8-b3d7-01146121b73d',
               child: {
-                type: 'visualization',
+                type: 'agg_based',
                 name: 'vega',
                 id: 'ed78a660-53a0-11e8-acbd-0be0ad9d822b',
                 description: '[Flights] Airport Connections (Hover Over Airport)',
                 url: '/app/visualize#/edit/ed78a660-53a0-11e8-acbd-0be0ad9d822b',
               },
-            }),
+            },
+          }),
           retry,
         });
       });
@@ -316,32 +395,34 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       it('propagates context for Tag Cloud visualization', async () => {
         await assertLogContains({
           description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-          predicate: (record) =>
-            Boolean(
-              record.http?.request?.id?.includes(
-                'kibana:application:dashboard:7adfa750-4c81-11e8-b3d7-01146121b73d;visualization:tagcloud:293b5a30-4c8f-11e8-b3d7-01146121b73d'
-              )
-            ),
+          predicate: checkHttpRequestId(
+            'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:tagcloud:293b5a30-4c8f-11e8-b3d7-01146121b73d'
+          ),
           retry,
         });
 
         await assertLogContains({
           description: 'execution context propagates to Kibana logs',
-          predicate: (record) =>
-            isExecutionContextLog(record?.message, {
-              type: 'application',
-              name: 'dashboard',
+          predicate: checkExecutionContextEntry({
+            name: 'dashboards',
+            url: '/app/dashboards',
+            type: 'application',
+            child: {
+              name: 'dashboards',
+              url: '/app/dashboards',
+              type: 'dashboard',
+              page: 'app',
               id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
               description: '[Flights] Global Flight Dashboard',
-              url: '/view/7adfa750-4c81-11e8-b3d7-01146121b73d',
               child: {
-                type: 'visualization',
+                type: 'agg_based',
                 name: 'tagcloud',
                 id: '293b5a30-4c8f-11e8-b3d7-01146121b73d',
                 description: '[Flights] Destination Weather',
                 url: '/app/visualize#/edit/293b5a30-4c8f-11e8-b3d7-01146121b73d',
               },
-            }),
+            },
+          }),
           retry,
         });
       });
@@ -349,32 +430,34 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       it('propagates context for Vertical bar visualization', async () => {
         await assertLogContains({
           description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-          predicate: (record) =>
-            Boolean(
-              record.http?.request?.id?.includes(
-                'kibana:application:dashboard:7adfa750-4c81-11e8-b3d7-01146121b73d;visualization:histogram:9886b410-4c8b-11e8-b3d7-01146121b73d'
-              )
-            ),
+          predicate: checkHttpRequestId(
+            'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:histogram:9886b410-4c8b-11e8-b3d7-01146121b73d'
+          ),
           retry,
         });
 
         await assertLogContains({
           description: 'execution context propagates to Kibana logs',
-          predicate: (record) =>
-            isExecutionContextLog(record?.message, {
-              type: 'application',
-              name: 'dashboard',
+          predicate: checkExecutionContextEntry({
+            type: 'application',
+            name: 'dashboards',
+            url: '/app/dashboards',
+            child: {
+              type: 'dashboard',
+              name: 'dashboards',
+              url: '/app/dashboards',
+              page: 'app',
               id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
               description: '[Flights] Global Flight Dashboard',
-              url: '/view/7adfa750-4c81-11e8-b3d7-01146121b73d',
               child: {
-                type: 'visualization',
+                type: 'agg_based',
                 name: 'histogram',
                 id: '9886b410-4c8b-11e8-b3d7-01146121b73d',
                 description: '[Flights] Delay Buckets',
                 url: '/app/visualize#/edit/9886b410-4c8b-11e8-b3d7-01146121b73d',
               },
-            }),
+            },
+          }),
           retry,
         });
       });
diff --git a/x-pack/test/functional_execution_context/tests/index.ts b/x-pack/test/functional_execution_context/tests/index.ts
index 2c34783a9bae30..ac83d4246bb8c8 100644
--- a/x-pack/test/functional_execution_context/tests/index.ts
+++ b/x-pack/test/functional_execution_context/tests/index.ts
@@ -6,9 +6,19 @@
  */
 
 import { FtrProviderContext } from '../ftr_provider_context';
+import { clearLogFile, closeLogstream } from '../test_utils';
 
 export default function ({ loadTestFile }: FtrProviderContext) {
   describe('Execution context', function () {
+    before(async () => {
+      // Cleaning the log file used for the tests to avoid false positives caused by previous runs.
+      // If any of the tests rely on logs generating during bootstrap, we might need to change this.
+      await clearLogFile();
+    });
+    after(() => {
+      closeLogstream();
+    });
+
     loadTestFile(require.resolve('./browser'));
     loadTestFile(require.resolve('./server'));
     loadTestFile(require.resolve('./log_correlation'));
diff --git a/x-pack/test/functional_execution_context/tests/log_correlation.ts b/x-pack/test/functional_execution_context/tests/log_correlation.ts
index fddaf282b7a7ff..35585f092bbcf0 100644
--- a/x-pack/test/functional_execution_context/tests/log_correlation.ts
+++ b/x-pack/test/functional_execution_context/tests/log_correlation.ts
@@ -6,7 +6,7 @@
  */
 import expect from '@kbn/expect';
 import type { FtrProviderContext } from '../ftr_provider_context';
-import { assertLogContains } from '../test_utils';
+import { assertLogContains, forceSyncLogFile } from '../test_utils';
 
 export default function ({ getService }: FtrProviderContext) {
   const retry = getService('retry');
@@ -24,12 +24,14 @@ export default function ({ getService }: FtrProviderContext) {
 
       expect(response2.body.traceId).not.to.be(response1.body.traceId);
 
+      await forceSyncLogFile();
+
       let responseTraceId: string | undefined;
       await assertLogContains({
         description: 'traceId included in the http logs',
         predicate: (record) => {
           // we don't check trace.id value since trace.id in the test plugin and Kibana are different on CI.
-          // because different 'elastic-apm-node' instaces are imported
+          // because different 'elastic-apm-node' instances are imported
           if (
             record.log?.logger === 'http.server.response' &&
             record.url?.path === '/emit_log_with_trace_id'
diff --git a/x-pack/test/functional_execution_context/tests/server.ts b/x-pack/test/functional_execution_context/tests/server.ts
index 0973c32e9e0fb6..097dc330c37cae 100644
--- a/x-pack/test/functional_execution_context/tests/server.ts
+++ b/x-pack/test/functional_execution_context/tests/server.ts
@@ -92,7 +92,7 @@ export default function ({ getService }: FtrProviderContext) {
       await assertLogContains({
         description: 'execution context propagates to Kibana logs',
         predicate: (record) =>
-          isExecutionContextLog(record?.message, {
+          isExecutionContextLog(record, {
             type: 'task manager',
             name: 'run alerting:test.executionContext',
             // @ts-expect-error. it accepts strings only
@@ -132,7 +132,7 @@ export default function ({ getService }: FtrProviderContext) {
       await assertLogContains({
         description: 'execution context propagates to Kibana logs',
         predicate: (record) =>
-          isExecutionContextLog(record?.message, {
+          isExecutionContextLog(record, {
             type: 'usage_collection',
             name: 'collector.fetch',
             id: 'application_usage',

From b7a0204e497783ca2f8a0cbf676ebdf737513071 Mon Sep 17 00:00:00 2001
From: Ying Mao <ying.mao@elastic.co>
Date: Mon, 23 Jan 2023 21:07:09 -0500
Subject: [PATCH 31/54] [Response Ops][Alerting] Install resources needed for
 framework alerts-as-data (#145581)

Resolves https://github.com/elastic/kibana/issues/145100

## Summary

* Adds alerting config for `enableFrameworkAlerts`
* When `xpack.alerting.enableFrameworkAlerts=true`, `AlertsService` is
initialized during the alerting plugin setup phase
* Adds optional `alerts` definition to the `RuleType` definition which
allows a rule type to specify a context and a field mapping for that
context
* `AlertsService.initialize()`
* installs an ILM policy that will be used by all alerts-as-data indices
- `alerts-default-ilm-policy`
* installs a component template that will be used by all alerts-as-data
indices - `alerts-common-component-template`, including all the mappings
for fields needed by the framework
* Rule type registration - when a rule type with an `alerts` definition
is registered, the context and field map are registered with the
`AlertService`. When `AlertsService` initialization is completed
successfully, context specific resources are installed.
* Context specific resources:
* installs context specific component template that reflects the
registered field map - `alerts-${context}-component-template`
* installs context specific index template for the default namespace -
`.alerts-${context}-default-template`
* creates context specific concrete write index for the default
namespace - `.alerts-${context}-default-000001`
* Resource installation retries for transient ES errors and
short-circuits when a timeout value is reached

## Notes
* We explore the possibility of creating a single index template per
context and re-using it for space-aware concrete indices but a rollover
alias (which must be space-aware) must be attached to an index template
so it is not feasible to only have a single index template
* There will be a followup issue for create space-specific index
templates/indices as needed to support detection rules desire to
separate alerts by space.

## To Verify

* set `xpack.alerting.enableFrameworkAlerts: true` in your kibana.yml
* modify
`x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.ts` to
define a custom field mapping for the `stack` context

```
--- a/x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.ts
+++ b/x-pack/plugins/stack_alerts/server/rule_types/es_query/rule_type.ts
@@ -187,5 +187,14 @@ export function getRuleType(
     },
     producer: STACK_ALERTS_FEATURE_ID,
     doesSetRecoveryContext: true,
+    alerts: {
+      context: 'stack',
+      fieldMap: {
+        'kibana.alert.threshold': {
+          required: false,
+          type: 'long',
+        },
+      },
+    },
   };
 }

```
* start up ES and Kibana and verify that the correct resources are
installed. The following should be created:
  * ILM policy - `alerts-default-ilm-policy`
  * Common component template - `alerts-common-component-template`
  * Stack component template - `alerts-stack-component-template`
* Stack index template for default space -
`.alerts-stack-default-template`
  * Stack write index for default space - `.alerts-stack-default-000001`
* verify that the index template uses both component templates and that
the expected mappings are applied to the index
* try making non-destructive, additive only changes to the common
component template or the stack context field mapping and verify that
the concrete index mappings are updated.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 packages/kbn-rule-data-utils/index.ts         |   1 +
 .../src/default_alerts_as_data.ts             | 141 +++
 .../src/technical_field_names.ts              |  82 +-
 .../field_maps/alert_field_map.ts             | 147 +++
 .../component_template_from_field_map.ts      |  35 +
 .../field_maps/mapping_from_field_map.test.ts | 282 ++++++
 .../field_maps/mapping_from_field_map.ts      |  52 +
 .../common/alert_schema/field_maps/types.ts   |  29 +
 .../alerting/common/alert_schema/index.ts     |   9 +
 .../alerts_service/alerts_service.mock.ts     |  21 +
 .../alerts_service/alerts_service.test.ts     | 944 ++++++++++++++++++
 .../server/alerts_service/alerts_service.ts   | 512 ++++++++++
 ...reate_resource_installation_helper.test.ts | 137 +++
 .../create_resource_installation_helper.ts    |  81 ++
 .../default_lifecycle_policy.ts               |  34 +
 .../retry_transient_es_errors.test.ts         |  95 ++
 .../retry_transient_es_errors.ts              |  57 ++
 .../alerting/server/alerts_service/types.ts   |  44 +
 x-pack/plugins/alerting/server/config.test.ts |   1 +
 x-pack/plugins/alerting/server/config.ts      |   1 +
 x-pack/plugins/alerting/server/plugin.test.ts |  22 +
 x-pack/plugins/alerting/server/plugin.ts      |  20 +-
 .../server/rule_type_registry.test.ts         |  51 +
 .../alerting/server/rule_type_registry.ts     |  10 +
 x-pack/plugins/alerting/server/types.ts       |   7 +
 x-pack/plugins/alerting/tsconfig.json         |   3 +-
 .../alerting_api_integration/common/config.ts |   1 +
 .../plugins/alerts/server/alert_types.ts      |  21 +
 .../tests/alerting/alerts_as_data.ts          | 176 ++++
 .../spaces_only/tests/alerting/index.ts       |   1 +
 30 files changed, 2959 insertions(+), 58 deletions(-)
 create mode 100644 packages/kbn-rule-data-utils/src/default_alerts_as_data.ts
 create mode 100644 x-pack/plugins/alerting/common/alert_schema/field_maps/alert_field_map.ts
 create mode 100644 x-pack/plugins/alerting/common/alert_schema/field_maps/component_template_from_field_map.ts
 create mode 100644 x-pack/plugins/alerting/common/alert_schema/field_maps/mapping_from_field_map.test.ts
 create mode 100644 x-pack/plugins/alerting/common/alert_schema/field_maps/mapping_from_field_map.ts
 create mode 100644 x-pack/plugins/alerting/common/alert_schema/field_maps/types.ts
 create mode 100644 x-pack/plugins/alerting/common/alert_schema/index.ts
 create mode 100644 x-pack/plugins/alerting/server/alerts_service/alerts_service.mock.ts
 create mode 100644 x-pack/plugins/alerting/server/alerts_service/alerts_service.test.ts
 create mode 100644 x-pack/plugins/alerting/server/alerts_service/alerts_service.ts
 create mode 100644 x-pack/plugins/alerting/server/alerts_service/create_resource_installation_helper.test.ts
 create mode 100644 x-pack/plugins/alerting/server/alerts_service/create_resource_installation_helper.ts
 create mode 100644 x-pack/plugins/alerting/server/alerts_service/default_lifecycle_policy.ts
 create mode 100644 x-pack/plugins/alerting/server/alerts_service/retry_transient_es_errors.test.ts
 create mode 100644 x-pack/plugins/alerting/server/alerts_service/retry_transient_es_errors.ts
 create mode 100644 x-pack/plugins/alerting/server/alerts_service/types.ts
 create mode 100644 x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_as_data.ts

diff --git a/packages/kbn-rule-data-utils/index.ts b/packages/kbn-rule-data-utils/index.ts
index 897e5609a83475..18c81aba6d81a9 100644
--- a/packages/kbn-rule-data-utils/index.ts
+++ b/packages/kbn-rule-data-utils/index.ts
@@ -6,6 +6,7 @@
  * Side Public License, v 1.
  */
 
+export * from './src/default_alerts_as_data';
 export * from './src/technical_field_names';
 export * from './src/alerts_as_data_rbac';
 export * from './src/alerts_as_data_severity';
diff --git a/packages/kbn-rule-data-utils/src/default_alerts_as_data.ts b/packages/kbn-rule-data-utils/src/default_alerts_as_data.ts
new file mode 100644
index 00000000000000..b428bea94cdcd1
--- /dev/null
+++ b/packages/kbn-rule-data-utils/src/default_alerts_as_data.ts
@@ -0,0 +1,141 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { ValuesType } from 'utility-types';
+
+const KIBANA_NAMESPACE = 'kibana' as const;
+const ALERT_NAMESPACE = `${KIBANA_NAMESPACE}.alert` as const;
+const ALERT_RULE_NAMESPACE = `${ALERT_NAMESPACE}.rule` as const;
+
+// kibana.space_ids - space ID(s) of the rule that created this alert
+const SPACE_IDS = `${KIBANA_NAMESPACE}.space_ids` as const;
+
+// kibana.version - Kibana version that this alert was created
+const VERSION = `${KIBANA_NAMESPACE}.version` as const;
+
+// kibana.alert.action_group - framework action group ID for this alert
+const ALERT_ACTION_GROUP = `${ALERT_NAMESPACE}.action_group` as const;
+
+// kibana.alert.duration.us - alert duration in nanoseconds - updated each execution
+// that the alert is active
+const ALERT_DURATION = `${ALERT_NAMESPACE}.duration.us` as const;
+
+// kibana.alert.end - timestamp when the alert is auto-recovered by the framework
+const ALERT_END = `${ALERT_NAMESPACE}.end` as const;
+
+// kibana.alert.flapping - whether the alert is currently in a flapping state
+const ALERT_FLAPPING = `${ALERT_NAMESPACE}.flapping` as const;
+
+// kibana.alert.id - alert ID, also known as alert instance ID
+const ALERT_ID = `${ALERT_NAMESPACE}.id` as const;
+
+// kibana.alert.reason - human readable reason that this alert is active
+const ALERT_REASON = `${ALERT_NAMESPACE}.reason` as const;
+
+// kibana.alert.start - timestamp when the alert is first active
+const ALERT_START = `${ALERT_NAMESPACE}.start` as const;
+
+// kibana.alert.status - active/recovered status of alert
+const ALERT_STATUS = `${ALERT_NAMESPACE}.status` as const;
+
+// kibana.alert.time_range - time range of alert from kibana.alert.start to now
+const ALERT_TIME_RANGE = `${ALERT_NAMESPACE}.time_range` as const;
+
+// kibana.alert.uuid - unique ID for the active span of this alert
+const ALERT_UUID = `${ALERT_NAMESPACE}.uuid` as const;
+
+// kibana.alert.workflow_status - open/closed status of alert
+const ALERT_WORKFLOW_STATUS = `${ALERT_NAMESPACE}.workflow_status` as const;
+
+// kibana.alert.rule.category - rule type name for rule that generated this alert
+const ALERT_RULE_CATEGORY = `${ALERT_RULE_NAMESPACE}.category` as const;
+
+// kibana.alert.rule.consumer - consumer for rule that generated this alert
+const ALERT_RULE_CONSUMER = `${ALERT_RULE_NAMESPACE}.consumer` as const;
+
+// kibana.alert.rule.execution.uuid - unique ID for the rule execution that generated this alert
+const ALERT_RULE_EXECUTION_UUID = `${ALERT_RULE_NAMESPACE}.execution.uuid` as const;
+
+// kibana.alert.rule.name - rule name for rule that generated this alert
+const ALERT_RULE_NAME = `${ALERT_RULE_NAMESPACE}.name` as const;
+
+// kibana.alert.rule.parameters - rule parameters for rule that generated this alert
+const ALERT_RULE_PARAMETERS = `${ALERT_RULE_NAMESPACE}.parameters` as const;
+
+// kibana.alert.rule.producer - rule type producer for rule that generated this alert
+const ALERT_RULE_PRODUCER = `${ALERT_RULE_NAMESPACE}.producer` as const;
+
+// kibana.alert.rule.tags - rule tags for rule that generated this alert
+const ALERT_RULE_TAGS = `${ALERT_RULE_NAMESPACE}.tags` as const;
+
+// kibana.alert.rule_type_id - rule type id for rule that generated this alert
+const ALERT_RULE_TYPE_ID = `${ALERT_RULE_NAMESPACE}.rule_type_id` as const;
+
+// kibana.alert.rule.uuid - rule ID for rule that generated this alert
+const ALERT_RULE_UUID = `${ALERT_RULE_NAMESPACE}.uuid` as const;
+
+const namespaces = {
+  KIBANA_NAMESPACE,
+  ALERT_NAMESPACE,
+  ALERT_RULE_NAMESPACE,
+};
+
+const fields = {
+  ALERT_ACTION_GROUP,
+  ALERT_DURATION,
+  ALERT_END,
+  ALERT_FLAPPING,
+  ALERT_ID,
+  ALERT_REASON,
+  ALERT_RULE_CATEGORY,
+  ALERT_RULE_CONSUMER,
+  ALERT_RULE_EXECUTION_UUID,
+  ALERT_RULE_NAME,
+  ALERT_RULE_PARAMETERS,
+  ALERT_RULE_PRODUCER,
+  ALERT_RULE_TAGS,
+  ALERT_RULE_TYPE_ID,
+  ALERT_RULE_UUID,
+  ALERT_START,
+  ALERT_STATUS,
+  ALERT_TIME_RANGE,
+  ALERT_UUID,
+  ALERT_WORKFLOW_STATUS,
+  SPACE_IDS,
+  VERSION,
+};
+
+export {
+  ALERT_ACTION_GROUP,
+  ALERT_DURATION,
+  ALERT_END,
+  ALERT_FLAPPING,
+  ALERT_ID,
+  ALERT_REASON,
+  ALERT_RULE_CATEGORY,
+  ALERT_RULE_CONSUMER,
+  ALERT_RULE_EXECUTION_UUID,
+  ALERT_RULE_NAME,
+  ALERT_RULE_PARAMETERS,
+  ALERT_RULE_PRODUCER,
+  ALERT_RULE_TAGS,
+  ALERT_RULE_TYPE_ID,
+  ALERT_RULE_UUID,
+  ALERT_START,
+  ALERT_STATUS,
+  ALERT_TIME_RANGE,
+  ALERT_UUID,
+  ALERT_WORKFLOW_STATUS,
+  SPACE_IDS,
+  VERSION,
+  ALERT_NAMESPACE,
+  ALERT_RULE_NAMESPACE,
+  KIBANA_NAMESPACE,
+};
+
+export type DefaultAlertFieldName = ValuesType<typeof fields & typeof namespaces>;
diff --git a/packages/kbn-rule-data-utils/src/technical_field_names.ts b/packages/kbn-rule-data-utils/src/technical_field_names.ts
index b5c4516c6c2c7c..89eca0f9230464 100644
--- a/packages/kbn-rule-data-utils/src/technical_field_names.ts
+++ b/packages/kbn-rule-data-utils/src/technical_field_names.ts
@@ -7,41 +7,51 @@
  */
 
 import { ValuesType } from 'utility-types';
+import {
+  KIBANA_NAMESPACE,
+  ALERT_ACTION_GROUP,
+  ALERT_DURATION,
+  ALERT_END,
+  ALERT_FLAPPING,
+  ALERT_REASON,
+  ALERT_RULE_CATEGORY,
+  ALERT_RULE_CONSUMER,
+  ALERT_RULE_EXECUTION_UUID,
+  ALERT_RULE_NAME,
+  ALERT_RULE_PARAMETERS,
+  ALERT_RULE_PRODUCER,
+  ALERT_RULE_TAGS,
+  ALERT_RULE_TYPE_ID,
+  ALERT_RULE_UUID,
+  ALERT_START,
+  ALERT_STATUS,
+  ALERT_TIME_RANGE,
+  ALERT_UUID,
+  ALERT_WORKFLOW_STATUS,
+  SPACE_IDS,
+  VERSION,
+  ALERT_NAMESPACE,
+  ALERT_RULE_NAMESPACE,
+} from './default_alerts_as_data';
 
-const KIBANA_NAMESPACE = 'kibana' as const;
-
-const ALERT_NAMESPACE = `${KIBANA_NAMESPACE}.alert` as const;
-const ALERT_RULE_NAMESPACE = `${ALERT_NAMESPACE}.rule` as const;
 const ALERT_RULE_THREAT_NAMESPACE = `${ALERT_RULE_NAMESPACE}.threat` as const;
 
 const ECS_VERSION = 'ecs.version' as const;
 const EVENT_ACTION = 'event.action' as const;
 const EVENT_KIND = 'event.kind' as const;
 const EVENT_MODULE = 'event.module' as const;
-const SPACE_IDS = `${KIBANA_NAMESPACE}.space_ids` as const;
 const TAGS = 'tags' as const;
 const TIMESTAMP = '@timestamp' as const;
-const VERSION = `${KIBANA_NAMESPACE}.version` as const;
 
 // Fields pertaining to the alert
-const ALERT_ACTION_GROUP = `${ALERT_NAMESPACE}.action_group` as const;
 const ALERT_BUILDING_BLOCK_TYPE = `${ALERT_NAMESPACE}.building_block_type` as const;
-const ALERT_DURATION = `${ALERT_NAMESPACE}.duration.us` as const;
-const ALERT_END = `${ALERT_NAMESPACE}.end` as const;
 const ALERT_EVALUATION_THRESHOLD = `${ALERT_NAMESPACE}.evaluation.threshold` as const;
 const ALERT_EVALUATION_VALUE = `${ALERT_NAMESPACE}.evaluation.value` as const;
-const ALERT_FLAPPING = `${ALERT_NAMESPACE}.flapping` as const;
 const ALERT_INSTANCE_ID = `${ALERT_NAMESPACE}.instance.id` as const;
-const ALERT_REASON = `${ALERT_NAMESPACE}.reason` as const;
 const ALERT_RISK_SCORE = `${ALERT_NAMESPACE}.risk_score` as const;
 const ALERT_SEVERITY = `${ALERT_NAMESPACE}.severity` as const;
-const ALERT_START = `${ALERT_NAMESPACE}.start` as const;
-const ALERT_TIME_RANGE = `${ALERT_NAMESPACE}.time_range` as const;
-const ALERT_STATUS = `${ALERT_NAMESPACE}.status` as const;
 const ALERT_SYSTEM_STATUS = `${ALERT_NAMESPACE}.system_status` as const;
-const ALERT_UUID = `${ALERT_NAMESPACE}.uuid` as const;
 const ALERT_WORKFLOW_REASON = `${ALERT_NAMESPACE}.workflow_reason` as const;
-const ALERT_WORKFLOW_STATUS = `${ALERT_NAMESPACE}.workflow_status` as const;
 const ALERT_WORKFLOW_USER = `${ALERT_NAMESPACE}.workflow_user` as const;
 const ALERT_SUPPRESSION_META = `${ALERT_NAMESPACE}.suppression` as const;
 const ALERT_SUPPRESSION_TERMS = `${ALERT_SUPPRESSION_META}.terms` as const;
@@ -61,22 +71,16 @@ const ALERT_RULE_CREATED_BY = `${ALERT_RULE_NAMESPACE}.created_by` as const;
 const ALERT_RULE_DESCRIPTION = `${ALERT_RULE_NAMESPACE}.description` as const;
 const ALERT_RULE_ENABLED = `${ALERT_RULE_NAMESPACE}.enabled` as const;
 const ALERT_RULE_EXCEPTIONS_LIST = `${ALERT_RULE_NAMESPACE}.exceptions_list` as const;
-const ALERT_RULE_EXECUTION_UUID = `${ALERT_RULE_NAMESPACE}.execution.uuid` as const;
 const ALERT_RULE_FROM = `${ALERT_RULE_NAMESPACE}.from` as const;
 const ALERT_RULE_INTERVAL = `${ALERT_RULE_NAMESPACE}.interval` as const;
 const ALERT_RULE_LICENSE = `${ALERT_RULE_NAMESPACE}.license` as const;
-const ALERT_RULE_CATEGORY = `${ALERT_RULE_NAMESPACE}.category` as const;
-const ALERT_RULE_NAME = `${ALERT_RULE_NAMESPACE}.name` as const;
 const ALERT_RULE_NAMESPACE_FIELD = `${ALERT_RULE_NAMESPACE}.namespace` as const;
 const ALERT_RULE_NOTE = `${ALERT_RULE_NAMESPACE}.note` as const;
-const ALERT_RULE_PARAMETERS = `${ALERT_RULE_NAMESPACE}.parameters` as const;
 const ALERT_RULE_REFERENCES = `${ALERT_RULE_NAMESPACE}.references` as const;
 const ALERT_RULE_RULE_ID = `${ALERT_RULE_NAMESPACE}.rule_id` as const;
 const ALERT_RULE_RULE_NAME_OVERRIDE = `${ALERT_RULE_NAMESPACE}.rule_name_override` as const;
-const ALERT_RULE_TAGS = `${ALERT_RULE_NAMESPACE}.tags` as const;
 const ALERT_RULE_TO = `${ALERT_RULE_NAMESPACE}.to` as const;
 const ALERT_RULE_TYPE = `${ALERT_RULE_NAMESPACE}.type` as const;
-const ALERT_RULE_TYPE_ID = `${ALERT_RULE_NAMESPACE}.rule_type_id` as const;
 const ALERT_RULE_UPDATED_AT = `${ALERT_RULE_NAMESPACE}.updated_at` as const;
 const ALERT_RULE_UPDATED_BY = `${ALERT_RULE_NAMESPACE}.updated_by` as const;
 const ALERT_RULE_VERSION = `${ALERT_RULE_NAMESPACE}.version` as const;
@@ -97,16 +101,6 @@ const ALERT_THREAT_TECHNIQUE_SUBTECHNIQUE_NAME =
 const ALERT_THREAT_TECHNIQUE_SUBTECHNIQUE_REFERENCE =
   `${ALERT_RULE_THREAT_NAMESPACE}.technique.subtechnique.reference` as const;
 
-// the feature instantiating a rule type.
-// Rule created in stack --> alerts
-// Rule created in siem --> siem
-const ALERT_RULE_CONSUMER = `${ALERT_RULE_NAMESPACE}.consumer` as const;
-// the plugin that registered the rule type.
-// Rule type apm.error_rate --> apm
-// Rule type siem.signals --> siem
-const ALERT_RULE_PRODUCER = `${ALERT_RULE_NAMESPACE}.producer` as const;
-const ALERT_RULE_UUID = `${ALERT_RULE_NAMESPACE}.uuid` as const;
-
 const namespaces = {
   KIBANA_NAMESPACE,
   ALERT_NAMESPACE,
@@ -189,23 +183,12 @@ const fields = {
 };
 
 export {
-  ALERT_ACTION_GROUP,
   ALERT_BUILDING_BLOCK_TYPE,
-  ALERT_DURATION,
-  ALERT_END,
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
-  ALERT_FLAPPING,
   ALERT_INSTANCE_ID,
-  ALERT_NAMESPACE,
-  ALERT_RULE_NAMESPACE,
-  ALERT_RULE_CONSUMER,
-  ALERT_RULE_PRODUCER,
-  ALERT_REASON,
   ALERT_RISK_SCORE,
-  ALERT_STATUS,
   ALERT_WORKFLOW_REASON,
-  ALERT_WORKFLOW_STATUS,
   ALERT_WORKFLOW_USER,
   ALERT_CASE_IDS,
   ALERT_RULE_AUTHOR,
@@ -214,36 +197,25 @@ export {
   ALERT_RULE_DESCRIPTION,
   ALERT_RULE_ENABLED,
   ALERT_RULE_EXCEPTIONS_LIST,
-  ALERT_RULE_EXECUTION_UUID,
   ALERT_RULE_FROM,
   ALERT_RULE_INTERVAL,
   ALERT_RULE_LICENSE,
-  ALERT_RULE_NAME,
   ALERT_RULE_NAMESPACE_FIELD,
   ALERT_RULE_NOTE,
-  ALERT_RULE_PARAMETERS,
   ALERT_RULE_REFERENCES,
   ALERT_RULE_RULE_ID,
   ALERT_RULE_RULE_NAME_OVERRIDE,
-  ALERT_RULE_TAGS,
   ALERT_RULE_TO,
   ALERT_RULE_TYPE,
-  ALERT_RULE_TYPE_ID,
   ALERT_RULE_UPDATED_AT,
   ALERT_RULE_UPDATED_BY,
   ALERT_RULE_VERSION,
   ALERT_SEVERITY,
-  ALERT_START,
-  ALERT_TIME_RANGE,
   ALERT_SYSTEM_STATUS,
-  ALERT_UUID,
   ECS_VERSION,
   EVENT_ACTION,
   EVENT_KIND,
   EVENT_MODULE,
-  KIBANA_NAMESPACE,
-  ALERT_RULE_UUID,
-  ALERT_RULE_CATEGORY,
   ALERT_THREAT_FRAMEWORK,
   ALERT_THREAT_TACTIC_ID,
   ALERT_THREAT_TACTIC_NAME,
@@ -262,8 +234,6 @@ export {
   ALERT_SUPPRESSION_DOCS_COUNT,
   TAGS,
   TIMESTAMP,
-  SPACE_IDS,
-  VERSION,
 };
 
 export type TechnicalRuleDataFieldName = ValuesType<typeof fields & typeof namespaces>;
diff --git a/x-pack/plugins/alerting/common/alert_schema/field_maps/alert_field_map.ts b/x-pack/plugins/alerting/common/alert_schema/field_maps/alert_field_map.ts
new file mode 100644
index 00000000000000..4613415e0fa002
--- /dev/null
+++ b/x-pack/plugins/alerting/common/alert_schema/field_maps/alert_field_map.ts
@@ -0,0 +1,147 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  ALERT_ACTION_GROUP,
+  ALERT_DURATION,
+  ALERT_END,
+  ALERT_FLAPPING,
+  ALERT_ID,
+  ALERT_REASON,
+  ALERT_RULE_CATEGORY,
+  ALERT_RULE_CONSUMER,
+  ALERT_RULE_EXECUTION_UUID,
+  ALERT_RULE_NAME,
+  ALERT_RULE_PARAMETERS,
+  ALERT_RULE_PRODUCER,
+  ALERT_RULE_TAGS,
+  ALERT_RULE_TYPE_ID,
+  ALERT_RULE_UUID,
+  ALERT_START,
+  ALERT_STATUS,
+  ALERT_TIME_RANGE,
+  ALERT_UUID,
+  ALERT_WORKFLOW_STATUS,
+  SPACE_IDS,
+  VERSION,
+} from '@kbn/rule-data-utils';
+
+export const alertFieldMap = {
+  [ALERT_RULE_PARAMETERS]: {
+    type: 'object',
+    enabled: false,
+    required: false,
+  },
+  [ALERT_RULE_TYPE_ID]: {
+    type: 'keyword',
+    array: false,
+    required: true,
+  },
+  [ALERT_RULE_CONSUMER]: {
+    type: 'keyword',
+    array: false,
+    required: true,
+  },
+  [ALERT_RULE_PRODUCER]: {
+    type: 'keyword',
+    array: false,
+    required: true,
+  },
+  [SPACE_IDS]: {
+    type: 'keyword',
+    array: true,
+    required: true,
+  },
+  [ALERT_UUID]: {
+    type: 'keyword',
+    array: false,
+    required: true,
+  },
+  [ALERT_ID]: {
+    type: 'keyword',
+    array: false,
+    required: true,
+  },
+  [ALERT_START]: {
+    type: 'date',
+    array: false,
+    required: false,
+  },
+  [ALERT_TIME_RANGE]: {
+    type: 'date_range',
+    format: 'epoch_millis||strict_date_optional_time',
+    array: false,
+    required: false,
+  },
+  [ALERT_END]: {
+    type: 'date',
+    array: false,
+    required: false,
+  },
+  [ALERT_DURATION]: {
+    type: 'long',
+    array: false,
+    required: false,
+  },
+  [ALERT_STATUS]: {
+    type: 'keyword',
+    array: false,
+    required: true,
+  },
+  [VERSION]: {
+    type: 'version',
+    array: false,
+    required: false,
+  },
+  [ALERT_WORKFLOW_STATUS]: {
+    type: 'keyword',
+    array: false,
+    required: false,
+  },
+  [ALERT_ACTION_GROUP]: {
+    type: 'keyword',
+    array: false,
+    required: false,
+  },
+  [ALERT_REASON]: {
+    type: 'keyword',
+    array: false,
+    required: false,
+  },
+  [ALERT_RULE_CATEGORY]: {
+    type: 'keyword',
+    array: false,
+    required: true,
+  },
+  [ALERT_RULE_UUID]: {
+    type: 'keyword',
+    array: false,
+    required: true,
+  },
+  [ALERT_RULE_EXECUTION_UUID]: {
+    type: 'keyword',
+    array: false,
+    required: false,
+  },
+  [ALERT_RULE_NAME]: {
+    type: 'keyword',
+    array: false,
+    required: true,
+  },
+  [ALERT_RULE_TAGS]: {
+    type: 'keyword',
+    array: true,
+    required: false,
+  },
+  [ALERT_FLAPPING]: {
+    type: 'boolean',
+    array: false,
+    required: false,
+  },
+};
+
+export type AlertFieldMap = typeof alertFieldMap;
diff --git a/x-pack/plugins/alerting/common/alert_schema/field_maps/component_template_from_field_map.ts b/x-pack/plugins/alerting/common/alert_schema/field_maps/component_template_from_field_map.ts
new file mode 100644
index 00000000000000..b4cd25a4f41260
--- /dev/null
+++ b/x-pack/plugins/alerting/common/alert_schema/field_maps/component_template_from_field_map.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ClusterPutComponentTemplateRequest } from '@elastic/elasticsearch/lib/api/types';
+import { mappingFromFieldMap } from './mapping_from_field_map';
+import { FieldMap } from './types';
+
+export interface GetComponentTemplateFromFieldMapOpts {
+  name: string;
+  fieldLimit?: number;
+  fieldMap: FieldMap;
+}
+export const getComponentTemplateFromFieldMap = ({
+  name,
+  fieldMap,
+  fieldLimit,
+}: GetComponentTemplateFromFieldMapOpts): ClusterPutComponentTemplateRequest => {
+  return {
+    name,
+    _meta: {
+      managed: true,
+    },
+    template: {
+      settings: {
+        number_of_shards: 1,
+        'index.mapping.total_fields.limit': fieldLimit ?? 1000,
+      },
+      mappings: mappingFromFieldMap(fieldMap, 'strict'),
+    },
+  };
+};
diff --git a/x-pack/plugins/alerting/common/alert_schema/field_maps/mapping_from_field_map.test.ts b/x-pack/plugins/alerting/common/alert_schema/field_maps/mapping_from_field_map.test.ts
new file mode 100644
index 00000000000000..2f2cac2367e8bd
--- /dev/null
+++ b/x-pack/plugins/alerting/common/alert_schema/field_maps/mapping_from_field_map.test.ts
@@ -0,0 +1,282 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { mappingFromFieldMap } from './mapping_from_field_map';
+import { FieldMap } from './types';
+import { alertFieldMap } from './alert_field_map';
+
+describe('mappingFromFieldMap', () => {
+  const fieldMap: FieldMap = {
+    date_field: {
+      type: 'date',
+      array: false,
+      required: true,
+    },
+    keyword_field: {
+      type: 'keyword',
+      array: false,
+      required: false,
+      ignore_above: 1024,
+    },
+    long_field: {
+      type: 'long',
+      array: false,
+      required: false,
+    },
+    multifield_field: {
+      type: 'keyword',
+      array: false,
+      required: false,
+      ignore_above: 1024,
+      multi_fields: [
+        {
+          flat_name: 'multifield_field.text',
+          name: 'text',
+          type: 'match_only_text',
+        },
+      ],
+    },
+    geopoint_field: {
+      type: 'geo_point',
+      array: false,
+      required: false,
+    },
+    ip_field: {
+      type: 'ip',
+      array: false,
+      required: false,
+    },
+    array_field: {
+      type: 'keyword',
+      array: true,
+      required: false,
+      ignore_above: 1024,
+    },
+    nested_array_field: {
+      type: 'nested',
+      array: false,
+      required: false,
+    },
+    'nested_array_field.field1': {
+      type: 'keyword',
+      array: false,
+      required: false,
+      ignore_above: 1024,
+    },
+    'nested_array_field.field2': {
+      type: 'keyword',
+      array: false,
+      required: false,
+      ignore_above: 1024,
+    },
+    scaled_float_field: {
+      type: 'scaled_float',
+      array: false,
+      required: false,
+      scaling_factor: 1000,
+    },
+    constant_keyword_field: {
+      type: 'constant_keyword',
+      array: false,
+      required: false,
+    },
+    'parent_field.child1': {
+      type: 'keyword',
+      array: false,
+      required: false,
+      ignore_above: 1024,
+    },
+    'parent_field.child2': {
+      type: 'keyword',
+      array: false,
+      required: false,
+      ignore_above: 1024,
+    },
+    unmapped_object: {
+      type: 'object',
+      required: false,
+      enabled: false,
+    },
+    formatted_field: {
+      type: 'date_range',
+      required: false,
+      format: 'epoch_millis||strict_date_optional_time',
+    },
+  };
+  const expectedMapping = {
+    properties: {
+      array_field: {
+        ignore_above: 1024,
+        type: 'keyword',
+      },
+      constant_keyword_field: {
+        type: 'constant_keyword',
+      },
+      date_field: {
+        type: 'date',
+      },
+      geopoint_field: {
+        type: 'geo_point',
+      },
+      ip_field: {
+        type: 'ip',
+      },
+      keyword_field: {
+        ignore_above: 1024,
+        type: 'keyword',
+      },
+      long_field: {
+        type: 'long',
+      },
+      multifield_field: {
+        fields: {
+          text: {
+            type: 'match_only_text',
+          },
+        },
+        ignore_above: 1024,
+        type: 'keyword',
+      },
+      nested_array_field: {
+        properties: {
+          field1: {
+            ignore_above: 1024,
+            type: 'keyword',
+          },
+          field2: {
+            ignore_above: 1024,
+            type: 'keyword',
+          },
+        },
+        type: 'nested',
+      },
+      parent_field: {
+        properties: {
+          child1: {
+            ignore_above: 1024,
+            type: 'keyword',
+          },
+          child2: {
+            ignore_above: 1024,
+            type: 'keyword',
+          },
+        },
+      },
+      scaled_float_field: {
+        scaling_factor: 1000,
+        type: 'scaled_float',
+      },
+      unmapped_object: {
+        enabled: false,
+        type: 'object',
+      },
+      formatted_field: {
+        type: 'date_range',
+        format: 'epoch_millis||strict_date_optional_time',
+      },
+    },
+  };
+  it('correctly creates mapping from field map', () => {
+    expect(mappingFromFieldMap(fieldMap)).toEqual({ dynamic: 'strict', ...expectedMapping });
+    expect(mappingFromFieldMap(alertFieldMap)).toEqual({
+      dynamic: 'strict',
+      properties: {
+        kibana: {
+          properties: {
+            alert: {
+              properties: {
+                action_group: {
+                  type: 'keyword',
+                },
+                duration: {
+                  properties: {
+                    us: {
+                      type: 'long',
+                    },
+                  },
+                },
+                end: {
+                  type: 'date',
+                },
+                flapping: {
+                  type: 'boolean',
+                },
+                id: {
+                  type: 'keyword',
+                },
+                reason: {
+                  type: 'keyword',
+                },
+                rule: {
+                  properties: {
+                    category: {
+                      type: 'keyword',
+                    },
+                    consumer: {
+                      type: 'keyword',
+                    },
+                    execution: {
+                      properties: {
+                        uuid: {
+                          type: 'keyword',
+                        },
+                      },
+                    },
+                    name: {
+                      type: 'keyword',
+                    },
+                    parameters: {
+                      type: 'object',
+                      enabled: false,
+                    },
+                    producer: {
+                      type: 'keyword',
+                    },
+                    rule_type_id: {
+                      type: 'keyword',
+                    },
+                    tags: {
+                      type: 'keyword',
+                    },
+                    uuid: {
+                      type: 'keyword',
+                    },
+                  },
+                },
+                start: {
+                  type: 'date',
+                },
+                status: {
+                  type: 'keyword',
+                },
+                time_range: {
+                  type: 'date_range',
+                  format: 'epoch_millis||strict_date_optional_time',
+                },
+                uuid: {
+                  type: 'keyword',
+                },
+                workflow_status: {
+                  type: 'keyword',
+                },
+              },
+            },
+            space_ids: {
+              type: 'keyword',
+            },
+            version: {
+              type: 'version',
+            },
+          },
+        },
+      },
+    });
+  });
+
+  it('uses dynamic setting if specified', () => {
+    expect(mappingFromFieldMap(fieldMap, true)).toEqual({ dynamic: true, ...expectedMapping });
+  });
+});
diff --git a/x-pack/plugins/alerting/common/alert_schema/field_maps/mapping_from_field_map.ts b/x-pack/plugins/alerting/common/alert_schema/field_maps/mapping_from_field_map.ts
new file mode 100644
index 00000000000000..5a1de7a995b366
--- /dev/null
+++ b/x-pack/plugins/alerting/common/alert_schema/field_maps/mapping_from_field_map.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { MappingTypeMapping } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import { set } from '@kbn/safer-lodash-set';
+import { FieldMap, MultiField } from './types';
+
+export function mappingFromFieldMap(
+  fieldMap: FieldMap,
+  dynamic: 'strict' | boolean = 'strict'
+): MappingTypeMapping {
+  const mappings = {
+    dynamic,
+    properties: {},
+  };
+
+  const fields = Object.keys(fieldMap).map((key: string) => {
+    const field = fieldMap[key];
+    return {
+      name: key,
+      ...field,
+    };
+  });
+
+  fields.forEach((field) => {
+    // eslint-disable-next-line @typescript-eslint/naming-convention
+    const { name, required, array, multi_fields, ...rest } = field;
+
+    const mapped = multi_fields
+      ? {
+          ...rest,
+          // eslint-disable-next-line @typescript-eslint/naming-convention
+          fields: multi_fields.reduce((acc, multi_field: MultiField) => {
+            return {
+              ...acc,
+              [multi_field.name]: {
+                type: multi_field.type,
+              },
+            };
+          }, {}),
+        }
+      : rest;
+
+    set(mappings.properties, field.name.split('.').join('.properties.'), mapped);
+  });
+
+  return mappings;
+}
diff --git a/x-pack/plugins/alerting/common/alert_schema/field_maps/types.ts b/x-pack/plugins/alerting/common/alert_schema/field_maps/types.ts
new file mode 100644
index 00000000000000..b687cbfb0cf7de
--- /dev/null
+++ b/x-pack/plugins/alerting/common/alert_schema/field_maps/types.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export interface MultiField {
+  flat_name?: string;
+  name: string;
+  type: string;
+}
+
+export interface FieldMap {
+  [key: string]: {
+    type: string;
+    required: boolean;
+    array?: boolean;
+    doc_values?: boolean;
+    enabled?: boolean;
+    format?: string;
+    ignore_above?: number;
+    index?: boolean;
+    multi_fields?: MultiField[];
+    path?: string;
+    scaling_factor?: number;
+    dynamic?: boolean | string;
+  };
+}
diff --git a/x-pack/plugins/alerting/common/alert_schema/index.ts b/x-pack/plugins/alerting/common/alert_schema/index.ts
new file mode 100644
index 00000000000000..acca43450fe347
--- /dev/null
+++ b/x-pack/plugins/alerting/common/alert_schema/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export { alertFieldMap } from './field_maps/alert_field_map';
+export { getComponentTemplateFromFieldMap } from './field_maps/component_template_from_field_map';
diff --git a/x-pack/plugins/alerting/server/alerts_service/alerts_service.mock.ts b/x-pack/plugins/alerting/server/alerts_service/alerts_service.mock.ts
new file mode 100644
index 00000000000000..d11e95f909c199
--- /dev/null
+++ b/x-pack/plugins/alerting/server/alerts_service/alerts_service.mock.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+const creatAlertsServiceMock = () => {
+  return jest.fn().mockImplementation(() => {
+    return {
+      initialize: jest.fn(),
+      register: jest.fn(),
+      isInitialized: jest.fn(),
+      isContextInitialized: jest.fn(),
+    };
+  });
+};
+
+export const alertsServiceMock = {
+  create: creatAlertsServiceMock(),
+};
diff --git a/x-pack/plugins/alerting/server/alerts_service/alerts_service.test.ts b/x-pack/plugins/alerting/server/alerts_service/alerts_service.test.ts
new file mode 100644
index 00000000000000..ba3623526591f7
--- /dev/null
+++ b/x-pack/plugins/alerting/server/alerts_service/alerts_service.test.ts
@@ -0,0 +1,944 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { elasticsearchServiceMock, loggingSystemMock } from '@kbn/core/server/mocks';
+import { errors as EsErrors } from '@elastic/elasticsearch';
+import { ReplaySubject, Subject } from 'rxjs';
+import { AlertsService } from './alerts_service';
+
+let logger: ReturnType<typeof loggingSystemMock['createLogger']>;
+const clusterClient = elasticsearchServiceMock.createClusterClient().asInternalUser;
+
+const SimulateTemplateResponse = {
+  template: {
+    aliases: {
+      alias_name_1: {
+        is_hidden: true,
+      },
+      alias_name_2: {
+        is_hidden: true,
+      },
+    },
+    mappings: { enabled: false },
+    settings: {},
+  },
+};
+interface HTTPError extends Error {
+  statusCode: number;
+}
+
+interface EsError extends Error {
+  meta: {
+    body: {
+      error: {
+        type: string;
+      };
+    };
+  };
+}
+
+const GetAliasResponse = {
+  real_index: {
+    aliases: {
+      alias_1: {
+        is_hidden: true,
+      },
+      alias_2: {
+        is_hidden: true,
+      },
+    },
+  },
+};
+
+const IlmPutBody = {
+  body: {
+    policy: {
+      _meta: {
+        managed: true,
+      },
+      phases: {
+        hot: {
+          actions: {
+            rollover: {
+              max_age: '30d',
+              max_primary_shard_size: '50gb',
+            },
+          },
+        },
+      },
+    },
+  },
+  name: 'alerts-default-ilm-policy',
+};
+
+const getIndexTemplatePutBody = (context?: string) => ({
+  name: `.alerts-${context ? context : 'test'}-default-template`,
+  body: {
+    index_patterns: [`.alerts-${context ? context : 'test'}-default-*`],
+    composed_of: [
+      'alerts-common-component-template',
+      `alerts-${context ? context : 'test'}-component-template`,
+    ],
+    template: {
+      settings: {
+        auto_expand_replicas: '0-1',
+        hidden: true,
+        'index.lifecycle': {
+          name: 'alerts-default-ilm-policy',
+          rollover_alias: `.alerts-${context ? context : 'test'}-default`,
+        },
+        'index.mapping.total_fields.limit': 2500,
+      },
+      mappings: {
+        dynamic: false,
+      },
+    },
+    _meta: {
+      managed: true,
+    },
+  },
+});
+
+const TestRegistrationContext = {
+  context: 'test',
+  fieldMap: { field: { type: 'keyword', required: false } },
+};
+
+const AnotherRegistrationContext = {
+  context: 'another',
+  fieldMap: { field: { type: 'keyword', required: false } },
+};
+
+describe('Alerts Service', () => {
+  let pluginStop$: Subject<void>;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    logger = loggingSystemMock.createLogger();
+    pluginStop$ = new ReplaySubject(1);
+    jest.spyOn(global.Math, 'random').mockReturnValue(0.01);
+    clusterClient.indices.simulateTemplate.mockImplementation(async () => SimulateTemplateResponse);
+    clusterClient.indices.simulateIndexTemplate.mockImplementation(
+      async () => SimulateTemplateResponse
+    );
+    clusterClient.indices.getAlias.mockImplementation(async () => GetAliasResponse);
+  });
+
+  afterEach(() => {
+    pluginStop$.next();
+    pluginStop$.complete();
+  });
+  describe('initialize()', () => {
+    test('should correctly initialize common resources', async () => {
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 50));
+
+      expect(alertsService.isInitialized()).toEqual(true);
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalledWith(IlmPutBody);
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(1);
+
+      const componentTemplate1 = clusterClient.cluster.putComponentTemplate.mock.calls[0][0];
+      expect(componentTemplate1.name).toEqual('alerts-common-component-template');
+    });
+
+    test('should log error and set initialized to false if adding ILM policy throws error', async () => {
+      clusterClient.ilm.putLifecycle.mockRejectedValueOnce(new Error('fail'));
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 50));
+
+      expect(alertsService.isInitialized()).toEqual(false);
+
+      expect(logger.error).toHaveBeenCalledWith(
+        `Error installing ILM policy alerts-default-ilm-policy - fail`
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).not.toHaveBeenCalled();
+    });
+
+    test('should log error and set initialized to false if creating/updating common component template throws error', async () => {
+      clusterClient.cluster.putComponentTemplate.mockRejectedValueOnce(new Error('fail'));
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 50));
+
+      expect(alertsService.isInitialized()).toEqual(false);
+      expect(logger.error).toHaveBeenCalledWith(
+        `Error installing component template alerts-common-component-template - fail`
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(1);
+    });
+
+    test('should install resources for contexts awaiting initialization when common resources are initialized', async () => {
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      // pre-register contexts so they get installed right after initialization
+      alertsService.register(TestRegistrationContext);
+      alertsService.register(AnotherRegistrationContext);
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 50));
+
+      expect(alertsService.isInitialized()).toEqual(true);
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+      expect(await alertsService.isContextInitialized(AnotherRegistrationContext.context)).toEqual(
+        true
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalledWith(IlmPutBody);
+      // 1x for common component template, 2x for context specific
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(3);
+
+      const componentTemplate1 = clusterClient.cluster.putComponentTemplate.mock.calls[0][0];
+      expect(componentTemplate1.name).toEqual('alerts-common-component-template');
+      const componentTemplate2 = clusterClient.cluster.putComponentTemplate.mock.calls[1][0];
+      expect(componentTemplate2.name).toEqual('alerts-another-component-template');
+      const componentTemplate3 = clusterClient.cluster.putComponentTemplate.mock.calls[2][0];
+      expect(componentTemplate3.name).toEqual('alerts-test-component-template');
+
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenNthCalledWith(
+        1,
+        getIndexTemplatePutBody('another')
+      );
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenNthCalledWith(
+        2,
+        getIndexTemplatePutBody()
+      );
+
+      expect(clusterClient.indices.getAlias).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.getAlias).toHaveBeenNthCalledWith(1, {
+        index: '.alerts-another-default-*',
+      });
+      expect(clusterClient.indices.getAlias).toHaveBeenNthCalledWith(2, {
+        index: '.alerts-test-default-*',
+      });
+      expect(clusterClient.indices.putSettings).toHaveBeenCalledTimes(4);
+      expect(clusterClient.indices.simulateIndexTemplate).toHaveBeenCalledTimes(4);
+      expect(clusterClient.indices.putMapping).toHaveBeenCalledTimes(4);
+      expect(clusterClient.indices.create).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.create).toHaveBeenNthCalledWith(1, {
+        index: '.alerts-another-default-000001',
+        body: {
+          aliases: {
+            '.alerts-another-default': {
+              is_write_index: true,
+            },
+          },
+        },
+      });
+      expect(clusterClient.indices.create).toHaveBeenNthCalledWith(2, {
+        index: '.alerts-test-default-000001',
+        body: {
+          aliases: {
+            '.alerts-test-default': {
+              is_write_index: true,
+            },
+          },
+        },
+      });
+    });
+  });
+
+  describe('register()', () => {
+    let alertsService: AlertsService;
+    beforeEach(async () => {
+      alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 50));
+      expect(alertsService.isInitialized()).toEqual(true);
+    });
+
+    test('should correctly install resources for context when common initialization is complete', async () => {
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalledWith(IlmPutBody);
+
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      const componentTemplate1 = clusterClient.cluster.putComponentTemplate.mock.calls[0][0];
+      expect(componentTemplate1.name).toEqual('alerts-common-component-template');
+      const componentTemplate2 = clusterClient.cluster.putComponentTemplate.mock.calls[1][0];
+      expect(componentTemplate2.name).toEqual('alerts-test-component-template');
+
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalledWith(
+        getIndexTemplatePutBody()
+      );
+      expect(clusterClient.indices.getAlias).toHaveBeenCalledWith({
+        index: '.alerts-test-default-*',
+      });
+      expect(clusterClient.indices.putSettings).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateIndexTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.putMapping).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.create).toHaveBeenCalledWith({
+        index: '.alerts-test-default-000001',
+        body: {
+          aliases: {
+            '.alerts-test-default': {
+              is_write_index: true,
+            },
+          },
+        },
+      });
+    });
+
+    test('should not install component template for context fieldMap is empty', async () => {
+      alertsService.register({
+        context: 'empty',
+        fieldMap: {},
+      });
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized('empty')).toEqual(true);
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalledWith(IlmPutBody);
+
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(1);
+      const componentTemplate1 = clusterClient.cluster.putComponentTemplate.mock.calls[0][0];
+      expect(componentTemplate1.name).toEqual('alerts-common-component-template');
+
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalledWith({
+        name: `.alerts-empty-default-template`,
+        body: {
+          index_patterns: [`.alerts-empty-default-*`],
+          composed_of: ['alerts-common-component-template'],
+          template: {
+            settings: {
+              auto_expand_replicas: '0-1',
+              hidden: true,
+              'index.lifecycle': {
+                name: 'alerts-default-ilm-policy',
+                rollover_alias: `.alerts-empty-default`,
+              },
+              'index.mapping.total_fields.limit': 2500,
+            },
+            mappings: {
+              dynamic: false,
+            },
+          },
+          _meta: {
+            managed: true,
+          },
+        },
+      });
+      expect(clusterClient.indices.getAlias).toHaveBeenCalledWith({
+        index: '.alerts-empty-default-*',
+      });
+      expect(clusterClient.indices.putSettings).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateIndexTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.putMapping).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.create).toHaveBeenCalledWith({
+        index: '.alerts-empty-default-000001',
+        body: {
+          aliases: {
+            '.alerts-empty-default': {
+              is_write_index: true,
+            },
+          },
+        },
+      });
+    });
+
+    test('should skip initialization if context already exists', async () => {
+      alertsService.register(TestRegistrationContext);
+      alertsService.register(TestRegistrationContext);
+
+      expect(logger.debug).toHaveBeenCalledWith(
+        `Resources for context "test" have already been registered.`
+      );
+    });
+
+    test('should throw error if context already exists and has been registered with a different field map', async () => {
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(() => {
+        alertsService.register({
+          ...TestRegistrationContext,
+          fieldMap: { anotherField: { type: 'keyword', required: false } },
+        });
+      }).toThrowErrorMatchingInlineSnapshot(
+        `"test has already been registered with a different mapping"`
+      );
+    });
+
+    test('should not update index template if simulating template throws error', async () => {
+      clusterClient.indices.simulateTemplate.mockRejectedValueOnce(new Error('fail'));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+
+      expect(logger.error).toHaveBeenCalledWith(
+        `Failed to simulate index template mappings for .alerts-test-default-template; not applying mappings - fail`
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      // putIndexTemplate is skipped but other operations are called as expected
+      expect(clusterClient.indices.putIndexTemplate).not.toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).toHaveBeenCalled();
+      expect(clusterClient.indices.create).toHaveBeenCalled();
+    });
+
+    test('should log error and set initialized to false if simulating template returns empty mappings', async () => {
+      clusterClient.indices.simulateTemplate.mockImplementationOnce(async () => ({
+        ...SimulateTemplateResponse,
+        template: {
+          ...SimulateTemplateResponse.template,
+          mappings: {},
+        },
+      }));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        false
+      );
+
+      expect(logger.error).toHaveBeenCalledWith(
+        new Error(
+          `No mappings would be generated for .alerts-test-default-template, possibly due to failed/misconfigured bootstrapping`
+        )
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).not.toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).not.toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).not.toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).not.toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).not.toHaveBeenCalled();
+      expect(clusterClient.indices.create).not.toHaveBeenCalled();
+    });
+
+    test('should log error and set initialized to false if updating index template throws error', async () => {
+      clusterClient.indices.putIndexTemplate.mockRejectedValueOnce(new Error('fail'));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        false
+      );
+
+      expect(logger.error).toHaveBeenCalledWith(
+        `Error installing index template .alerts-test-default-template - fail`
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).not.toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).not.toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).not.toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).not.toHaveBeenCalled();
+      expect(clusterClient.indices.create).not.toHaveBeenCalled();
+    });
+
+    test('should log error and set initialized to false if checking for concrete write index throws error', async () => {
+      clusterClient.indices.getAlias.mockRejectedValueOnce(new Error('fail'));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        false
+      );
+
+      expect(logger.error).toHaveBeenCalledWith(
+        `Error fetching concrete indices for .alerts-test-default-* pattern - fail`
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).not.toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).not.toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).not.toHaveBeenCalled();
+      expect(clusterClient.indices.create).not.toHaveBeenCalled();
+    });
+
+    test('should not throw error if checking for concrete write index throws 404', async () => {
+      const error = new Error(`index doesn't exist`) as HTTPError;
+      error.statusCode = 404;
+      clusterClient.indices.getAlias.mockRejectedValueOnce(error);
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).not.toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).not.toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).not.toHaveBeenCalled();
+      expect(clusterClient.indices.create).toHaveBeenCalled();
+    });
+
+    test('should log error and set initialized to false if updating index settings for existing indices throws error', async () => {
+      clusterClient.indices.putSettings.mockRejectedValueOnce(new Error('fail'));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        false
+      );
+
+      expect(logger.error).toHaveBeenCalledWith(
+        `Failed to PUT index.mapping.total_fields.limit settings for alias alias_1: fail`
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).not.toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).not.toHaveBeenCalled();
+      expect(clusterClient.indices.create).not.toHaveBeenCalled();
+    });
+
+    test('should skip updating index mapping for existing indices if simulate index template throws error', async () => {
+      clusterClient.indices.simulateIndexTemplate.mockRejectedValueOnce(new Error('fail'));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+
+      expect(logger.error).toHaveBeenCalledWith(
+        `Ignored PUT mappings for alias alias_1; error generating simulated mappings: fail`
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).toHaveBeenCalled();
+      expect(clusterClient.indices.create).toHaveBeenCalled();
+    });
+
+    test('should log error and set initialized to false if updating index mappings for existing indices throws error', async () => {
+      clusterClient.indices.putMapping.mockRejectedValueOnce(new Error('fail'));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        false
+      );
+
+      expect(logger.error).toHaveBeenCalledWith(`Failed to PUT mapping for alias alias_1: fail`);
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).toHaveBeenCalled();
+      expect(clusterClient.indices.create).not.toHaveBeenCalled();
+    });
+
+    test('does not updating settings or mappings if no existing concrete indices', async () => {
+      clusterClient.indices.getAlias.mockImplementationOnce(async () => ({}));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).not.toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).not.toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).not.toHaveBeenCalled();
+      expect(clusterClient.indices.create).toHaveBeenCalled();
+    });
+
+    test('should log error and set initialized to false if concrete indices exist but none are write index', async () => {
+      clusterClient.indices.getAlias.mockImplementationOnce(async () => ({
+        '.alerts-test-default-0001': {
+          aliases: {
+            '.alerts-test-default': {
+              is_write_index: false,
+              is_hidden: true,
+            },
+            alias_2: {
+              is_write_index: false,
+              is_hidden: true,
+            },
+          },
+        },
+      }));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        false
+      );
+
+      expect(logger.error).toHaveBeenCalledWith(
+        new Error(
+          `Indices matching pattern .alerts-test-default-* exist but none are set as the write index for alias .alerts-test-default`
+        )
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).toHaveBeenCalled();
+      expect(clusterClient.indices.create).not.toHaveBeenCalled();
+    });
+
+    test('does not create new index if concrete write index exists', async () => {
+      clusterClient.indices.getAlias.mockImplementationOnce(async () => ({
+        '.alerts-test-default-0001': {
+          aliases: {
+            '.alerts-test-default': {
+              is_write_index: true,
+              is_hidden: true,
+            },
+            alias_2: {
+              is_write_index: false,
+              is_hidden: true,
+            },
+          },
+        },
+      }));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).toHaveBeenCalled();
+      expect(clusterClient.indices.create).not.toHaveBeenCalled();
+    });
+
+    test('should log error and set initialized to false if create concrete index throws error', async () => {
+      clusterClient.indices.create.mockRejectedValueOnce(new Error('fail'));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        false
+      );
+
+      expect(logger.error).toHaveBeenCalledWith(`Error creating concrete write index - fail`);
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).toHaveBeenCalled();
+      expect(clusterClient.indices.create).toHaveBeenCalled();
+    });
+
+    test('should not throw error if create concrete index throws resource_already_exists_exception error and write index already exists', async () => {
+      const error = new Error(`fail`) as EsError;
+      error.meta = {
+        body: {
+          error: {
+            type: 'resource_already_exists_exception',
+          },
+        },
+      };
+      clusterClient.indices.create.mockRejectedValueOnce(error);
+      clusterClient.indices.get.mockImplementationOnce(async () => ({
+        '.alerts-test-default-000001': {
+          aliases: { '.alerts-test-default': { is_write_index: true } },
+        },
+      }));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+
+      expect(logger.error).toHaveBeenCalledWith(`Error creating concrete write index - fail`);
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).toHaveBeenCalled();
+      expect(clusterClient.indices.get).toHaveBeenCalled();
+      expect(clusterClient.indices.create).toHaveBeenCalled();
+    });
+
+    test('should log error and set initialized to false if create concrete index throws resource_already_exists_exception error and write index does not already exists', async () => {
+      const error = new Error(`fail`) as EsError;
+      error.meta = {
+        body: {
+          error: {
+            type: 'resource_already_exists_exception',
+          },
+        },
+      };
+      clusterClient.indices.create.mockRejectedValueOnce(error);
+      clusterClient.indices.get.mockImplementationOnce(async () => ({
+        '.alerts-test-default-000001': {
+          aliases: { '.alerts-test-default': { is_write_index: false } },
+        },
+      }));
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 50));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        false
+      );
+
+      expect(logger.error).toHaveBeenCalledWith(`Error creating concrete write index - fail`);
+
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalled();
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(2);
+      expect(clusterClient.indices.simulateTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.getAlias).toHaveBeenCalled();
+      expect(clusterClient.indices.putSettings).toHaveBeenCalled();
+      expect(clusterClient.indices.simulateIndexTemplate).toHaveBeenCalled();
+      expect(clusterClient.indices.putMapping).toHaveBeenCalled();
+      expect(clusterClient.indices.get).toHaveBeenCalled();
+      expect(clusterClient.indices.create).toHaveBeenCalled();
+    });
+  });
+
+  describe('retries', () => {
+    test('should retry adding ILM policy for transient ES errors', async () => {
+      clusterClient.ilm.putLifecycle
+        .mockRejectedValueOnce(new EsErrors.ConnectionError('foo'))
+        .mockRejectedValueOnce(new EsErrors.TimeoutError('timeout'))
+        .mockResolvedValue({ acknowledged: true });
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 150));
+      expect(alertsService.isInitialized()).toEqual(true);
+      expect(clusterClient.ilm.putLifecycle).toHaveBeenCalledTimes(3);
+    });
+
+    test('should retry adding component template for transient ES errors', async () => {
+      clusterClient.cluster.putComponentTemplate
+        .mockRejectedValueOnce(new EsErrors.ConnectionError('foo'))
+        .mockRejectedValueOnce(new EsErrors.TimeoutError('timeout'))
+        .mockResolvedValue({ acknowledged: true });
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 150));
+      expect(alertsService.isInitialized()).toEqual(true);
+      expect(clusterClient.cluster.putComponentTemplate).toHaveBeenCalledTimes(3);
+    });
+
+    test('should retry updating index template for transient ES errors', async () => {
+      clusterClient.indices.putIndexTemplate
+        .mockRejectedValueOnce(new EsErrors.ConnectionError('foo'))
+        .mockRejectedValueOnce(new EsErrors.TimeoutError('timeout'))
+        .mockResolvedValue({ acknowledged: true });
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 150));
+      expect(alertsService.isInitialized()).toEqual(true);
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 150));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+      expect(clusterClient.indices.putIndexTemplate).toHaveBeenCalledTimes(3);
+    });
+
+    test('should retry updating index settings for existing indices for transient ES errors', async () => {
+      clusterClient.indices.putSettings
+        .mockRejectedValueOnce(new EsErrors.ConnectionError('foo'))
+        .mockRejectedValueOnce(new EsErrors.TimeoutError('timeout'))
+        .mockResolvedValue({ acknowledged: true });
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 150));
+      expect(alertsService.isInitialized()).toEqual(true);
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 150));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+      expect(clusterClient.indices.putSettings).toHaveBeenCalledTimes(4);
+    });
+
+    test('should retry updating index mappings for existing indices for transient ES errors', async () => {
+      clusterClient.indices.putMapping
+        .mockRejectedValueOnce(new EsErrors.ConnectionError('foo'))
+        .mockRejectedValueOnce(new EsErrors.TimeoutError('timeout'))
+        .mockResolvedValue({ acknowledged: true });
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 150));
+      expect(alertsService.isInitialized()).toEqual(true);
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 150));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+      expect(clusterClient.indices.putMapping).toHaveBeenCalledTimes(4);
+    });
+
+    test('should retry creating concrete index for transient ES errors', async () => {
+      clusterClient.indices.create
+        .mockRejectedValueOnce(new EsErrors.ConnectionError('foo'))
+        .mockRejectedValueOnce(new EsErrors.TimeoutError('timeout'))
+        .mockResolvedValue({ index: 'index', shards_acknowledged: true, acknowledged: true });
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 150));
+      expect(alertsService.isInitialized()).toEqual(true);
+
+      alertsService.register(TestRegistrationContext);
+      await new Promise((r) => setTimeout(r, 150));
+      expect(await alertsService.isContextInitialized(TestRegistrationContext.context)).toEqual(
+        true
+      );
+      expect(clusterClient.indices.create).toHaveBeenCalledTimes(3);
+    });
+  });
+
+  describe('timeout', () => {
+    test('should short circuit initialization if timeout exceeded', async () => {
+      clusterClient.ilm.putLifecycle.mockImplementationOnce(async () => {
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        return { acknowledged: true };
+      });
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize(10);
+      await new Promise((r) => setTimeout(r, 150));
+      expect(alertsService.isInitialized()).toEqual(false);
+
+      expect(logger.error).toHaveBeenCalledWith(new Error(`Timeout: it took more than 10ms`));
+    });
+
+    test('should short circuit initialization if pluginStop$ signal received but not throw error', async () => {
+      pluginStop$.next();
+      const alertsService = new AlertsService({
+        logger,
+        elasticsearchClientPromise: Promise.resolve(clusterClient),
+        pluginStop$,
+      });
+
+      alertsService.initialize();
+      await new Promise((r) => setTimeout(r, 50));
+
+      expect(logger.error).toHaveBeenCalledWith(
+        new Error(`Server is stopping; must stop all async operations`)
+      );
+    });
+  });
+});
diff --git a/x-pack/plugins/alerting/server/alerts_service/alerts_service.ts b/x-pack/plugins/alerting/server/alerts_service/alerts_service.ts
new file mode 100644
index 00000000000000..0742be50c4fa40
--- /dev/null
+++ b/x-pack/plugins/alerting/server/alerts_service/alerts_service.ts
@@ -0,0 +1,512 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  ClusterPutComponentTemplateRequest,
+  IndicesSimulateIndexTemplateResponse,
+  MappingTypeMapping,
+} from '@elastic/elasticsearch/lib/api/types';
+import { get, isEmpty, isEqual } from 'lodash';
+import { Logger, ElasticsearchClient } from '@kbn/core/server';
+import { firstValueFrom, Observable } from 'rxjs';
+import { FieldMap } from '../../common/alert_schema/field_maps/types';
+import { alertFieldMap } from '../../common/alert_schema';
+import { ILM_POLICY_NAME, DEFAULT_ILM_POLICY } from './default_lifecycle_policy';
+import {
+  getComponentTemplate,
+  getComponentTemplateName,
+  getIndexTemplateAndPattern,
+  IIndexPatternString,
+} from './types';
+import { retryTransientEsErrors } from './retry_transient_es_errors';
+import { IRuleTypeAlerts } from '../types';
+import {
+  createResourceInstallationHelper,
+  ResourceInstallationHelper,
+} from './create_resource_installation_helper';
+
+const TOTAL_FIELDS_LIMIT = 2500;
+const INSTALLATION_TIMEOUT = 20 * 60 * 1000; // 20 minutes
+
+interface AlertsServiceParams {
+  logger: Logger;
+  pluginStop$: Observable<void>;
+  elasticsearchClientPromise: Promise<ElasticsearchClient>;
+}
+
+interface ConcreteIndexInfo {
+  index: string;
+  alias: string;
+  isWriteIndex: boolean;
+}
+interface IAlertsService {
+  /**
+   * Initializes the common ES resources needed for framework alerts as data
+   * - ILM policy - common policy shared by all AAD indices
+   * - Component template - common mappings for fields populated and used by the framework
+   *
+   * Once common resource initialization is complete, look for any solution-specific
+   * resources that have been registered and are awaiting initialization.
+   */
+  initialize(timeoutMs?: number): void;
+
+  /**
+   * Register solution specific resources. If common resource initialization is
+   * complete, go ahead and install those resources, otherwise add to queue to
+   * await initialization
+   *
+   * Solution specific resources include:
+   * - Component template - solution specific mappings for fields used only by solution rule types
+   * - Index templates - solution specific template that combines common and solution specific component templates
+   * - Concrete write index - solution specific write index
+   */
+  register(opts: IRuleTypeAlerts, timeoutMs?: number): void;
+
+  isInitialized(): boolean;
+}
+
+export class AlertsService implements IAlertsService {
+  private initialized: boolean;
+  private resourceInitializationHelper: ResourceInstallationHelper;
+  private registeredContexts: Map<string, FieldMap> = new Map();
+
+  constructor(private readonly options: AlertsServiceParams) {
+    this.initialized = false;
+    this.resourceInitializationHelper = createResourceInstallationHelper(
+      this.initializeContext.bind(this)
+    );
+  }
+
+  public isInitialized() {
+    return this.initialized;
+  }
+
+  public async isContextInitialized(context: string) {
+    return (await this.resourceInitializationHelper.getInitializedContexts().get(context)) ?? false;
+  }
+
+  public initialize(timeoutMs?: number) {
+    // Only initialize once
+    if (this.initialized) return;
+
+    this.options.logger.debug(`Initializing resources for AlertsService`);
+
+    // Use setImmediate to execute async fns as soon as possible
+    setImmediate(async () => {
+      try {
+        const esClient = await this.options.elasticsearchClientPromise;
+
+        // Common initialization installs ILM policy and shared component template
+        const initFns = [
+          () => this.createOrUpdateIlmPolicy(esClient),
+          () => this.createOrUpdateComponentTemplate(esClient, getComponentTemplate(alertFieldMap)),
+        ];
+
+        for (const fn of initFns) {
+          await this.installWithTimeout(async () => await fn(), timeoutMs);
+        }
+
+        this.initialized = true;
+      } catch (err) {
+        this.options.logger.error(
+          `Error installing common resources for AlertsService. No additional resources will be installed and rule execution may be impacted.`
+        );
+        this.initialized = false;
+      }
+
+      if (this.initialized) {
+        this.resourceInitializationHelper.setReadyToInitialize(timeoutMs);
+      }
+    });
+  }
+
+  public register({ context, fieldMap }: IRuleTypeAlerts, timeoutMs?: number) {
+    // check whether this context has been registered before
+    if (this.registeredContexts.has(context)) {
+      const registeredFieldMap = this.registeredContexts.get(context);
+      if (!isEqual(fieldMap, registeredFieldMap)) {
+        throw new Error(`${context} has already been registered with a different mapping`);
+      }
+      this.options.logger.debug(`Resources for context "${context}" have already been registered.`);
+      return;
+    }
+
+    this.options.logger.info(`Registering resources for context "${context}".`);
+    this.registeredContexts.set(context, fieldMap);
+    this.resourceInitializationHelper.add({ context, fieldMap }, timeoutMs);
+  }
+
+  private async initializeContext({ context, fieldMap }: IRuleTypeAlerts, timeoutMs?: number) {
+    const esClient = await this.options.elasticsearchClientPromise;
+
+    const indexTemplateAndPattern = getIndexTemplateAndPattern(context);
+
+    // Context specific initialization installs component template, index template and write index
+    // If fieldMap is empty, don't create context specific component template
+    const initFns = isEmpty(fieldMap)
+      ? [
+          async () =>
+            await this.createOrUpdateIndexTemplate(esClient, indexTemplateAndPattern, [
+              getComponentTemplateName(),
+            ]),
+          async () => await this.createConcreteWriteIndex(esClient, indexTemplateAndPattern),
+        ]
+      : [
+          async () =>
+            await this.createOrUpdateComponentTemplate(
+              esClient,
+              getComponentTemplate(fieldMap, context)
+            ),
+          async () =>
+            await this.createOrUpdateIndexTemplate(esClient, indexTemplateAndPattern, [
+              getComponentTemplateName(),
+              getComponentTemplateName(context),
+            ]),
+          async () => await this.createConcreteWriteIndex(esClient, indexTemplateAndPattern),
+        ];
+
+    for (const fn of initFns) {
+      await this.installWithTimeout(async () => await fn(), timeoutMs);
+    }
+  }
+
+  /**
+   * Creates ILM policy if it doesn't already exist, updates it if it does
+   */
+  private async createOrUpdateIlmPolicy(esClient: ElasticsearchClient) {
+    this.options.logger.info(`Installing ILM policy ${ILM_POLICY_NAME}`);
+
+    try {
+      await retryTransientEsErrors(
+        () =>
+          esClient.ilm.putLifecycle({
+            name: ILM_POLICY_NAME,
+            body: DEFAULT_ILM_POLICY,
+          }),
+        { logger: this.options.logger }
+      );
+    } catch (err) {
+      this.options.logger.error(`Error installing ILM policy ${ILM_POLICY_NAME} - ${err.message}`);
+      throw err;
+    }
+  }
+
+  private async createOrUpdateComponentTemplate(
+    esClient: ElasticsearchClient,
+    template: ClusterPutComponentTemplateRequest
+  ) {
+    this.options.logger.info(`Installing component template ${template.name}`);
+
+    try {
+      await retryTransientEsErrors(() => esClient.cluster.putComponentTemplate(template), {
+        logger: this.options.logger,
+      });
+    } catch (err) {
+      this.options.logger.error(
+        `Error installing component template ${template.name} - ${err.message}`
+      );
+      throw err;
+    }
+  }
+
+  /**
+   * Installs index template that uses installed component template
+   * Prior to installation, simulates the installation to check for possible
+   * conflicts. Simulate should return an empty mapping if a template
+   * conflicts with an already installed template.
+   */
+  private async createOrUpdateIndexTemplate(
+    esClient: ElasticsearchClient,
+    indexPatterns: IIndexPatternString,
+    componentTemplateNames: string[]
+  ) {
+    this.options.logger.info(`Installing index template ${indexPatterns.template}`);
+
+    const indexTemplate = {
+      name: indexPatterns.template,
+      body: {
+        index_patterns: [indexPatterns.pattern],
+        composed_of: componentTemplateNames,
+        template: {
+          settings: {
+            auto_expand_replicas: '0-1',
+            hidden: true,
+            'index.lifecycle': {
+              name: ILM_POLICY_NAME,
+              rollover_alias: indexPatterns.alias,
+            },
+            'index.mapping.total_fields.limit': TOTAL_FIELDS_LIMIT,
+          },
+          mappings: {
+            dynamic: false,
+          },
+        },
+        _meta: {
+          managed: true,
+        },
+        // do we need metadata? like kibana version? doesn't that get updated every version? or just the first version its installed
+      },
+    };
+
+    let mappings: MappingTypeMapping = {};
+    try {
+      // Simulate the index template to proactively identify any issues with the mapping
+      const simulateResponse = await esClient.indices.simulateTemplate(indexTemplate);
+      mappings = simulateResponse.template.mappings;
+    } catch (err) {
+      this.options.logger.error(
+        `Failed to simulate index template mappings for ${indexPatterns.template}; not applying mappings - ${err.message}`
+      );
+      return;
+    }
+
+    if (isEmpty(mappings)) {
+      throw new Error(
+        `No mappings would be generated for ${indexPatterns.template}, possibly due to failed/misconfigured bootstrapping`
+      );
+    }
+
+    try {
+      await retryTransientEsErrors(() => esClient.indices.putIndexTemplate(indexTemplate), {
+        logger: this.options.logger,
+      });
+    } catch (err) {
+      this.options.logger.error(
+        `Error installing index template ${indexPatterns.template} - ${err.message}`
+      );
+      throw err;
+    }
+  }
+
+  /**
+   * Updates the underlying mapping for any existing concrete indices
+   */
+  private async updateIndexMappings(
+    esClient: ElasticsearchClient,
+    concreteIndices: ConcreteIndexInfo[]
+  ) {
+    this.options.logger.debug(
+      `Updating underlying mappings for ${concreteIndices.length} indices.`
+    );
+
+    // Update total field limit setting of found indices
+    // Other index setting changes are not updated at this time
+    await Promise.all(
+      concreteIndices.map((index) => this.updateTotalFieldLimitSetting(esClient, index))
+    );
+
+    // Update mappings of the found indices.
+    await Promise.all(
+      concreteIndices.map((index) => this.updateUnderlyingMapping(esClient, index))
+    );
+  }
+
+  private async updateTotalFieldLimitSetting(
+    esClient: ElasticsearchClient,
+    { index, alias }: ConcreteIndexInfo
+  ) {
+    try {
+      await retryTransientEsErrors(
+        () =>
+          esClient.indices.putSettings({
+            index,
+            body: {
+              'index.mapping.total_fields.limit': TOTAL_FIELDS_LIMIT,
+            },
+          }),
+        {
+          logger: this.options.logger,
+        }
+      );
+      return;
+    } catch (err) {
+      this.options.logger.error(
+        `Failed to PUT index.mapping.total_fields.limit settings for alias ${alias}: ${err.message}`
+      );
+      throw err;
+    }
+  }
+
+  private async updateUnderlyingMapping(
+    esClient: ElasticsearchClient,
+    { index, alias }: ConcreteIndexInfo
+  ) {
+    let simulatedIndexMapping: IndicesSimulateIndexTemplateResponse;
+    try {
+      simulatedIndexMapping = await esClient.indices.simulateIndexTemplate({
+        name: index,
+      });
+    } catch (err) {
+      this.options.logger.error(
+        `Ignored PUT mappings for alias ${alias}; error generating simulated mappings: ${err.message}`
+      );
+      return;
+    }
+
+    const simulatedMapping = get(simulatedIndexMapping, ['template', 'mappings']);
+
+    if (simulatedMapping == null) {
+      this.options.logger.error(
+        `Ignored PUT mappings for alias ${alias}; simulated mappings were empty`
+      );
+      return;
+    }
+
+    try {
+      await retryTransientEsErrors(
+        () =>
+          esClient.indices.putMapping({
+            index,
+            body: simulatedMapping,
+          }),
+        {
+          logger: this.options.logger,
+        }
+      );
+
+      return;
+    } catch (err) {
+      this.options.logger.error(`Failed to PUT mapping for alias ${alias}: ${err.message}`);
+      throw err;
+    }
+  }
+
+  private async createConcreteWriteIndex(
+    esClient: ElasticsearchClient,
+    indexPatterns: IIndexPatternString
+  ) {
+    this.options.logger.info(`Creating concrete write index - ${indexPatterns.name}`);
+
+    // check if a concrete write index already exists
+    let concreteIndices: ConcreteIndexInfo[] = [];
+    try {
+      const response = await esClient.indices.getAlias({
+        index: indexPatterns.pattern,
+      });
+
+      concreteIndices = Object.entries(response).flatMap(([index, { aliases }]) =>
+        Object.entries(aliases).map(([aliasName, aliasProperties]) => ({
+          index,
+          alias: aliasName,
+          isWriteIndex: aliasProperties.is_write_index ?? false,
+        }))
+      );
+
+      this.options.logger.debug(
+        `Found ${concreteIndices.length} concrete indices for ${
+          indexPatterns.name
+        } - ${JSON.stringify(concreteIndices)}`
+      );
+    } catch (error) {
+      // 404 is expected if no concrete write indices have been created
+      if (error.statusCode !== 404) {
+        this.options.logger.error(
+          `Error fetching concrete indices for ${indexPatterns.pattern} pattern - ${error.message}`
+        );
+        throw error;
+      }
+    }
+
+    let concreteWriteIndicesExist = false;
+    // if a concrete write index already exists, update the underlying mapping
+    if (concreteIndices.length > 0) {
+      await this.updateIndexMappings(esClient, concreteIndices);
+
+      const concreteIndicesExist = concreteIndices.some(
+        (index) => index.alias === indexPatterns.alias
+      );
+      concreteWriteIndicesExist = concreteIndices.some(
+        (index) => index.alias === indexPatterns.alias && index.isWriteIndex
+      );
+
+      // If there are some concrete indices but none of them are the write index, we'll throw an error
+      // because one of the existing indices should have been the write target.
+      if (concreteIndicesExist && !concreteWriteIndicesExist) {
+        throw new Error(
+          `Indices matching pattern ${indexPatterns.pattern} exist but none are set as the write index for alias ${indexPatterns.alias}`
+        );
+      }
+    }
+
+    // check if a concrete write index already exists
+    if (!concreteWriteIndicesExist) {
+      try {
+        await retryTransientEsErrors(
+          () =>
+            esClient.indices.create({
+              index: indexPatterns.name,
+              body: {
+                aliases: {
+                  [indexPatterns.alias]: {
+                    is_write_index: true,
+                  },
+                },
+              },
+            }),
+          {
+            logger: this.options.logger,
+          }
+        );
+      } catch (error) {
+        this.options.logger.error(`Error creating concrete write index - ${error.message}`);
+        // If the index already exists and it's the write index for the alias,
+        // something else created it so suppress the error. If it's not the write
+        // index, that's bad, throw an error.
+        if (error?.meta?.body?.error?.type === 'resource_already_exists_exception') {
+          const existingIndices = await esClient.indices.get({
+            index: indexPatterns.name,
+          });
+          if (
+            !existingIndices[indexPatterns.name]?.aliases?.[indexPatterns.alias]?.is_write_index
+          ) {
+            throw Error(
+              `Attempted to create index: ${indexPatterns.name} as the write index for alias: ${indexPatterns.alias}, but the index already exists and is not the write index for the alias`
+            );
+          }
+        } else {
+          throw error;
+        }
+      }
+    }
+  }
+
+  private async installWithTimeout(
+    installFn: () => Promise<void>,
+    timeoutMs: number = INSTALLATION_TIMEOUT
+  ): Promise<void> {
+    try {
+      let timeoutId: NodeJS.Timeout;
+      const install = async (): Promise<void> => {
+        await installFn();
+        if (timeoutId) {
+          clearTimeout(timeoutId);
+        }
+      };
+
+      const throwTimeoutException = (): Promise<void> => {
+        return new Promise((_, reject) => {
+          timeoutId = setTimeout(() => {
+            const msg = `Timeout: it took more than ${timeoutMs}ms`;
+            reject(new Error(msg));
+          }, timeoutMs);
+
+          firstValueFrom(this.options.pluginStop$).then(() => {
+            clearTimeout(timeoutId);
+            reject(new Error('Server is stopping; must stop all async operations'));
+          });
+        });
+      };
+
+      await Promise.race([install(), throwTimeoutException()]);
+    } catch (e) {
+      this.options.logger.error(e);
+
+      const reason = e?.message || 'Unknown reason';
+      throw new Error(`Failure during installation. ${reason}`);
+    }
+  }
+}
diff --git a/x-pack/plugins/alerting/server/alerts_service/create_resource_installation_helper.test.ts b/x-pack/plugins/alerting/server/alerts_service/create_resource_installation_helper.test.ts
new file mode 100644
index 00000000000000..f9ce460d040931
--- /dev/null
+++ b/x-pack/plugins/alerting/server/alerts_service/create_resource_installation_helper.test.ts
@@ -0,0 +1,137 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { loggingSystemMock } from '@kbn/core/server/mocks';
+import { IRuleTypeAlerts } from '../types';
+import { createResourceInstallationHelper } from './create_resource_installation_helper';
+
+const logger: ReturnType<typeof loggingSystemMock['createLogger']> =
+  loggingSystemMock.createLogger();
+
+const initFn = async (context: IRuleTypeAlerts, timeoutMs?: number) => {
+  logger.info(context.context);
+};
+
+const initFnWithDelay = async (context: IRuleTypeAlerts, timeoutMs?: number) => {
+  logger.info(context.context);
+  await new Promise((r) => setTimeout(r, 50));
+};
+
+const initFnWithError = async (context: IRuleTypeAlerts, timeoutMs?: number) => {
+  throw new Error('fail');
+};
+
+describe('createResourceInstallationHelper', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test(`should not call init function if readyToInitialize is false`, () => {
+    const helper = createResourceInstallationHelper(initFn);
+
+    // Add two contexts that need to be initialized but don't call helper.setReadyToInitialize()
+    helper.add({ context: 'test1', fieldMap: { field: { type: 'keyword', required: false } } });
+    helper.add({ context: 'test2', fieldMap: { field: { type: 'keyword', required: false } } });
+
+    expect(logger.info).not.toHaveBeenCalled();
+    const initializedContexts = helper.getInitializedContexts();
+    expect([...initializedContexts.keys()].length).toEqual(0);
+  });
+
+  test(`should call init function if readyToInitialize is set to true`, async () => {
+    const helper = createResourceInstallationHelper(initFn);
+
+    // Add two contexts that need to be initialized and then call helper.setReadyToInitialize()
+    helper.add({ context: 'test1', fieldMap: { field: { type: 'keyword', required: false } } });
+    helper.add({ context: 'test2', fieldMap: { field: { type: 'keyword', required: false } } });
+
+    helper.setReadyToInitialize();
+
+    // for the setImmediate
+    await new Promise((r) => setTimeout(r, 10));
+
+    expect(logger.info).toHaveBeenCalledTimes(2);
+    const initializedContexts = helper.getInitializedContexts();
+    expect([...initializedContexts.keys()].length).toEqual(2);
+
+    expect(await initializedContexts.get('test1')).toEqual(true);
+    expect(await initializedContexts.get('test2')).toEqual(true);
+  });
+
+  test(`should install resources for contexts added after readyToInitialize is called`, async () => {
+    const helper = createResourceInstallationHelper(initFnWithDelay);
+
+    // Add two contexts that need to be initialized
+    helper.add({ context: 'test1', fieldMap: { field: { type: 'keyword', required: false } } });
+    helper.add({ context: 'test2', fieldMap: { field: { type: 'keyword', required: false } } });
+
+    // Start processing the queued contexts
+    helper.setReadyToInitialize();
+
+    // for the setImmediate
+    await new Promise((r) => setTimeout(r, 10));
+
+    // Add another context to process
+    helper.add({ context: 'test3', fieldMap: { field: { type: 'keyword', required: false } } });
+
+    // 3 contexts with delay will take 150
+    await new Promise((r) => setTimeout(r, 10));
+
+    expect(logger.info).toHaveBeenCalledTimes(3);
+    const initializedContexts = helper.getInitializedContexts();
+    expect([...initializedContexts.keys()].length).toEqual(3);
+
+    expect(await initializedContexts.get('test1')).toEqual(true);
+    expect(await initializedContexts.get('test2')).toEqual(true);
+    expect(await initializedContexts.get('test3')).toEqual(true);
+  });
+
+  test(`should install resources for contexts added after initial processing loop has run`, async () => {
+    const helper = createResourceInstallationHelper(initFn);
+
+    // No contexts queued so this should finish quickly
+    helper.setReadyToInitialize();
+
+    // for the setImmediate
+    await new Promise((r) => setTimeout(r, 10));
+
+    expect(logger.info).not.toHaveBeenCalled();
+    let initializedContexts = helper.getInitializedContexts();
+    expect([...initializedContexts.keys()].length).toEqual(0);
+
+    // Add a context to process
+    helper.add({ context: 'test1', fieldMap: { field: { type: 'keyword', required: false } } });
+
+    // for the setImmediate
+    await new Promise((r) => setTimeout(r, 10));
+
+    expect(logger.info).toHaveBeenCalledTimes(1);
+    initializedContexts = helper.getInitializedContexts();
+    expect([...initializedContexts.keys()].length).toEqual(1);
+
+    expect(await initializedContexts.get('test1')).toEqual(true);
+  });
+
+  test(`should gracefully handle errors during initialization and set initialized flag to false`, async () => {
+    const helper = createResourceInstallationHelper(initFnWithError);
+
+    helper.setReadyToInitialize();
+
+    // for the setImmediate
+    await new Promise((r) => setTimeout(r, 10));
+
+    // Add a context to process
+    helper.add({ context: 'test1', fieldMap: { field: { type: 'keyword', required: false } } });
+
+    // for the setImmediate
+    await new Promise((r) => setTimeout(r, 10));
+
+    const initializedContexts = helper.getInitializedContexts();
+    expect([...initializedContexts.keys()].length).toEqual(1);
+    expect(await initializedContexts.get('test1')).toEqual(false);
+  });
+});
diff --git a/x-pack/plugins/alerting/server/alerts_service/create_resource_installation_helper.ts b/x-pack/plugins/alerting/server/alerts_service/create_resource_installation_helper.ts
new file mode 100644
index 00000000000000..0e3cbe0f87a9a1
--- /dev/null
+++ b/x-pack/plugins/alerting/server/alerts_service/create_resource_installation_helper.ts
@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { IRuleTypeAlerts } from '../types';
+
+export interface ResourceInstallationHelper {
+  add: (context: IRuleTypeAlerts, timeoutMs?: number) => void;
+  setReadyToInitialize: (timeoutMs?: number) => void;
+  getInitializedContexts: () => Map<string, Promise<boolean>>;
+}
+
+/**
+ * Helper function that queues up resources to initialize until we are
+ * ready to begin initialization. Once we're ready, we start taking from
+ * the queue and kicking off initialization.
+ *
+ * If a resource is added after we begin initialization, we push it onto
+ * the queue and the running loop will handle it
+ *
+ * If a resource is added to the queue when the processing loop is not
+ * running, kick off the processing loop
+ */
+export function createResourceInstallationHelper(
+  initFn: (context: IRuleTypeAlerts, timeoutMs?: number) => Promise<void>
+): ResourceInstallationHelper {
+  let readyToInitialize = false;
+  let isInitializing: boolean = false;
+  const contextsToInitialize: IRuleTypeAlerts[] = [];
+  const initializedContexts: Map<string, Promise<boolean>> = new Map();
+
+  const waitUntilContextResourcesInstalled = async (
+    context: IRuleTypeAlerts,
+    timeoutMs?: number
+  ): Promise<boolean> => {
+    try {
+      await initFn(context, timeoutMs);
+      return true;
+    } catch (err) {
+      return false;
+    }
+  };
+
+  const startInitialization = (timeoutMs?: number) => {
+    if (!readyToInitialize) {
+      return;
+    }
+
+    setImmediate(async () => {
+      isInitializing = true;
+      while (contextsToInitialize.length > 0) {
+        const context = contextsToInitialize.pop()!;
+        initializedContexts.set(
+          context.context,
+
+          // Return a promise than can be checked when needed
+          waitUntilContextResourcesInstalled(context, timeoutMs)
+        );
+      }
+      isInitializing = false;
+    });
+  };
+  return {
+    add: (context: IRuleTypeAlerts, timeoutMs?: number) => {
+      contextsToInitialize.push(context);
+      if (!isInitializing) {
+        startInitialization(timeoutMs);
+      }
+    },
+    setReadyToInitialize: (timeoutMs?: number) => {
+      readyToInitialize = true;
+      startInitialization(timeoutMs);
+    },
+    getInitializedContexts: () => {
+      return initializedContexts;
+    },
+  };
+}
diff --git a/x-pack/plugins/alerting/server/alerts_service/default_lifecycle_policy.ts b/x-pack/plugins/alerting/server/alerts_service/default_lifecycle_policy.ts
new file mode 100644
index 00000000000000..f5d11c6214ee61
--- /dev/null
+++ b/x-pack/plugins/alerting/server/alerts_service/default_lifecycle_policy.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/**
+ * Default alert index ILM policy
+ * - _meta.managed: notify users this is a managed policy and should be modified
+ *     at their own risk
+ * - no delete phase as we want to keep these indices around indefinitely
+ *
+ * This should be used by all alerts-as-data indices
+ */
+
+export const ILM_POLICY_NAME = 'alerts-default-ilm-policy';
+export const DEFAULT_ILM_POLICY = {
+  policy: {
+    _meta: {
+      managed: true,
+    },
+    phases: {
+      hot: {
+        actions: {
+          rollover: {
+            max_age: '30d',
+            max_primary_shard_size: '50gb',
+          },
+        },
+      },
+    },
+  },
+};
diff --git a/x-pack/plugins/alerting/server/alerts_service/retry_transient_es_errors.test.ts b/x-pack/plugins/alerting/server/alerts_service/retry_transient_es_errors.test.ts
new file mode 100644
index 00000000000000..2501c57776d80c
--- /dev/null
+++ b/x-pack/plugins/alerting/server/alerts_service/retry_transient_es_errors.test.ts
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { loggerMock } from '@kbn/logging-mocks';
+import { errors as EsErrors } from '@elastic/elasticsearch';
+
+import { retryTransientEsErrors } from './retry_transient_es_errors';
+
+const logger = loggerMock.create();
+const randomDelayMultiplier = 0.01;
+
+describe('retryTransientErrors', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+    jest.spyOn(global.Math, 'random').mockReturnValue(randomDelayMultiplier);
+  });
+
+  it("doesn't retry if operation is successful", async () => {
+    const esCallMock = jest.fn().mockResolvedValue('success');
+    expect(await retryTransientEsErrors(esCallMock, { logger })).toEqual('success');
+    expect(esCallMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('logs a warning message on retry', async () => {
+    const esCallMock = jest
+      .fn()
+      .mockRejectedValueOnce(new EsErrors.ConnectionError('foo'))
+      .mockResolvedValue('success');
+
+    await retryTransientEsErrors(esCallMock, { logger });
+    expect(logger.warn).toHaveBeenCalledTimes(1);
+    expect(logger.warn.mock.calls[0][0]).toMatch(
+      `Retrying Elasticsearch operation after [2s] due to error: ConnectionError: foo ConnectionError: foo`
+    );
+  });
+
+  it('retries with an exponential backoff', async () => {
+    let attempt = 0;
+    const esCallMock = jest.fn(async () => {
+      attempt++;
+      if (attempt < 4) {
+        throw new EsErrors.ConnectionError('foo');
+      } else {
+        return 'success';
+      }
+    });
+
+    expect(await retryTransientEsErrors(esCallMock, { logger })).toEqual('success');
+    expect(esCallMock).toHaveBeenCalledTimes(4);
+    expect(logger.warn).toHaveBeenCalledTimes(3);
+    expect(logger.warn.mock.calls[0][0]).toMatch(
+      `Retrying Elasticsearch operation after [2s] due to error: ConnectionError: foo ConnectionError: foo`
+    );
+    expect(logger.warn.mock.calls[1][0]).toMatch(
+      `Retrying Elasticsearch operation after [4s] due to error: ConnectionError: foo ConnectionError: foo`
+    );
+    expect(logger.warn.mock.calls[2][0]).toMatch(
+      `Retrying Elasticsearch operation after [8s] due to error: ConnectionError: foo ConnectionError: foo`
+    );
+  });
+
+  it('retries each supported error type', async () => {
+    const errors = [
+      new EsErrors.NoLivingConnectionsError('no living connection', {
+        warnings: [],
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        meta: {} as any,
+      }),
+      new EsErrors.ConnectionError('no connection'),
+      new EsErrors.TimeoutError('timeout'),
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      new EsErrors.ResponseError({ statusCode: 503, meta: {} as any, warnings: [] }),
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      new EsErrors.ResponseError({ statusCode: 408, meta: {} as any, warnings: [] }),
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      new EsErrors.ResponseError({ statusCode: 410, meta: {} as any, warnings: [] }),
+    ];
+
+    for (const error of errors) {
+      const esCallMock = jest.fn().mockRejectedValueOnce(error).mockResolvedValue('success');
+      expect(await retryTransientEsErrors(esCallMock, { logger })).toEqual('success');
+      expect(esCallMock).toHaveBeenCalledTimes(2);
+    }
+  });
+
+  it('does not retry unsupported errors', async () => {
+    const error = new Error('foo!');
+    const esCallMock = jest.fn().mockRejectedValueOnce(error).mockResolvedValue('success');
+    await expect(retryTransientEsErrors(esCallMock, { logger })).rejects.toThrow(error);
+    expect(esCallMock).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/x-pack/plugins/alerting/server/alerts_service/retry_transient_es_errors.ts b/x-pack/plugins/alerting/server/alerts_service/retry_transient_es_errors.ts
new file mode 100644
index 00000000000000..2df03e65690f16
--- /dev/null
+++ b/x-pack/plugins/alerting/server/alerts_service/retry_transient_es_errors.ts
@@ -0,0 +1,57 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Logger } from '@kbn/core/server';
+import { errors as EsErrors } from '@elastic/elasticsearch';
+
+const MAX_ATTEMPTS = 3;
+
+const retryResponseStatuses = [
+  503, // ServiceUnavailable
+  408, // RequestTimeout
+  410, // Gone
+];
+
+const isRetryableError = (e: Error) =>
+  e instanceof EsErrors.NoLivingConnectionsError ||
+  e instanceof EsErrors.ConnectionError ||
+  e instanceof EsErrors.TimeoutError ||
+  (e instanceof EsErrors.ResponseError && retryResponseStatuses.includes(e?.statusCode!));
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export const retryTransientEsErrors = async <T>(
+  esCall: () => Promise<T>,
+  {
+    logger,
+    attempt = 0,
+  }: {
+    logger: Logger;
+    attempt?: number;
+  }
+): Promise<T> => {
+  try {
+    return await esCall();
+  } catch (e) {
+    if (attempt < MAX_ATTEMPTS && isRetryableError(e)) {
+      const retryCount = attempt + 1;
+      const retryDelaySec: number = Math.min(Math.pow(2, retryCount), 30); // 2s, 4s, 8s, 16s, 30s, 30s, 30s...
+
+      logger.warn(
+        `Retrying Elasticsearch operation after [${retryDelaySec}s] due to error: ${e.toString()} ${
+          e.stack
+        }`
+      );
+
+      // delay with some randomness
+      await delay(retryDelaySec * 1000 * Math.random());
+      return retryTransientEsErrors(esCall, { logger, attempt: retryCount });
+    }
+
+    throw e;
+  }
+};
diff --git a/x-pack/plugins/alerting/server/alerts_service/types.ts b/x-pack/plugins/alerting/server/alerts_service/types.ts
new file mode 100644
index 00000000000000..db47a9a8e00150
--- /dev/null
+++ b/x-pack/plugins/alerting/server/alerts_service/types.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ClusterPutComponentTemplateRequest } from '@elastic/elasticsearch/lib/api/types';
+import { getComponentTemplateFromFieldMap } from '../../common/alert_schema';
+import { FieldMap } from '../../common/alert_schema/field_maps/types';
+
+export const getComponentTemplateName = (context?: string) =>
+  `alerts-${context ? context : 'common'}-component-template`;
+
+export interface IIndexPatternString {
+  template: string;
+  pattern: string;
+  alias: string;
+  name: string;
+}
+
+export const getIndexTemplateAndPattern = (
+  context: string,
+  namespace?: string
+): IIndexPatternString => {
+  const pattern = `${context}-${namespace ? namespace : 'default'}`;
+  return {
+    template: `.alerts-${pattern}-template`,
+    pattern: `.alerts-${pattern}-*`,
+    alias: `.alerts-${pattern}`,
+    name: `.alerts-${pattern}-000001`,
+  };
+};
+
+export const getComponentTemplate = (
+  fieldMap: FieldMap,
+  context?: string
+): ClusterPutComponentTemplateRequest =>
+  getComponentTemplateFromFieldMap({
+    name: getComponentTemplateName(context),
+    fieldMap,
+    // set field limit slightly higher than actual number of fields
+    fieldLimit: 100, // Math.round(Object.keys(fieldMap).length * 1.5),
+  });
diff --git a/x-pack/plugins/alerting/server/config.test.ts b/x-pack/plugins/alerting/server/config.test.ts
index ec6f2f6565d67f..26ea818719b7e7 100644
--- a/x-pack/plugins/alerting/server/config.test.ts
+++ b/x-pack/plugins/alerting/server/config.test.ts
@@ -13,6 +13,7 @@ describe('config validation', () => {
     expect(configSchema.validate(config)).toMatchInlineSnapshot(`
       Object {
         "cancelAlertsOnRuleTimeout": true,
+        "enableFrameworkAlerts": false,
         "healthCheck": Object {
           "interval": "60m",
         },
diff --git a/x-pack/plugins/alerting/server/config.ts b/x-pack/plugins/alerting/server/config.ts
index f6becbf192b05e..f727cb98c02661 100644
--- a/x-pack/plugins/alerting/server/config.ts
+++ b/x-pack/plugins/alerting/server/config.ts
@@ -62,6 +62,7 @@ export const configSchema = schema.object({
   maxEphemeralActionsPerAlert: schema.number({
     defaultValue: DEFAULT_MAX_EPHEMERAL_ACTIONS_PER_ALERT,
   }),
+  enableFrameworkAlerts: schema.boolean({ defaultValue: false }),
   cancelAlertsOnRuleTimeout: schema.boolean({ defaultValue: true }),
   rules: rulesSchema,
 });
diff --git a/x-pack/plugins/alerting/server/plugin.test.ts b/x-pack/plugins/alerting/server/plugin.test.ts
index 7b85bc898fee03..4e48c0db01ae69 100644
--- a/x-pack/plugins/alerting/server/plugin.test.ts
+++ b/x-pack/plugins/alerting/server/plugin.test.ts
@@ -26,6 +26,13 @@ import {
   PluginSetup as DataPluginSetup,
 } from '@kbn/data-plugin/server';
 import { spacesMock } from '@kbn/spaces-plugin/server/mocks';
+import { AlertsService } from './alerts_service/alerts_service';
+import { alertsServiceMock } from './alerts_service/alerts_service.mock';
+
+const mockAlertService = alertsServiceMock.create();
+jest.mock('./alerts_service/alerts_service', () => ({
+  AlertsService: jest.fn().mockImplementation(() => mockAlertService),
+}));
 import { SharePluginStart } from '@kbn/share-plugin/server';
 import { dataViewPluginMocks } from '@kbn/data-views-plugin/public/mocks';
 
@@ -33,6 +40,7 @@ const generateAlertingConfig = (): AlertingConfig => ({
   healthCheck: {
     interval: '5m',
   },
+  enableFrameworkAlerts: false,
   invalidateApiKeysTask: {
     interval: '5m',
     removalDelay: '1h',
@@ -116,6 +124,20 @@ describe('Alerting Plugin', () => {
       expect(usageCollectionSetup.registerCollector).toHaveBeenCalled();
     });
 
+    it('should initialize AlertsService if enableFrameworkAlerts config is true', async () => {
+      const context = coreMock.createPluginInitializerContext<AlertingConfig>({
+        ...generateAlertingConfig(),
+        enableFrameworkAlerts: true,
+      });
+      plugin = new AlertingPlugin(context);
+
+      // need await to test number of calls of setupMocks.status.set, because it is under async function which awaiting core.getStartServices()
+      await plugin.setup(setupMocks, mockPlugins);
+
+      expect(AlertsService).toHaveBeenCalled();
+      expect(mockAlertService.initialize).toHaveBeenCalled();
+    });
+
     it(`exposes configured minimumScheduleInterval()`, async () => {
       const context = coreMock.createPluginInitializerContext<AlertingConfig>(
         generateAlertingConfig()
diff --git a/x-pack/plugins/alerting/server/plugin.ts b/x-pack/plugins/alerting/server/plugin.ts
index b3b94584025c3b..5ae4be21d9a639 100644
--- a/x-pack/plugins/alerting/server/plugin.ts
+++ b/x-pack/plugins/alerting/server/plugin.ts
@@ -6,7 +6,7 @@
  */
 
 import type { PublicMethodsOf } from '@kbn/utility-types';
-import { BehaviorSubject } from 'rxjs';
+import { BehaviorSubject, ReplaySubject, Subject } from 'rxjs';
 import { pick } from 'lodash';
 import { UsageCollectionSetup, UsageCounter } from '@kbn/usage-collection-plugin/server';
 import { SecurityPluginSetup, SecurityPluginStart } from '@kbn/security-plugin/server';
@@ -86,6 +86,7 @@ import { getSecurityHealth, SecurityHealth } from './lib/get_security_health';
 import { registerNodeCollector, registerClusterCollector, InMemoryMetrics } from './monitoring';
 import { getRuleTaskTimeout } from './lib/get_rule_task_timeout';
 import { getActionsConfigMap } from './lib/get_actions_config_map';
+import { AlertsService } from './alerts_service/alerts_service';
 import { rulesSettingsFeature } from './rules_settings_feature';
 
 export const EVENT_LOG_PROVIDER = 'alerting';
@@ -186,6 +187,8 @@ export class AlertingPlugin {
   private kibanaBaseUrl: string | undefined;
   private usageCounter: UsageCounter | undefined;
   private inMemoryMetrics: InMemoryMetrics;
+  private alertsService?: AlertsService;
+  private pluginStop$: Subject<void>;
 
   constructor(initializerContext: PluginInitializerContext) {
     this.config = initializerContext.config.get();
@@ -197,6 +200,7 @@ export class AlertingPlugin {
     this.telemetryLogger = initializerContext.logger.get('usage');
     this.kibanaVersion = initializerContext.env.packageInfo.version;
     this.inMemoryMetrics = new InMemoryMetrics(initializerContext.logger.get('in_memory_metrics'));
+    this.pluginStop$ = new ReplaySubject(1);
   }
 
   public setup(
@@ -235,12 +239,24 @@ export class AlertingPlugin {
     this.eventLogService = plugins.eventLog;
     plugins.eventLog.registerProviderActions(EVENT_LOG_PROVIDER, Object.values(EVENT_LOG_ACTIONS));
 
+    if (this.config.enableFrameworkAlerts) {
+      this.alertsService = new AlertsService({
+        logger: this.logger,
+        pluginStop$: this.pluginStop$,
+        elasticsearchClientPromise: core
+          .getStartServices()
+          .then(([{ elasticsearch }]) => elasticsearch.client.asInternalUser),
+      });
+      this.alertsService!.initialize();
+    }
+
     const ruleTypeRegistry = new RuleTypeRegistry({
       logger: this.logger,
       taskManager: plugins.taskManager,
       taskRunnerFactory: this.taskRunnerFactory,
       licenseState: this.licenseState,
       licensing: plugins.licensing,
+      alertsService: this.alertsService,
       minimumScheduleInterval: this.config.rules.minimumScheduleInterval,
       inMemoryMetrics: this.inMemoryMetrics,
     });
@@ -526,5 +542,7 @@ export class AlertingPlugin {
     if (this.licenseState) {
       this.licenseState.clean();
     }
+    this.pluginStop$.next();
+    this.pluginStop$.complete();
   }
 }
diff --git a/x-pack/plugins/alerting/server/rule_type_registry.test.ts b/x-pack/plugins/alerting/server/rule_type_registry.test.ts
index 8391d94576d13b..bb15ef287e4086 100644
--- a/x-pack/plugins/alerting/server/rule_type_registry.test.ts
+++ b/x-pack/plugins/alerting/server/rule_type_registry.test.ts
@@ -14,6 +14,7 @@ import { licenseStateMock } from './lib/license_state.mock';
 import { licensingMock } from '@kbn/licensing-plugin/server/mocks';
 import { loggingSystemMock } from '@kbn/core/server/mocks';
 import { inMemoryMetricsMock } from './monitoring/in_memory_metrics.mock';
+import { alertsServiceMock } from './alerts_service/alerts_service.mock';
 
 const logger = loggingSystemMock.create().get();
 let mockedLicenseState: jest.Mocked<ILicenseState>;
@@ -21,6 +22,7 @@ let ruleTypeRegistryParams: ConstructorOptions;
 
 const taskManager = taskManagerMock.createSetup();
 const inMemoryMetrics = inMemoryMetricsMock.create();
+const alertsService = alertsServiceMock.create();
 
 beforeEach(() => {
   jest.resetAllMocks();
@@ -451,6 +453,55 @@ describe('Create Lifecycle', () => {
         })
       ).toThrowErrorMatchingInlineSnapshot(`"Rule type \\"test\\" is already registered."`);
     });
+
+    test('should initialize alerts as data resources if AlertsService is defined and alert definition is registered', () => {
+      const registry = new RuleTypeRegistry({ ...ruleTypeRegistryParams, alertsService });
+      registry.register({
+        id: 'test',
+        name: 'Test',
+        actionGroups: [
+          {
+            id: 'default',
+            name: 'Default',
+          },
+        ],
+        defaultActionGroupId: 'default',
+        minimumLicenseRequired: 'basic',
+        isExportable: true,
+        executor: jest.fn(),
+        producer: 'alerts',
+        alerts: {
+          context: 'test',
+          fieldMap: { field: { type: 'keyword', required: false } },
+        },
+      });
+
+      expect(alertsService.register).toHaveBeenCalledWith({
+        context: 'test',
+        fieldMap: { field: { type: 'keyword', required: false } },
+      });
+    });
+
+    test('should not initialize alerts as data resources if no alert definition is registered', () => {
+      const registry = new RuleTypeRegistry({ ...ruleTypeRegistryParams, alertsService });
+      registry.register({
+        id: 'test',
+        name: 'Test',
+        actionGroups: [
+          {
+            id: 'default',
+            name: 'Default',
+          },
+        ],
+        defaultActionGroupId: 'default',
+        minimumLicenseRequired: 'basic',
+        isExportable: true,
+        executor: jest.fn(),
+        producer: 'alerts',
+      });
+
+      expect(alertsService.register).not.toHaveBeenCalled();
+    });
   });
 
   describe('get()', () => {
diff --git a/x-pack/plugins/alerting/server/rule_type_registry.ts b/x-pack/plugins/alerting/server/rule_type_registry.ts
index b908f7cb67b877..b4be0957f11af5 100644
--- a/x-pack/plugins/alerting/server/rule_type_registry.ts
+++ b/x-pack/plugins/alerting/server/rule_type_registry.ts
@@ -33,6 +33,7 @@ import { ILicenseState } from './lib/license_state';
 import { getRuleTypeFeatureUsageName } from './lib/get_rule_type_feature_usage_name';
 import { InMemoryMetrics } from './monitoring';
 import { AlertingRulesConfig } from '.';
+import { AlertsService } from './alerts_service/alerts_service';
 
 export interface ConstructorOptions {
   logger: Logger;
@@ -42,6 +43,7 @@ export interface ConstructorOptions {
   licensing: LicensingPluginSetup;
   minimumScheduleInterval: AlertingRulesConfig['minimumScheduleInterval'];
   inMemoryMetrics: InMemoryMetrics;
+  alertsService?: AlertsService;
 }
 
 export interface RegistryRuleType
@@ -139,6 +141,7 @@ export class RuleTypeRegistry {
   private readonly minimumScheduleInterval: AlertingRulesConfig['minimumScheduleInterval'];
   private readonly licensing: LicensingPluginSetup;
   private readonly inMemoryMetrics: InMemoryMetrics;
+  private readonly alertsService?: AlertsService;
 
   constructor({
     logger,
@@ -148,6 +151,7 @@ export class RuleTypeRegistry {
     licensing,
     minimumScheduleInterval,
     inMemoryMetrics,
+    alertsService,
   }: ConstructorOptions) {
     this.logger = logger;
     this.taskManager = taskManager;
@@ -156,6 +160,7 @@ export class RuleTypeRegistry {
     this.licensing = licensing;
     this.minimumScheduleInterval = minimumScheduleInterval;
     this.inMemoryMetrics = inMemoryMetrics;
+    this.alertsService = alertsService;
   }
 
   public has(id: string) {
@@ -277,6 +282,11 @@ export class RuleTypeRegistry {
           >(normalizedRuleType, context, this.inMemoryMetrics),
       },
     });
+
+    if (this.alertsService && ruleType.alerts) {
+      this.alertsService.register(ruleType.alerts);
+    }
+
     // No need to notify usage on basic alert types
     if (ruleType.minimumLicenseRequired !== 'basic') {
       this.licensing.featureUsage.register(
diff --git a/x-pack/plugins/alerting/server/types.ts b/x-pack/plugins/alerting/server/types.ts
index f4b7cc57b27e47..4092b9209432a5 100644
--- a/x-pack/plugins/alerting/server/types.ts
+++ b/x-pack/plugins/alerting/server/types.ts
@@ -50,6 +50,7 @@ import {
   RuleLastRun,
 } from '../common';
 import { PublicAlertFactory } from './alert/create_alert_factory';
+import { FieldMap } from '../common/alert_schema/field_maps/types';
 export type WithoutQueryAndParams<T> = Pick<T, Exclude<keyof T, 'query' | 'params'>>;
 export type SpaceIdToNamespaceFunction = (spaceId?: string) => string | undefined;
 export type { RuleTypeParams };
@@ -158,6 +159,11 @@ export interface SummarizedAlerts {
   };
 }
 export type GetSummarizedAlertsFn = (opts: GetSummarizedAlertsFnOpts) => Promise<SummarizedAlerts>;
+export interface IRuleTypeAlerts {
+  context: string;
+  namespace?: string;
+  fieldMap: FieldMap;
+}
 
 export interface RuleType<
   Params extends RuleTypeParams = never,
@@ -204,6 +210,7 @@ export interface RuleType<
   cancelAlertsOnRuleTimeout?: boolean;
   doesSetRecoveryContext?: boolean;
   getSummarizedAlerts?: GetSummarizedAlertsFn;
+  alerts?: IRuleTypeAlerts;
   /**
    * Determines whether framework should
    * automatically make recovery determination. Defaults to true.
diff --git a/x-pack/plugins/alerting/tsconfig.json b/x-pack/plugins/alerting/tsconfig.json
index a1fb0d3892d2af..73c407bd325a8d 100644
--- a/x-pack/plugins/alerting/tsconfig.json
+++ b/x-pack/plugins/alerting/tsconfig.json
@@ -8,7 +8,7 @@
     // have to declare *.json explicitly due to https://github.com/microsoft/TypeScript/issues/25636
     "server/**/*.json",
     "public/**/*",
-    "common/*"
+    "common/**/*"
   ],
   "kbn_references": [
     "@kbn/core",
@@ -39,6 +39,7 @@
     "@kbn/apm-utils",
     "@kbn/data-views-plugin",
     "@kbn/share-plugin",
+    "@kbn/safer-lodash-set",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/test/alerting_api_integration/common/config.ts b/x-pack/test/alerting_api_integration/common/config.ts
index 2f70ad59024831..6ee90026d98211 100644
--- a/x-pack/test/alerting_api_integration/common/config.ts
+++ b/x-pack/test/alerting_api_integration/common/config.ts
@@ -185,6 +185,7 @@ export function createTestConfig(name: string, options: CreateTestConfigOptions)
           `--xpack.alerting.rules.run.actions.connectorTypeOverrides=${JSON.stringify([
             { id: 'test.capped', max: '1' },
           ])}`,
+          `--xpack.alerting.enableFrameworkAlerts=true`,
           `--xpack.actions.enabledActionTypes=${JSON.stringify(enabledActionTypes)}`,
           `--xpack.actions.rejectUnauthorized=${rejectUnauthorized}`,
           `--xpack.actions.microsoftGraphApiUrl=${servers.kibana.protocol}://${servers.kibana.hostname}:${servers.kibana.port}/api/_actions-FTS-external-service-simulators/exchange/users/test@/sendMail`,
diff --git a/x-pack/test/alerting_api_integration/common/plugins/alerts/server/alert_types.ts b/x-pack/test/alerting_api_integration/common/plugins/alerts/server/alert_types.ts
index 0c8390ca938dc9..3c2880d69f7764 100644
--- a/x-pack/test/alerting_api_integration/common/plugins/alerts/server/alert_types.ts
+++ b/x-pack/test/alerting_api_integration/common/plugins/alerts/server/alert_types.ts
@@ -92,6 +92,27 @@ function getAlwaysFiringAlertType() {
       context: [{ name: 'instanceContextValue', description: 'the instance context value' }],
     },
     executor: curry(alwaysFiringExecutor)(),
+    alerts: {
+      context: 'test.always-firing',
+      fieldMap: {
+        instance_state_value: {
+          required: false,
+          type: 'boolean',
+        },
+        instance_params_value: {
+          required: false,
+          type: 'boolean',
+        },
+        instance_context_value: {
+          required: false,
+          type: 'boolean',
+        },
+        group_in_series_index: {
+          required: false,
+          type: 'long',
+        },
+      },
+    },
   };
   return result;
 }
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_as_data.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_as_data.ts
new file mode 100644
index 00000000000000..13cb9bcd337f97
--- /dev/null
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/alerts_as_data.ts
@@ -0,0 +1,176 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { alertFieldMap } from '@kbn/alerting-plugin/common/alert_schema';
+import { mappingFromFieldMap } from '@kbn/alerting-plugin/common/alert_schema/field_maps/mapping_from_field_map';
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../../common/ftr_provider_context';
+
+// eslint-disable-next-line import/no-default-export
+export default function createAlertsAsDataTest({ getService }: FtrProviderContext) {
+  const es = getService('es');
+  const commonFrameworkMappings = mappingFromFieldMap(alertFieldMap, 'strict');
+
+  describe('alerts as data', () => {
+    it('should install common alerts as data resources on startup', async () => {
+      const ilmPolicyName = 'alerts-default-ilm-policy';
+      const componentTemplateName = 'alerts-common-component-template';
+
+      const commonIlmPolicy = await es.ilm.getLifecycle({
+        name: ilmPolicyName,
+      });
+
+      expect(commonIlmPolicy[ilmPolicyName].policy).to.eql({
+        _meta: {
+          managed: true,
+        },
+        phases: {
+          hot: {
+            min_age: '0ms',
+            actions: {
+              rollover: {
+                max_age: '30d',
+                max_primary_shard_size: '50gb',
+              },
+            },
+          },
+        },
+      });
+
+      const { component_templates: componentTemplates } = await es.cluster.getComponentTemplate({
+        name: componentTemplateName,
+      });
+
+      expect(componentTemplates.length).to.eql(1);
+      const commonComponentTemplate = componentTemplates[0];
+
+      expect(commonComponentTemplate.name).to.eql(componentTemplateName);
+      expect(commonComponentTemplate.component_template.template.mappings).to.eql(
+        commonFrameworkMappings
+      );
+      expect(commonComponentTemplate.component_template.template.settings).to.eql({
+        index: {
+          number_of_shards: 1,
+          mapping: {
+            total_fields: {
+              limit: 100,
+            },
+          },
+        },
+      });
+    });
+
+    it('should install context specific alerts as data resources on startup', async () => {
+      const componentTemplateName = 'alerts-test.always-firing-component-template';
+      const indexTemplateName = '.alerts-test.always-firing-default-template';
+      const indexName = '.alerts-test.always-firing-default-000001';
+      const contextSpecificMappings = {
+        instance_params_value: {
+          type: 'boolean',
+        },
+        instance_state_value: {
+          type: 'boolean',
+        },
+        instance_context_value: {
+          type: 'boolean',
+        },
+        group_in_series_index: {
+          type: 'long',
+        },
+      };
+
+      const { component_templates: componentTemplates } = await es.cluster.getComponentTemplate({
+        name: componentTemplateName,
+      });
+      expect(componentTemplates.length).to.eql(1);
+      const contextComponentTemplate = componentTemplates[0];
+      expect(contextComponentTemplate.name).to.eql(componentTemplateName);
+      expect(contextComponentTemplate.component_template.template.mappings).to.eql({
+        dynamic: 'strict',
+        properties: contextSpecificMappings,
+      });
+      expect(contextComponentTemplate.component_template.template.settings).to.eql({
+        index: {
+          number_of_shards: 1,
+          mapping: {
+            total_fields: {
+              limit: 100,
+            },
+          },
+        },
+      });
+
+      const { index_templates: indexTemplates } = await es.indices.getIndexTemplate({
+        name: indexTemplateName,
+      });
+      expect(indexTemplates.length).to.eql(1);
+      const contextIndexTemplate = indexTemplates[0];
+      expect(contextIndexTemplate.name).to.eql(indexTemplateName);
+      expect(contextIndexTemplate.index_template.index_patterns).to.eql([
+        '.alerts-test.always-firing-default-*',
+      ]);
+      expect(contextIndexTemplate.index_template.composed_of).to.eql([
+        'alerts-common-component-template',
+        'alerts-test.always-firing-component-template',
+      ]);
+      expect(contextIndexTemplate.index_template.template!.mappings).to.eql({
+        dynamic: false,
+      });
+      expect(contextIndexTemplate.index_template.template!.settings).to.eql({
+        index: {
+          lifecycle: {
+            name: 'alerts-default-ilm-policy',
+            rollover_alias: '.alerts-test.always-firing-default',
+          },
+          mapping: {
+            total_fields: {
+              limit: '2500',
+            },
+          },
+          hidden: 'true',
+          auto_expand_replicas: '0-1',
+        },
+      });
+
+      const contextIndex = await es.indices.get({
+        index: indexName,
+      });
+
+      expect(contextIndex[indexName].aliases).to.eql({
+        '.alerts-test.always-firing-default': {
+          is_write_index: true,
+        },
+      });
+
+      expect(contextIndex[indexName].mappings).to.eql({
+        dynamic: 'false',
+        properties: {
+          ...contextSpecificMappings,
+          ...commonFrameworkMappings.properties,
+        },
+      });
+
+      expect(contextIndex[indexName].settings?.index?.lifecycle).to.eql({
+        name: 'alerts-default-ilm-policy',
+        rollover_alias: '.alerts-test.always-firing-default',
+      });
+
+      expect(contextIndex[indexName].settings?.index?.mapping).to.eql({
+        total_fields: {
+          limit: '2500',
+        },
+      });
+
+      expect(contextIndex[indexName].settings?.index?.hidden).to.eql('true');
+      expect(contextIndex[indexName].settings?.index?.number_of_shards).to.eql(1);
+      expect(contextIndex[indexName].settings?.index?.auto_expand_replicas).to.eql('0-1');
+      expect(contextIndex[indexName].settings?.index?.provided_name).to.eql(
+        '.alerts-test.always-firing-default-000001'
+      );
+    });
+  });
+}
diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
index 9f3faf1d3a5fae..d7da90cf56df4b 100644
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/index.ts
@@ -53,6 +53,7 @@ export default function alertingTests({ loadTestFile, getService }: FtrProviderC
     loadTestFile(require.resolve('./run_soon'));
     loadTestFile(require.resolve('./flapping_history'));
     loadTestFile(require.resolve('./check_registered_rule_types'));
+    loadTestFile(require.resolve('./alerts_as_data'));
     // Do not place test files here, due to https://github.com/elastic/kibana/issues/123059
 
     // note that this test will destroy existing spaces

From ef6d48933afee1a55b064d6f483781d8c8ee9340 Mon Sep 17 00:00:00 2001
From: Jonathan Budzenski <jon@elastic.co>
Date: Mon, 23 Jan 2023 20:07:27 -0600
Subject: [PATCH 32/54] Revert "[artifacts/container-image] Trigger image tag
 update (#149143)"

This reverts commit 598843f7ca2b887beb6d91c525b438fd3bfe6531.
---
 .../scripts/steps/artifacts/docker_image.sh   | 20 -------------------
 1 file changed, 20 deletions(-)

diff --git a/.buildkite/scripts/steps/artifacts/docker_image.sh b/.buildkite/scripts/steps/artifacts/docker_image.sh
index a47372359893e7..edd82152aae2a1 100755
--- a/.buildkite/scripts/steps/artifacts/docker_image.sh
+++ b/.buildkite/scripts/steps/artifacts/docker_image.sh
@@ -65,23 +65,3 @@ buildkite-agent artifact upload "kibana-$BASE_VERSION-docker-image.tar.gz"
 buildkite-agent artifact upload "kibana-$BASE_VERSION-docker-image-aarch64.tar.gz"
 buildkite-agent artifact upload "dependencies-$GIT_ABBREV_COMMIT.csv"
 cd -
-
-echo "--- Trigger image tag update"
-if [[ "$BUILDKITE_BRANCH" == "$KIBANA_BASE_BRANCH" ]]; then
-
-  cat << EOF | buildkite-agent pipeline upload
-steps:
-  - trigger: k8s-gitops-update-image-tag
-    label: "Update image tag for deployment-api"
-    branches: main
-    build:
-      env:
-        MODE: sed
-        TARGET_FILE: app-config-controllers.yaml
-        IMAGE_TAG: "$KIBANA_IMAGE"
-        SERVICE: app-config-controllers
-EOF
-
-else
-  echo "Skipping update for untracked branch $BUILDKITE_BRANCH"
-fi

From 0bef28b31cf6640528ed10d73516e5eecd97ff49 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 24 Jan 2023 00:54:21 -0500
Subject: [PATCH 33/54] [api-docs] 2023-01-24 Daily api_docs build (#149377)

Generated by
https://buildkite.com/elastic/kibana-api-docs-daily/builds/227
---
 api_docs/actions.devdocs.json                 |  488 +-
 api_docs/actions.mdx                          |    4 +-
 api_docs/advanced_settings.mdx                |    2 +-
 api_docs/aiops.mdx                            |    2 +-
 api_docs/alerting.devdocs.json                |  105 +-
 api_docs/alerting.mdx                         |    4 +-
 api_docs/apm.mdx                              |    2 +-
 api_docs/banners.mdx                          |    2 +-
 api_docs/bfetch.mdx                           |    2 +-
 api_docs/canvas.mdx                           |    2 +-
 api_docs/cases.mdx                            |    2 +-
 api_docs/charts.mdx                           |    2 +-
 api_docs/cloud.mdx                            |    2 +-
 api_docs/cloud_chat.mdx                       |    2 +-
 api_docs/cloud_data_migration.mdx             |    2 +-
 api_docs/cloud_defend.mdx                     |    2 +-
 api_docs/cloud_experiments.mdx                |    2 +-
 api_docs/cloud_security_posture.mdx           |    2 +-
 api_docs/console.mdx                          |    2 +-
 api_docs/controls.mdx                         |    2 +-
 api_docs/core.devdocs.json                    |  204 +
 api_docs/core.mdx                             |    4 +-
 api_docs/custom_integrations.mdx              |    2 +-
 api_docs/dashboard.devdocs.json               | 1428 ++++-
 api_docs/dashboard.mdx                        |    7 +-
 api_docs/dashboard_enhanced.mdx               |    2 +-
 api_docs/data.devdocs.json                    |  112 +
 api_docs/data.mdx                             |    2 +-
 api_docs/data_query.devdocs.json              |   32 +-
 api_docs/data_query.mdx                       |    2 +-
 api_docs/data_search.devdocs.json             |    2 +-
 api_docs/data_search.mdx                      |    2 +-
 api_docs/data_view_editor.mdx                 |    2 +-
 api_docs/data_view_field_editor.mdx           |    2 +-
 api_docs/data_view_management.mdx             |    2 +-
 api_docs/data_views.devdocs.json              |   56 +
 api_docs/data_views.mdx                       |    2 +-
 api_docs/data_visualizer.mdx                  |    2 +-
 api_docs/deprecations_by_api.mdx              |    4 +-
 api_docs/deprecations_by_plugin.mdx           |   13 +-
 api_docs/deprecations_by_team.mdx             |    2 +-
 api_docs/dev_tools.mdx                        |    2 +-
 api_docs/discover.mdx                         |    2 +-
 api_docs/discover_enhanced.mdx                |    2 +-
 api_docs/embeddable.mdx                       |    2 +-
 api_docs/embeddable_enhanced.mdx              |    2 +-
 api_docs/encrypted_saved_objects.mdx          |    2 +-
 api_docs/enterprise_search.mdx                |    2 +-
 api_docs/es_ui_shared.mdx                     |    2 +-
 api_docs/event_annotation.mdx                 |    2 +-
 api_docs/event_log.devdocs.json               |   23 +-
 api_docs/event_log.mdx                        |    4 +-
 api_docs/expression_error.mdx                 |    2 +-
 api_docs/expression_gauge.mdx                 |    2 +-
 api_docs/expression_heatmap.mdx               |    2 +-
 api_docs/expression_image.mdx                 |    2 +-
 api_docs/expression_legacy_metric_vis.mdx     |    2 +-
 api_docs/expression_metric.mdx                |    2 +-
 api_docs/expression_metric_vis.mdx            |    2 +-
 api_docs/expression_partition_vis.mdx         |    2 +-
 api_docs/expression_repeat_image.mdx          |    2 +-
 api_docs/expression_reveal_image.mdx          |    2 +-
 api_docs/expression_shape.mdx                 |    2 +-
 api_docs/expression_tagcloud.mdx              |    2 +-
 api_docs/expression_x_y.mdx                   |    2 +-
 api_docs/expressions.mdx                      |    2 +-
 api_docs/features.mdx                         |    2 +-
 api_docs/field_formats.mdx                    |    2 +-
 api_docs/file_upload.mdx                      |    2 +-
 api_docs/files.mdx                            |    2 +-
 api_docs/files_management.mdx                 |    2 +-
 api_docs/fleet.devdocs.json                   |   15 +
 api_docs/fleet.mdx                            |    4 +-
 api_docs/global_search.mdx                    |    2 +-
 api_docs/guided_onboarding.mdx                |    2 +-
 api_docs/home.mdx                             |    2 +-
 api_docs/image_embeddable.mdx                 |    2 +-
 api_docs/index_lifecycle_management.mdx       |    2 +-
 api_docs/index_management.mdx                 |    2 +-
 api_docs/infra.devdocs.json                   |   14 +
 api_docs/infra.mdx                            |    4 +-
 api_docs/inspector.mdx                        |    2 +-
 api_docs/interactive_setup.mdx                |    2 +-
 api_docs/kbn_ace.mdx                          |    2 +-
 api_docs/kbn_aiops_components.mdx             |    2 +-
 api_docs/kbn_aiops_utils.mdx                  |    2 +-
 api_docs/kbn_alerts.mdx                       |    2 +-
 api_docs/kbn_analytics.mdx                    |    2 +-
 api_docs/kbn_analytics_client.devdocs.json    |   32 +
 api_docs/kbn_analytics_client.mdx             |    2 +-
 ..._analytics_shippers_elastic_v3_browser.mdx |    2 +-
 ...n_analytics_shippers_elastic_v3_common.mdx |    2 +-
 ...n_analytics_shippers_elastic_v3_server.mdx |    2 +-
 api_docs/kbn_analytics_shippers_fullstory.mdx |    2 +-
 api_docs/kbn_analytics_shippers_gainsight.mdx |    2 +-
 api_docs/kbn_apm_config_loader.mdx            |    2 +-
 api_docs/kbn_apm_synthtrace.mdx               |    2 +-
 api_docs/kbn_apm_synthtrace_client.mdx        |    2 +-
 api_docs/kbn_apm_utils.mdx                    |    2 +-
 api_docs/kbn_axe_config.mdx                   |    2 +-
 api_docs/kbn_cases_components.mdx             |    2 +-
 api_docs/kbn_cell_actions.mdx                 |    2 +-
 api_docs/kbn_chart_icons.mdx                  |    2 +-
 api_docs/kbn_ci_stats_core.mdx                |    2 +-
 api_docs/kbn_ci_stats_performance_metrics.mdx |    2 +-
 api_docs/kbn_ci_stats_reporter.mdx            |    2 +-
 api_docs/kbn_cli_dev_mode.mdx                 |    2 +-
 api_docs/kbn_coloring.mdx                     |    2 +-
 api_docs/kbn_config.mdx                       |    2 +-
 api_docs/kbn_config_mocks.mdx                 |    2 +-
 api_docs/kbn_config_schema.mdx                |    2 +-
 .../kbn_content_management_content_editor.mdx |    2 +-
 .../kbn_content_management_table_list.mdx     |    2 +-
 api_docs/kbn_core_analytics_browser.mdx       |    2 +-
 .../kbn_core_analytics_browser_internal.mdx   |    2 +-
 api_docs/kbn_core_analytics_browser_mocks.mdx |    2 +-
 api_docs/kbn_core_analytics_server.mdx        |    2 +-
 .../kbn_core_analytics_server_internal.mdx    |    2 +-
 api_docs/kbn_core_analytics_server_mocks.mdx  |    2 +-
 api_docs/kbn_core_application_browser.mdx     |    2 +-
 .../kbn_core_application_browser_internal.mdx |    2 +-
 .../kbn_core_application_browser_mocks.mdx    |    2 +-
 api_docs/kbn_core_application_common.mdx      |    2 +-
 api_docs/kbn_core_apps_browser_internal.mdx   |    2 +-
 api_docs/kbn_core_apps_browser_mocks.mdx      |    2 +-
 api_docs/kbn_core_apps_server_internal.mdx    |    2 +-
 api_docs/kbn_core_base_browser_mocks.mdx      |    2 +-
 api_docs/kbn_core_base_common.mdx             |    2 +-
 api_docs/kbn_core_base_server_internal.mdx    |    2 +-
 api_docs/kbn_core_base_server_mocks.mdx       |    2 +-
 .../kbn_core_capabilities_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_capabilities_common.mdx     |    2 +-
 api_docs/kbn_core_capabilities_server.mdx     |    2 +-
 .../kbn_core_capabilities_server_mocks.mdx    |    2 +-
 api_docs/kbn_core_chrome_browser.mdx          |    2 +-
 api_docs/kbn_core_chrome_browser_mocks.mdx    |    2 +-
 api_docs/kbn_core_config_server_internal.mdx  |    2 +-
 api_docs/kbn_core_custom_branding_browser.mdx |    2 +-
 ..._core_custom_branding_browser_internal.mdx |    2 +-
 ...kbn_core_custom_branding_browser_mocks.mdx |    2 +-
 api_docs/kbn_core_custom_branding_common.mdx  |    2 +-
 api_docs/kbn_core_custom_branding_server.mdx  |    2 +-
 ...n_core_custom_branding_server_internal.mdx |    2 +-
 .../kbn_core_custom_branding_server_mocks.mdx |    2 +-
 api_docs/kbn_core_deprecations_browser.mdx    |    2 +-
 ...kbn_core_deprecations_browser_internal.mdx |    2 +-
 .../kbn_core_deprecations_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_deprecations_common.mdx     |    2 +-
 api_docs/kbn_core_deprecations_server.mdx     |    2 +-
 .../kbn_core_deprecations_server_internal.mdx |    2 +-
 .../kbn_core_deprecations_server_mocks.mdx    |    2 +-
 api_docs/kbn_core_doc_links_browser.mdx       |    2 +-
 api_docs/kbn_core_doc_links_browser_mocks.mdx |    2 +-
 api_docs/kbn_core_doc_links_server.mdx        |    2 +-
 api_docs/kbn_core_doc_links_server_mocks.mdx  |    2 +-
 ...e_elasticsearch_client_server_internal.mdx |    2 +-
 ...core_elasticsearch_client_server_mocks.mdx |    2 +-
 api_docs/kbn_core_elasticsearch_server.mdx    |    2 +-
 ...kbn_core_elasticsearch_server_internal.mdx |    2 +-
 .../kbn_core_elasticsearch_server_mocks.mdx   |    2 +-
 .../kbn_core_environment_server_internal.mdx  |    2 +-
 .../kbn_core_environment_server_mocks.mdx     |    2 +-
 .../kbn_core_execution_context_browser.mdx    |    2 +-
 ...ore_execution_context_browser_internal.mdx |    2 +-
 ...n_core_execution_context_browser_mocks.mdx |    2 +-
 .../kbn_core_execution_context_common.mdx     |    2 +-
 .../kbn_core_execution_context_server.mdx     |    2 +-
 ...core_execution_context_server_internal.mdx |    2 +-
 ...bn_core_execution_context_server_mocks.mdx |    2 +-
 api_docs/kbn_core_fatal_errors_browser.mdx    |    2 +-
 .../kbn_core_fatal_errors_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_http_browser.mdx            |    2 +-
 api_docs/kbn_core_http_browser_internal.mdx   |    2 +-
 api_docs/kbn_core_http_browser_mocks.mdx      |    2 +-
 api_docs/kbn_core_http_common.mdx             |    2 +-
 .../kbn_core_http_context_server_mocks.mdx    |    2 +-
 ...re_http_request_handler_context_server.mdx |    2 +-
 api_docs/kbn_core_http_resources_server.mdx   |    2 +-
 ...bn_core_http_resources_server_internal.mdx |    2 +-
 .../kbn_core_http_resources_server_mocks.mdx  |    2 +-
 .../kbn_core_http_router_server_internal.mdx  |    2 +-
 .../kbn_core_http_router_server_mocks.mdx     |    2 +-
 api_docs/kbn_core_http_server.mdx             |    2 +-
 api_docs/kbn_core_http_server_internal.mdx    |    2 +-
 api_docs/kbn_core_http_server_mocks.mdx       |    2 +-
 api_docs/kbn_core_i18n_browser.mdx            |    2 +-
 api_docs/kbn_core_i18n_browser_mocks.mdx      |    2 +-
 api_docs/kbn_core_i18n_server.mdx             |    2 +-
 api_docs/kbn_core_i18n_server_internal.mdx    |    2 +-
 api_docs/kbn_core_i18n_server_mocks.mdx       |    2 +-
 ...n_core_injected_metadata_browser_mocks.mdx |    2 +-
 ...kbn_core_integrations_browser_internal.mdx |    2 +-
 .../kbn_core_integrations_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_lifecycle_browser.mdx       |    2 +-
 api_docs/kbn_core_lifecycle_browser_mocks.mdx |    2 +-
 api_docs/kbn_core_lifecycle_server.mdx        |    2 +-
 api_docs/kbn_core_lifecycle_server_mocks.mdx  |    2 +-
 api_docs/kbn_core_logging_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_logging_common_internal.mdx |    2 +-
 api_docs/kbn_core_logging_server.mdx          |    2 +-
 api_docs/kbn_core_logging_server_internal.mdx |    2 +-
 api_docs/kbn_core_logging_server_mocks.mdx    |    2 +-
 ...ore_metrics_collectors_server_internal.mdx |    2 +-
 ...n_core_metrics_collectors_server_mocks.mdx |    2 +-
 api_docs/kbn_core_metrics_server.mdx          |    2 +-
 api_docs/kbn_core_metrics_server_internal.mdx |    2 +-
 api_docs/kbn_core_metrics_server_mocks.mdx    |    2 +-
 api_docs/kbn_core_mount_utils_browser.mdx     |    2 +-
 api_docs/kbn_core_node_server.mdx             |    2 +-
 api_docs/kbn_core_node_server_internal.mdx    |    2 +-
 api_docs/kbn_core_node_server_mocks.mdx       |    2 +-
 api_docs/kbn_core_notifications_browser.mdx   |    2 +-
 ...bn_core_notifications_browser_internal.mdx |    2 +-
 .../kbn_core_notifications_browser_mocks.mdx  |    2 +-
 api_docs/kbn_core_overlays_browser.mdx        |    2 +-
 .../kbn_core_overlays_browser_internal.mdx    |    2 +-
 api_docs/kbn_core_overlays_browser_mocks.mdx  |    2 +-
 api_docs/kbn_core_plugins_browser.mdx         |    2 +-
 api_docs/kbn_core_plugins_browser_mocks.mdx   |    2 +-
 api_docs/kbn_core_plugins_server.mdx          |    2 +-
 api_docs/kbn_core_plugins_server_mocks.mdx    |    2 +-
 api_docs/kbn_core_preboot_server.mdx          |    2 +-
 api_docs/kbn_core_preboot_server_mocks.mdx    |    2 +-
 api_docs/kbn_core_rendering_browser_mocks.mdx |    2 +-
 .../kbn_core_rendering_server_internal.mdx    |    2 +-
 api_docs/kbn_core_rendering_server_mocks.mdx  |    2 +-
 api_docs/kbn_core_root_server_internal.mdx    |    2 +-
 .../kbn_core_saved_objects_api_browser.mdx    |    2 +-
 .../kbn_core_saved_objects_api_server.mdx     |    2 +-
 ...core_saved_objects_api_server_internal.mdx |    2 +-
 ...bn_core_saved_objects_api_server_mocks.mdx |    2 +-
 ...ore_saved_objects_base_server_internal.mdx |    2 +-
 ...n_core_saved_objects_base_server_mocks.mdx |    2 +-
 api_docs/kbn_core_saved_objects_browser.mdx   |    2 +-
 ...bn_core_saved_objects_browser_internal.mdx |    2 +-
 .../kbn_core_saved_objects_browser_mocks.mdx  |    2 +-
 ...kbn_core_saved_objects_common.devdocs.json |   64 +
 api_docs/kbn_core_saved_objects_common.mdx    |    2 +-
 ..._objects_import_export_server_internal.mdx |    2 +-
 ...ved_objects_import_export_server_mocks.mdx |    2 +-
 ...aved_objects_migration_server_internal.mdx |    2 +-
 ...e_saved_objects_migration_server_mocks.mdx |    2 +-
 ...kbn_core_saved_objects_server.devdocs.json |   76 +
 api_docs/kbn_core_saved_objects_server.mdx    |    4 +-
 ...kbn_core_saved_objects_server_internal.mdx |    2 +-
 .../kbn_core_saved_objects_server_mocks.mdx   |    2 +-
 .../kbn_core_saved_objects_utils_server.mdx   |    2 +-
 api_docs/kbn_core_status_common.mdx           |    2 +-
 api_docs/kbn_core_status_common_internal.mdx  |    2 +-
 api_docs/kbn_core_status_server.mdx           |    2 +-
 api_docs/kbn_core_status_server_internal.mdx  |    2 +-
 api_docs/kbn_core_status_server_mocks.mdx     |    2 +-
 ...core_test_helpers_deprecations_getters.mdx |    2 +-
 ...n_core_test_helpers_http_setup_browser.mdx |    2 +-
 api_docs/kbn_core_test_helpers_kbn_server.mdx |    2 +-
 ...n_core_test_helpers_so_type_serializer.mdx |    2 +-
 ..._core_test_helpers_test_utils.devdocs.json |   78 +
 api_docs/kbn_core_test_helpers_test_utils.mdx |    4 +-
 api_docs/kbn_core_theme_browser.mdx           |    2 +-
 api_docs/kbn_core_theme_browser_internal.mdx  |    2 +-
 api_docs/kbn_core_theme_browser_mocks.mdx     |    2 +-
 api_docs/kbn_core_ui_settings_browser.mdx     |    2 +-
 .../kbn_core_ui_settings_browser_internal.mdx |    2 +-
 .../kbn_core_ui_settings_browser_mocks.mdx    |    2 +-
 api_docs/kbn_core_ui_settings_common.mdx      |    2 +-
 api_docs/kbn_core_ui_settings_server.mdx      |    2 +-
 .../kbn_core_ui_settings_server_internal.mdx  |    2 +-
 .../kbn_core_ui_settings_server_mocks.mdx     |    2 +-
 api_docs/kbn_core_usage_data_server.mdx       |    2 +-
 .../kbn_core_usage_data_server_internal.mdx   |    2 +-
 api_docs/kbn_core_usage_data_server_mocks.mdx |    2 +-
 api_docs/kbn_crypto.mdx                       |    2 +-
 api_docs/kbn_crypto_browser.mdx               |    2 +-
 api_docs/kbn_cypress_config.mdx               |    2 +-
 api_docs/kbn_datemath.mdx                     |    2 +-
 api_docs/kbn_dev_cli_errors.mdx               |    2 +-
 api_docs/kbn_dev_cli_runner.mdx               |    2 +-
 api_docs/kbn_dev_proc_runner.mdx              |    2 +-
 api_docs/kbn_dev_utils.mdx                    |    2 +-
 api_docs/kbn_doc_links.mdx                    |    2 +-
 api_docs/kbn_docs_utils.mdx                   |    2 +-
 api_docs/kbn_ebt_tools.mdx                    |    2 +-
 api_docs/kbn_ecs.mdx                          |    2 +-
 api_docs/kbn_es.mdx                           |    2 +-
 api_docs/kbn_es_archiver.mdx                  |    2 +-
 api_docs/kbn_es_errors.mdx                    |    2 +-
 api_docs/kbn_es_query.mdx                     |    2 +-
 api_docs/kbn_es_types.mdx                     |    2 +-
 api_docs/kbn_eslint_plugin_imports.mdx        |    2 +-
 api_docs/kbn_field_types.mdx                  |    2 +-
 api_docs/kbn_find_used_node_modules.mdx       |    2 +-
 .../kbn_ftr_common_functional_services.mdx    |    2 +-
 api_docs/kbn_generate.mdx                     |    2 +-
 api_docs/kbn_get_repo_files.mdx               |    2 +-
 api_docs/kbn_guided_onboarding.mdx            |    2 +-
 api_docs/kbn_handlebars.mdx                   |    2 +-
 api_docs/kbn_hapi_mocks.mdx                   |    2 +-
 api_docs/kbn_health_gateway_server.mdx        |    2 +-
 api_docs/kbn_home_sample_data_card.mdx        |    2 +-
 api_docs/kbn_home_sample_data_tab.mdx         |    2 +-
 api_docs/kbn_i18n.mdx                         |    2 +-
 api_docs/kbn_i18n_react.mdx                   |    2 +-
 api_docs/kbn_import_resolver.mdx              |    2 +-
 api_docs/kbn_interpreter.mdx                  |    2 +-
 api_docs/kbn_io_ts_utils.mdx                  |    2 +-
 api_docs/kbn_jest_serializers.mdx             |    2 +-
 api_docs/kbn_journeys.mdx                     |    2 +-
 api_docs/kbn_json_ast.mdx                     |    2 +-
 api_docs/kbn_kibana_manifest_schema.mdx       |    2 +-
 .../kbn_language_documentation_popover.mdx    |    2 +-
 api_docs/kbn_logging.mdx                      |    2 +-
 api_docs/kbn_logging_mocks.mdx                |    2 +-
 api_docs/kbn_managed_vscode_config.mdx        |    2 +-
 api_docs/kbn_mapbox_gl.mdx                    |    2 +-
 api_docs/kbn_ml_agg_utils.mdx                 |    2 +-
 api_docs/kbn_ml_date_picker.mdx               |    2 +-
 api_docs/kbn_ml_is_defined.mdx                |    2 +-
 api_docs/kbn_ml_is_populated_object.mdx       |    2 +-
 api_docs/kbn_ml_local_storage.mdx             |    2 +-
 api_docs/kbn_ml_nested_property.mdx           |    2 +-
 api_docs/kbn_ml_query_utils.mdx               |    2 +-
 api_docs/kbn_ml_string_hash.mdx               |    2 +-
 api_docs/kbn_ml_url_state.mdx                 |    2 +-
 api_docs/kbn_monaco.mdx                       |    2 +-
 api_docs/kbn_optimizer.mdx                    |    2 +-
 api_docs/kbn_optimizer_webpack_helpers.mdx    |    2 +-
 api_docs/kbn_osquery_io_ts_types.mdx          |    2 +-
 ..._performance_testing_dataset_extractor.mdx |    2 +-
 api_docs/kbn_plugin_generator.mdx             |    2 +-
 api_docs/kbn_plugin_helpers.mdx               |    2 +-
 api_docs/kbn_react_field.mdx                  |    2 +-
 api_docs/kbn_repo_file_maps.mdx               |    2 +-
 api_docs/kbn_repo_linter.mdx                  |    2 +-
 api_docs/kbn_repo_path.mdx                    |    2 +-
 api_docs/kbn_repo_source_classifier.mdx       |    2 +-
 api_docs/kbn_rison.mdx                        |    2 +-
 api_docs/kbn_rule_data_utils.devdocs.json     |   80 +-
 api_docs/kbn_rule_data_utils.mdx              |    4 +-
 .../kbn_securitysolution_autocomplete.mdx     |    2 +-
 .../kbn_securitysolution_ecs.devdocs.json     | 4948 +++++++++++++++++
 api_docs/kbn_securitysolution_ecs.mdx         |   36 +
 api_docs/kbn_securitysolution_es_utils.mdx    |    2 +-
 ...ion_exception_list_components.devdocs.json |    8 +-
 ...ritysolution_exception_list_components.mdx |    2 +-
 api_docs/kbn_securitysolution_hook_utils.mdx  |    2 +-
 ..._securitysolution_io_ts_alerting_types.mdx |    2 +-
 .../kbn_securitysolution_io_ts_list_types.mdx |    2 +-
 api_docs/kbn_securitysolution_io_ts_types.mdx |    2 +-
 api_docs/kbn_securitysolution_io_ts_utils.mdx |    2 +-
 api_docs/kbn_securitysolution_list_api.mdx    |    2 +-
 .../kbn_securitysolution_list_constants.mdx   |    2 +-
 api_docs/kbn_securitysolution_list_hooks.mdx  |    2 +-
 api_docs/kbn_securitysolution_list_utils.mdx  |    2 +-
 api_docs/kbn_securitysolution_rules.mdx       |    2 +-
 api_docs/kbn_securitysolution_t_grid.mdx      |    2 +-
 api_docs/kbn_securitysolution_utils.mdx       |    2 +-
 api_docs/kbn_server_http_tools.mdx            |    2 +-
 api_docs/kbn_server_route_repository.mdx      |    2 +-
 api_docs/kbn_shared_svg.mdx                   |    2 +-
 api_docs/kbn_shared_ux_avatar_solution.mdx    |    2 +-
 ...ared_ux_avatar_user_profile_components.mdx |    2 +-
 .../kbn_shared_ux_button_exit_full_screen.mdx |    2 +-
 ...hared_ux_button_exit_full_screen_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_button_toolbar.mdx     |    2 +-
 api_docs/kbn_shared_ux_card_no_data.mdx       |    2 +-
 api_docs/kbn_shared_ux_card_no_data_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_file_context.mdx       |    2 +-
 api_docs/kbn_shared_ux_file_image.mdx         |    2 +-
 api_docs/kbn_shared_ux_file_image_mocks.mdx   |    2 +-
 api_docs/kbn_shared_ux_file_mocks.mdx         |    2 +-
 api_docs/kbn_shared_ux_file_picker.mdx        |    2 +-
 api_docs/kbn_shared_ux_file_upload.mdx        |    2 +-
 api_docs/kbn_shared_ux_file_util.mdx          |    2 +-
 api_docs/kbn_shared_ux_link_redirect_app.mdx  |    2 +-
 .../kbn_shared_ux_link_redirect_app_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_markdown.mdx           |    2 +-
 api_docs/kbn_shared_ux_markdown_mocks.mdx     |    2 +-
 .../kbn_shared_ux_page_analytics_no_data.mdx  |    2 +-
 ...shared_ux_page_analytics_no_data_mocks.mdx |    2 +-
 .../kbn_shared_ux_page_kibana_no_data.mdx     |    2 +-
 ...bn_shared_ux_page_kibana_no_data_mocks.mdx |    2 +-
 .../kbn_shared_ux_page_kibana_template.mdx    |    2 +-
 ...n_shared_ux_page_kibana_template_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_page_no_data.mdx       |    2 +-
 .../kbn_shared_ux_page_no_data_config.mdx     |    2 +-
 ...bn_shared_ux_page_no_data_config_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_page_no_data_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_page_solution_nav.mdx  |    2 +-
 .../kbn_shared_ux_prompt_no_data_views.mdx    |    2 +-
 ...n_shared_ux_prompt_no_data_views_mocks.mdx |    2 +-
 api_docs/kbn_shared_ux_prompt_not_found.mdx   |    2 +-
 api_docs/kbn_shared_ux_router.mdx             |    2 +-
 api_docs/kbn_shared_ux_router_mocks.mdx       |    2 +-
 api_docs/kbn_shared_ux_storybook_config.mdx   |    2 +-
 api_docs/kbn_shared_ux_storybook_mock.mdx     |    2 +-
 api_docs/kbn_shared_ux_utility.mdx            |    2 +-
 api_docs/kbn_slo_schema.mdx                   |    2 +-
 api_docs/kbn_some_dev_log.mdx                 |    2 +-
 api_docs/kbn_std.mdx                          |    2 +-
 api_docs/kbn_stdio_dev_helpers.mdx            |    2 +-
 api_docs/kbn_storybook.mdx                    |    2 +-
 api_docs/kbn_telemetry_tools.mdx              |    2 +-
 api_docs/kbn_test.mdx                         |    2 +-
 api_docs/kbn_test_jest_helpers.mdx            |    2 +-
 api_docs/kbn_test_subj_selector.mdx           |    2 +-
 api_docs/kbn_tooling_log.mdx                  |    2 +-
 api_docs/kbn_ts_projects.mdx                  |    2 +-
 api_docs/kbn_typed_react_router_config.mdx    |    2 +-
 api_docs/kbn_ui_actions_browser.mdx           |    2 +-
 api_docs/kbn_ui_shared_deps_src.mdx           |    2 +-
 api_docs/kbn_ui_theme.mdx                     |    2 +-
 api_docs/kbn_user_profile_components.mdx      |    2 +-
 api_docs/kbn_utility_types.mdx                |    2 +-
 api_docs/kbn_utility_types_jest.mdx           |    2 +-
 api_docs/kbn_utils.mdx                        |    2 +-
 api_docs/kbn_yarn_lock_validator.mdx          |    2 +-
 api_docs/kibana_overview.mdx                  |    2 +-
 api_docs/kibana_react.devdocs.json            |   24 -
 api_docs/kibana_react.mdx                     |    2 +-
 api_docs/kibana_utils.mdx                     |    2 +-
 api_docs/kubernetes_security.mdx              |    2 +-
 api_docs/lens.devdocs.json                    |  245 +-
 api_docs/lens.mdx                             |    4 +-
 api_docs/license_api_guard.mdx                |    2 +-
 api_docs/license_management.mdx               |    2 +-
 api_docs/licensing.mdx                        |    2 +-
 api_docs/lists.mdx                            |    2 +-
 api_docs/management.mdx                       |    2 +-
 api_docs/maps.mdx                             |    2 +-
 api_docs/maps_ems.mdx                         |    2 +-
 api_docs/ml.mdx                               |    2 +-
 api_docs/monitoring.mdx                       |    2 +-
 api_docs/monitoring_collection.mdx            |    2 +-
 api_docs/navigation.mdx                       |    2 +-
 api_docs/newsfeed.mdx                         |    2 +-
 api_docs/notifications.mdx                    |    2 +-
 api_docs/observability.mdx                    |    2 +-
 api_docs/osquery.mdx                          |    2 +-
 api_docs/plugin_directory.mdx                 |   31 +-
 api_docs/presentation_util.mdx                |    2 +-
 api_docs/profiling.mdx                        |    2 +-
 api_docs/remote_clusters.mdx                  |    2 +-
 api_docs/reporting.mdx                        |    2 +-
 api_docs/rollup.mdx                           |    2 +-
 api_docs/rule_registry.devdocs.json           |    6 +-
 api_docs/rule_registry.mdx                    |    2 +-
 api_docs/runtime_fields.mdx                   |    2 +-
 api_docs/saved_objects.mdx                    |    2 +-
 api_docs/saved_objects_finder.mdx             |    2 +-
 api_docs/saved_objects_management.mdx         |    2 +-
 api_docs/saved_objects_tagging.mdx            |    2 +-
 api_docs/saved_objects_tagging_oss.mdx        |    2 +-
 api_docs/saved_search.mdx                     |    2 +-
 api_docs/screenshot_mode.mdx                  |    2 +-
 api_docs/screenshotting.mdx                   |    2 +-
 api_docs/security.mdx                         |    2 +-
 api_docs/security_solution.mdx                |    2 +-
 api_docs/session_view.mdx                     |    2 +-
 api_docs/share.mdx                            |    2 +-
 api_docs/snapshot_restore.mdx                 |    2 +-
 api_docs/spaces.mdx                           |    2 +-
 api_docs/stack_alerts.mdx                     |    2 +-
 api_docs/stack_connectors.mdx                 |    2 +-
 api_docs/task_manager.mdx                     |    2 +-
 api_docs/telemetry.mdx                        |    2 +-
 api_docs/telemetry_collection_manager.mdx     |    2 +-
 api_docs/telemetry_collection_xpack.mdx       |    2 +-
 api_docs/telemetry_management_section.mdx     |    2 +-
 api_docs/threat_intelligence.mdx              |    2 +-
 api_docs/timelines.devdocs.json               |   56 +-
 api_docs/timelines.mdx                        |    4 +-
 api_docs/transform.mdx                        |    2 +-
 api_docs/triggers_actions_ui.devdocs.json     |    2 +-
 api_docs/triggers_actions_ui.mdx              |    2 +-
 api_docs/ui_actions.mdx                       |    2 +-
 api_docs/ui_actions_enhanced.mdx              |    2 +-
 api_docs/unified_field_list.mdx               |    2 +-
 api_docs/unified_histogram.mdx                |    2 +-
 api_docs/unified_search.mdx                   |    2 +-
 api_docs/unified_search_autocomplete.mdx      |    2 +-
 api_docs/url_forwarding.mdx                   |    2 +-
 api_docs/usage_collection.mdx                 |    2 +-
 api_docs/ux.mdx                               |    2 +-
 api_docs/vis_default_editor.mdx               |    2 +-
 api_docs/vis_type_gauge.mdx                   |    2 +-
 api_docs/vis_type_heatmap.mdx                 |    2 +-
 api_docs/vis_type_pie.mdx                     |    2 +-
 api_docs/vis_type_table.mdx                   |    2 +-
 api_docs/vis_type_timelion.mdx                |    2 +-
 api_docs/vis_type_timeseries.mdx              |    2 +-
 api_docs/vis_type_vega.mdx                    |    2 +-
 api_docs/vis_type_vislib.mdx                  |    2 +-
 api_docs/vis_type_xy.mdx                      |    2 +-
 api_docs/visualizations.devdocs.json          |    4 +-
 api_docs/visualizations.mdx                   |    2 +-
 495 files changed, 8349 insertions(+), 798 deletions(-)
 create mode 100644 api_docs/kbn_securitysolution_ecs.devdocs.json
 create mode 100644 api_docs/kbn_securitysolution_ecs.mdx

diff --git a/api_docs/actions.devdocs.json b/api_docs/actions.devdocs.json
index 16ef1ac715e6e6..a83fdd9ed6bfc0 100644
--- a/api_docs/actions.devdocs.json
+++ b/api_docs/actions.devdocs.json
@@ -1941,7 +1941,7 @@
           "ActionTypeConfig",
           ">>; execute: ({ actionId, params, source, relatedSavedObjects, }: Omit<",
           "ExecuteOptions",
-          "<unknown>, \"request\">) => Promise<",
+          "<unknown>, \"request\" | \"actionExecutionId\">) => Promise<",
           {
             "pluginId": "actions",
             "scope": "common",
@@ -1991,7 +1991,31 @@
             "section": "def-common.ActionType",
             "text": "ActionType"
           },
-          "[]>; isActionTypeEnabled: (actionTypeId: string, options?: { notifyUsage: boolean; }) => boolean; isPreconfigured: (connectorId: string) => boolean; }"
+          "[]>; isActionTypeEnabled: (actionTypeId: string, options?: { notifyUsage: boolean; }) => boolean; isPreconfigured: (connectorId: string) => boolean; getGlobalExecutionLogWithAuth: ({ dateStart, dateEnd, filter, page, perPage, sort, namespaces, }: ",
+          {
+            "pluginId": "actions",
+            "scope": "common",
+            "docId": "kibActionsPluginApi",
+            "section": "def-common.GetGlobalExecutionLogParams",
+            "text": "GetGlobalExecutionLogParams"
+          },
+          ") => Promise<",
+          {
+            "pluginId": "actions",
+            "scope": "common",
+            "docId": "kibActionsPluginApi",
+            "section": "def-common.IExecutionLogResult",
+            "text": "IExecutionLogResult"
+          },
+          ">; getGlobalExecutionKpiWithAuth: ({ dateStart, dateEnd, filter, namespaces, }: ",
+          {
+            "pluginId": "actions",
+            "scope": "common",
+            "docId": "kibActionsPluginApi",
+            "section": "def-common.GetGlobalExecutionKPIParams",
+            "text": "GetGlobalExecutionKPIParams"
+          },
+          ") => Promise<{ success: number; unknown: number; failure: number; warning: number; }>; }"
         ],
         "path": "x-pack/plugins/actions/server/index.ts",
         "deprecated": false,
@@ -3259,6 +3283,363 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "actions",
+        "id": "def-common.GetGlobalExecutionKPIParams",
+        "type": "Interface",
+        "tags": [],
+        "label": "GetGlobalExecutionKPIParams",
+        "description": [],
+        "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.GetGlobalExecutionKPIParams.dateStart",
+            "type": "string",
+            "tags": [],
+            "label": "dateStart",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.GetGlobalExecutionKPIParams.dateEnd",
+            "type": "string",
+            "tags": [],
+            "label": "dateEnd",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.GetGlobalExecutionKPIParams.filter",
+            "type": "string",
+            "tags": [],
+            "label": "filter",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.GetGlobalExecutionKPIParams.namespaces",
+            "type": "Array",
+            "tags": [],
+            "label": "namespaces",
+            "description": [],
+            "signature": [
+              "(string | undefined)[] | undefined"
+            ],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "actions",
+        "id": "def-common.GetGlobalExecutionLogParams",
+        "type": "Interface",
+        "tags": [],
+        "label": "GetGlobalExecutionLogParams",
+        "description": [],
+        "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.GetGlobalExecutionLogParams.dateStart",
+            "type": "string",
+            "tags": [],
+            "label": "dateStart",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.GetGlobalExecutionLogParams.dateEnd",
+            "type": "string",
+            "tags": [],
+            "label": "dateEnd",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.GetGlobalExecutionLogParams.filter",
+            "type": "string",
+            "tags": [],
+            "label": "filter",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.GetGlobalExecutionLogParams.page",
+            "type": "number",
+            "tags": [],
+            "label": "page",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.GetGlobalExecutionLogParams.perPage",
+            "type": "number",
+            "tags": [],
+            "label": "perPage",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.GetGlobalExecutionLogParams.sort",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "sort",
+            "description": [],
+            "signature": [
+              "SortCombinations",
+              " | ",
+              "SortCombinations",
+              "[]"
+            ],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.GetGlobalExecutionLogParams.namespaces",
+            "type": "Array",
+            "tags": [],
+            "label": "namespaces",
+            "description": [],
+            "signature": [
+              "(string | undefined)[] | undefined"
+            ],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "actions",
+        "id": "def-common.IExecutionLog",
+        "type": "Interface",
+        "tags": [],
+        "label": "IExecutionLog",
+        "description": [],
+        "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLog.id",
+            "type": "string",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLog.timestamp",
+            "type": "string",
+            "tags": [],
+            "label": "timestamp",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLog.duration_ms",
+            "type": "number",
+            "tags": [],
+            "label": "duration_ms",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLog.status",
+            "type": "string",
+            "tags": [],
+            "label": "status",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLog.message",
+            "type": "string",
+            "tags": [],
+            "label": "message",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLog.version",
+            "type": "string",
+            "tags": [],
+            "label": "version",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLog.schedule_delay_ms",
+            "type": "number",
+            "tags": [],
+            "label": "schedule_delay_ms",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLog.space_ids",
+            "type": "Array",
+            "tags": [],
+            "label": "space_ids",
+            "description": [],
+            "signature": [
+              "string[]"
+            ],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLog.connector_name",
+            "type": "string",
+            "tags": [],
+            "label": "connector_name",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLog.connector_id",
+            "type": "string",
+            "tags": [],
+            "label": "connector_id",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLog.timed_out",
+            "type": "boolean",
+            "tags": [],
+            "label": "timed_out",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "actions",
+        "id": "def-common.IExecutionLogResult",
+        "type": "Interface",
+        "tags": [],
+        "label": "IExecutionLogResult",
+        "description": [],
+        "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLogResult.total",
+            "type": "number",
+            "tags": [],
+            "label": "total",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.IExecutionLogResult.data",
+            "type": "Array",
+            "tags": [],
+            "label": "data",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "actions",
+                "scope": "common",
+                "docId": "kibActionsPluginApi",
+                "section": "def-common.IExecutionLog",
+                "text": "IExecutionLog"
+              },
+              "[]"
+            ],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "actions",
         "id": "def-common.ValidatedEmail",
@@ -3518,6 +3899,36 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "actions",
+        "id": "def-common.ExecutionLogSortFields",
+        "type": "Type",
+        "tags": [],
+        "label": "ExecutionLogSortFields",
+        "description": [],
+        "signature": [
+          "\"timestamp\" | \"execution_duration\" | \"schedule_delay\""
+        ],
+        "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "actions",
+        "id": "def-common.IExecutionKPIResult",
+        "type": "Type",
+        "tags": [],
+        "label": "IExecutionKPIResult",
+        "description": [],
+        "signature": [
+          "{ success: number; unknown: number; failure: number; warning: number; }"
+        ],
+        "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "actions",
         "id": "def-common.INTERNAL_BASE_ACTION_API_PATH",
@@ -3759,6 +4170,79 @@
         ],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "actions",
+        "id": "def-common.EMPTY_EXECUTION_KPI_RESULT",
+        "type": "Object",
+        "tags": [],
+        "label": "EMPTY_EXECUTION_KPI_RESULT",
+        "description": [],
+        "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.EMPTY_EXECUTION_KPI_RESULT.success",
+            "type": "number",
+            "tags": [],
+            "label": "success",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.EMPTY_EXECUTION_KPI_RESULT.unknown",
+            "type": "number",
+            "tags": [],
+            "label": "unknown",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.EMPTY_EXECUTION_KPI_RESULT.failure",
+            "type": "number",
+            "tags": [],
+            "label": "failure",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "actions",
+            "id": "def-common.EMPTY_EXECUTION_KPI_RESULT.warning",
+            "type": "number",
+            "tags": [],
+            "label": "warning",
+            "description": [],
+            "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "actions",
+        "id": "def-common.executionLogSortableColumns",
+        "type": "Object",
+        "tags": [],
+        "label": "executionLogSortableColumns",
+        "description": [],
+        "signature": [
+          "readonly [\"timestamp\", \"execution_duration\", \"schedule_delay\"]"
+        ],
+        "path": "x-pack/plugins/actions/common/execution_log_types.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "actions",
         "id": "def-common.MustacheInEmailRegExp",
diff --git a/api_docs/actions.mdx b/api_docs/actions.mdx
index 882757a213a9fc..ee662b9c894721 100644
--- a/api_docs/actions.mdx
+++ b/api_docs/actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/actions
 title: "actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the actions plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'actions']
 ---
 import actionsObj from './actions.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Response Ops](https://github.com/orgs/elastic/teams/response-ops) for q
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 220 | 8 | 215 | 24 |
+| 256 | 8 | 251 | 24 |
 
 ## Client
 
diff --git a/api_docs/advanced_settings.mdx b/api_docs/advanced_settings.mdx
index d502783f4a86bb..4b62794804f096 100644
--- a/api_docs/advanced_settings.mdx
+++ b/api_docs/advanced_settings.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/advancedSettings
 title: "advancedSettings"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the advancedSettings plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'advancedSettings']
 ---
 import advancedSettingsObj from './advanced_settings.devdocs.json';
diff --git a/api_docs/aiops.mdx b/api_docs/aiops.mdx
index b7fca969b62146..efc8fee440e655 100644
--- a/api_docs/aiops.mdx
+++ b/api_docs/aiops.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/aiops
 title: "aiops"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the aiops plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'aiops']
 ---
 import aiopsObj from './aiops.devdocs.json';
diff --git a/api_docs/alerting.devdocs.json b/api_docs/alerting.devdocs.json
index f3f981432d60d9..598360a4ad3e4d 100644
--- a/api_docs/alerting.devdocs.json
+++ b/api_docs/alerting.devdocs.json
@@ -565,14 +565,6 @@
               ", filterOpts: ",
               "AlertingAuthorizationFilterOpts",
               ") => Promise<{ filter?: ",
-              {
-                "pluginId": "@kbn/utility-types",
-                "scope": "common",
-                "docId": "kibKbnUtilityTypesPluginApi",
-                "section": "def-common.JsonObject",
-                "text": "JsonObject"
-              },
-              " | ",
               {
                 "pluginId": "@kbn/es-query",
                 "scope": "common",
@@ -580,6 +572,14 @@
                 "section": "def-common.KueryNode",
                 "text": "KueryNode"
               },
+              " | ",
+              {
+                "pluginId": "@kbn/utility-types",
+                "scope": "common",
+                "docId": "kibKbnUtilityTypesPluginApi",
+                "section": "def-common.JsonObject",
+                "text": "JsonObject"
+              },
               " | undefined; ensureRuleTypeIsAuthorized: (ruleTypeId: string, consumer: string, auth: string) => void; }>"
             ],
             "path": "x-pack/plugins/alerting/server/authorization/alerting_authorization.ts",
@@ -660,14 +660,6 @@
                 "text": "WriteOperations"
               },
               ") => Promise<{ filter?: ",
-              {
-                "pluginId": "@kbn/utility-types",
-                "scope": "common",
-                "docId": "kibKbnUtilityTypesPluginApi",
-                "section": "def-common.JsonObject",
-                "text": "JsonObject"
-              },
-              " | ",
               {
                 "pluginId": "@kbn/es-query",
                 "scope": "common",
@@ -675,6 +667,14 @@
                 "section": "def-common.KueryNode",
                 "text": "KueryNode"
               },
+              " | ",
+              {
+                "pluginId": "@kbn/utility-types",
+                "scope": "common",
+                "docId": "kibKbnUtilityTypesPluginApi",
+                "section": "def-common.JsonObject",
+                "text": "JsonObject"
+              },
               " | undefined; ensureRuleTypeIsAuthorized: (ruleTypeId: string, consumer: string, auth: string) => void; }>"
             ],
             "path": "x-pack/plugins/alerting/server/authorization/alerting_authorization.ts",
@@ -2919,6 +2919,37 @@
             "path": "x-pack/plugins/alerting/server/types.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-server.RuleType.alerts",
+            "type": "Object",
+            "tags": [],
+            "label": "alerts",
+            "description": [],
+            "signature": [
+              "IRuleTypeAlerts",
+              " | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "alerting",
+            "id": "def-server.RuleType.autoRecoverAlerts",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "autoRecoverAlerts",
+            "description": [
+              "\nDetermines whether framework should\nautomatically make recovery determination. Defaults to true."
+            ],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "x-pack/plugins/alerting/server/types.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
@@ -3381,30 +3412,32 @@
             "section": "def-common.SanitizedRule",
             "text": "SanitizedRule"
           },
-          "<Params>>; muteAll: (options: { id: string; }) => Promise<void>; getAlertState: (params: ",
-          "GetAlertStateParams",
-          ") => Promise<void | { alertTypeState?: { [x: string]: unknown; } | undefined; alertInstances?: { [x: string]: { state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; } | undefined; }; } | undefined; alertRecoveredInstances?: { [x: string]: { state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; } | undefined; }; } | undefined; previousStartedAt?: Date | null | undefined; summaryActions?: { [x: string]: { date: Date; }; } | undefined; }>; getAlertSummary: (params: ",
-          "GetAlertSummaryParams",
+          "<Params>>; getGlobalExecutionLogWithAuth: (params: ",
+          "GetGlobalExecutionLogParams",
           ") => Promise<",
           {
             "pluginId": "alerting",
             "scope": "common",
             "docId": "kibAlertingPluginApi",
-            "section": "def-common.AlertSummary",
-            "text": "AlertSummary"
+            "section": "def-common.IExecutionLogResult",
+            "text": "IExecutionLogResult"
           },
-          ">; getExecutionLogForRule: (params: ",
-          "GetExecutionLogByIdParams",
+          ">; getGlobalExecutionKpiWithAuth: (params: ",
+          "GetGlobalExecutionKPIParams",
+          ") => Promise<{ success: number; unknown: number; failure: number; warning: number; activeAlerts: number; newAlerts: number; recoveredAlerts: number; erroredActions: number; triggeredActions: number; }>; muteAll: (options: { id: string; }) => Promise<void>; getAlertState: (params: ",
+          "GetAlertStateParams",
+          ") => Promise<void | { alertTypeState?: { [x: string]: unknown; } | undefined; alertInstances?: { [x: string]: { state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; pendingRecoveredCount?: number | undefined; } | undefined; }; } | undefined; alertRecoveredInstances?: { [x: string]: { state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; pendingRecoveredCount?: number | undefined; } | undefined; }; } | undefined; previousStartedAt?: Date | null | undefined; summaryActions?: { [x: string]: { date: Date; }; } | undefined; }>; getAlertSummary: (params: ",
+          "GetAlertSummaryParams",
           ") => Promise<",
           {
             "pluginId": "alerting",
             "scope": "common",
             "docId": "kibAlertingPluginApi",
-            "section": "def-common.IExecutionLogResult",
-            "text": "IExecutionLogResult"
+            "section": "def-common.AlertSummary",
+            "text": "AlertSummary"
           },
-          ">; getGlobalExecutionLogWithAuth: (params: ",
-          "GetGlobalExecutionLogParams",
+          ">; getExecutionLogForRule: (params: ",
+          "GetExecutionLogByIdParams",
           ") => Promise<",
           {
             "pluginId": "alerting",
@@ -3415,8 +3448,6 @@
           },
           ">; getRuleExecutionKPI: (params: ",
           "GetRuleExecutionKPIParams",
-          ") => Promise<{ success: number; unknown: number; failure: number; warning: number; activeAlerts: number; newAlerts: number; recoveredAlerts: number; erroredActions: number; triggeredActions: number; }>; getGlobalExecutionKpiWithAuth: (params: ",
-          "GetGlobalExecutionKPIParams",
           ") => Promise<{ success: number; unknown: number; failure: number; warning: number; activeAlerts: number; newAlerts: number; recoveredAlerts: number; erroredActions: number; triggeredActions: number; }>; getActionErrorLog: (params: ",
           "GetActionErrorLogByIdParams",
           ") => Promise<",
@@ -7145,7 +7176,7 @@
         "label": "AlertInstanceMeta",
         "description": [],
         "signature": [
-          "{ lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; }"
+          "{ lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; pendingRecoveredCount?: number | undefined; }"
         ],
         "path": "x-pack/plugins/alerting/common/alert_instance.ts",
         "deprecated": false,
@@ -7295,7 +7326,7 @@
         "label": "ExecutionLogSortFields",
         "description": [],
         "signature": [
-          "\"timestamp\" | \"execution_duration\" | \"total_search_duration\" | \"es_search_duration\" | \"schedule_delay\" | \"num_triggered_actions\" | \"num_generated_actions\" | \"num_active_alerts\" | \"num_recovered_alerts\" | \"num_new_alerts\""
+          "\"timestamp\" | \"execution_duration\" | \"schedule_delay\" | \"total_search_duration\" | \"es_search_duration\" | \"num_triggered_actions\" | \"num_generated_actions\" | \"num_active_alerts\" | \"num_recovered_alerts\" | \"num_new_alerts\""
         ],
         "path": "x-pack/plugins/alerting/common/execution_log_types.ts",
         "deprecated": false,
@@ -7474,7 +7505,7 @@
         "label": "RawAlertInstance",
         "description": [],
         "signature": [
-          "{ state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; } | undefined; }"
+          "{ state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; pendingRecoveredCount?: number | undefined; } | undefined; }"
         ],
         "path": "x-pack/plugins/alerting/common/alert_instance.ts",
         "deprecated": false,
@@ -7823,7 +7854,7 @@
         "label": "RuleTaskState",
         "description": [],
         "signature": [
-          "{ alertTypeState?: { [x: string]: unknown; } | undefined; alertInstances?: { [x: string]: { state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; } | undefined; }; } | undefined; alertRecoveredInstances?: { [x: string]: { state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; } | undefined; }; } | undefined; previousStartedAt?: Date | null | undefined; summaryActions?: { [x: string]: { date: Date; }; } | undefined; }"
+          "{ alertTypeState?: { [x: string]: unknown; } | undefined; alertInstances?: { [x: string]: { state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; pendingRecoveredCount?: number | undefined; } | undefined; }; } | undefined; alertRecoveredInstances?: { [x: string]: { state?: { [x: string]: unknown; } | undefined; meta?: { lastScheduledActions?: ({ subgroup?: string | undefined; } & { group: string; date: Date; } & { actions?: { [x: string]: { date: Date; }; } | undefined; }) | undefined; flappingHistory?: boolean[] | undefined; flapping?: boolean | undefined; pendingRecoveredCount?: number | undefined; } | undefined; }; } | undefined; previousStartedAt?: Date | null | undefined; summaryActions?: { [x: string]: { date: Date; }; } | undefined; }"
         ],
         "path": "x-pack/plugins/alerting/common/rule_task_instance.ts",
         "deprecated": false,
@@ -8265,6 +8296,8 @@
           "BooleanC",
           ">; flapping: ",
           "BooleanC",
+          "; pendingRecoveredCount: ",
+          "NumberC",
           "; }>; }>"
         ],
         "path": "x-pack/plugins/alerting/common/alert_instance.ts",
@@ -8413,6 +8446,8 @@
           "BooleanC",
           ">; flapping: ",
           "BooleanC",
+          "; pendingRecoveredCount: ",
+          "NumberC",
           "; }>; }>>; alertRecoveredInstances: ",
           "RecordC",
           "<",
@@ -8455,6 +8490,8 @@
           "BooleanC",
           ">; flapping: ",
           "BooleanC",
+          "; pendingRecoveredCount: ",
+          "NumberC",
           "; }>; }>>; previousStartedAt: ",
           "UnionC",
           "<[",
diff --git a/api_docs/alerting.mdx b/api_docs/alerting.mdx
index 4b8d8e6b88320e..a9f9c13e7a73ab 100644
--- a/api_docs/alerting.mdx
+++ b/api_docs/alerting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/alerting
 title: "alerting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the alerting plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'alerting']
 ---
 import alertingObj from './alerting.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Response Ops](https://github.com/orgs/elastic/teams/response-ops) for q
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 465 | 0 | 456 | 38 |
+| 467 | 0 | 457 | 39 |
 
 ## Client
 
diff --git a/api_docs/apm.mdx b/api_docs/apm.mdx
index b575f13b49d632..6795d650c6d275 100644
--- a/api_docs/apm.mdx
+++ b/api_docs/apm.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/apm
 title: "apm"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the apm plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apm']
 ---
 import apmObj from './apm.devdocs.json';
diff --git a/api_docs/banners.mdx b/api_docs/banners.mdx
index a6372c2ec5f9be..7f6d19eb01edfa 100644
--- a/api_docs/banners.mdx
+++ b/api_docs/banners.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/banners
 title: "banners"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the banners plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'banners']
 ---
 import bannersObj from './banners.devdocs.json';
diff --git a/api_docs/bfetch.mdx b/api_docs/bfetch.mdx
index b8d69c68892bf6..b42b0468a7dc70 100644
--- a/api_docs/bfetch.mdx
+++ b/api_docs/bfetch.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/bfetch
 title: "bfetch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the bfetch plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'bfetch']
 ---
 import bfetchObj from './bfetch.devdocs.json';
diff --git a/api_docs/canvas.mdx b/api_docs/canvas.mdx
index ea4a8dbdd7112b..20c1b790925391 100644
--- a/api_docs/canvas.mdx
+++ b/api_docs/canvas.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/canvas
 title: "canvas"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the canvas plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'canvas']
 ---
 import canvasObj from './canvas.devdocs.json';
diff --git a/api_docs/cases.mdx b/api_docs/cases.mdx
index 32c6dfabc03080..697aeac4481004 100644
--- a/api_docs/cases.mdx
+++ b/api_docs/cases.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cases
 title: "cases"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cases plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cases']
 ---
 import casesObj from './cases.devdocs.json';
diff --git a/api_docs/charts.mdx b/api_docs/charts.mdx
index 7c47818af3acb6..92f9b58fbf61e8 100644
--- a/api_docs/charts.mdx
+++ b/api_docs/charts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/charts
 title: "charts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the charts plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'charts']
 ---
 import chartsObj from './charts.devdocs.json';
diff --git a/api_docs/cloud.mdx b/api_docs/cloud.mdx
index be71624edcd067..719e85fbca149e 100644
--- a/api_docs/cloud.mdx
+++ b/api_docs/cloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloud
 title: "cloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloud plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloud']
 ---
 import cloudObj from './cloud.devdocs.json';
diff --git a/api_docs/cloud_chat.mdx b/api_docs/cloud_chat.mdx
index c10c892a4b31cc..07861197c1a9dc 100644
--- a/api_docs/cloud_chat.mdx
+++ b/api_docs/cloud_chat.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudChat
 title: "cloudChat"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudChat plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudChat']
 ---
 import cloudChatObj from './cloud_chat.devdocs.json';
diff --git a/api_docs/cloud_data_migration.mdx b/api_docs/cloud_data_migration.mdx
index 9bf47c37698c2a..9aff276af60f40 100644
--- a/api_docs/cloud_data_migration.mdx
+++ b/api_docs/cloud_data_migration.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDataMigration
 title: "cloudDataMigration"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDataMigration plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDataMigration']
 ---
 import cloudDataMigrationObj from './cloud_data_migration.devdocs.json';
diff --git a/api_docs/cloud_defend.mdx b/api_docs/cloud_defend.mdx
index 39e865fca5b5d1..2799b15be23807 100644
--- a/api_docs/cloud_defend.mdx
+++ b/api_docs/cloud_defend.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDefend
 title: "cloudDefend"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudDefend plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDefend']
 ---
 import cloudDefendObj from './cloud_defend.devdocs.json';
diff --git a/api_docs/cloud_experiments.mdx b/api_docs/cloud_experiments.mdx
index 50eaedaa2b4f23..de3eb208301c48 100644
--- a/api_docs/cloud_experiments.mdx
+++ b/api_docs/cloud_experiments.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudExperiments
 title: "cloudExperiments"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudExperiments plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudExperiments']
 ---
 import cloudExperimentsObj from './cloud_experiments.devdocs.json';
diff --git a/api_docs/cloud_security_posture.mdx b/api_docs/cloud_security_posture.mdx
index 83610a7d6125c1..1e38856df3e4dd 100644
--- a/api_docs/cloud_security_posture.mdx
+++ b/api_docs/cloud_security_posture.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudSecurityPosture
 title: "cloudSecurityPosture"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the cloudSecurityPosture plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudSecurityPosture']
 ---
 import cloudSecurityPostureObj from './cloud_security_posture.devdocs.json';
diff --git a/api_docs/console.mdx b/api_docs/console.mdx
index 4e396919c5d5a8..560bdbe4cb872b 100644
--- a/api_docs/console.mdx
+++ b/api_docs/console.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/console
 title: "console"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the console plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'console']
 ---
 import consoleObj from './console.devdocs.json';
diff --git a/api_docs/controls.mdx b/api_docs/controls.mdx
index 6071894e19c6b0..b61657e794017c 100644
--- a/api_docs/controls.mdx
+++ b/api_docs/controls.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/controls
 title: "controls"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the controls plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'controls']
 ---
 import controlsObj from './controls.devdocs.json';
diff --git a/api_docs/core.devdocs.json b/api_docs/core.devdocs.json
index f8065754bc0201..56a598e85ddc6c 100644
--- a/api_docs/core.devdocs.json
+++ b/api_docs/core.devdocs.json
@@ -8226,6 +8226,14 @@
                 "plugin": "fleet",
                 "path": "x-pack/plugins/fleet/server/services/telemetry/fleet_usage_sender.ts"
               },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_client.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_client.ts"
+              },
               {
                 "plugin": "osquery",
                 "path": "x-pack/plugins/osquery/server/lib/telemetry/sender.ts"
@@ -8438,6 +8446,30 @@
                 "plugin": "security",
                 "path": "x-pack/plugins/security/server/analytics/analytics_service.test.ts"
               },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
               {
                 "plugin": "@kbn/core-status-server-internal",
                 "path": "packages/core/status/core-status-server-internal/src/status_service.test.ts"
@@ -21700,6 +21732,18 @@
             "plugin": "cases",
             "path": "x-pack/plugins/cases/server/common/types.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
           {
             "plugin": "synthetics",
             "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts"
@@ -21772,6 +21816,50 @@
             "plugin": "alerting",
             "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
           {
             "plugin": "fleet",
             "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts"
@@ -23637,6 +23725,14 @@
             "plugin": "lens",
             "path": "x-pack/plugins/lens/public/app_plugin/share_action.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
           {
             "plugin": "@kbn/core-saved-objects-api-server-internal",
             "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts"
@@ -37469,6 +37565,14 @@
                 "plugin": "fleet",
                 "path": "x-pack/plugins/fleet/server/services/telemetry/fleet_usage_sender.ts"
               },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_client.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_client.ts"
+              },
               {
                 "plugin": "osquery",
                 "path": "x-pack/plugins/osquery/server/lib/telemetry/sender.ts"
@@ -37681,6 +37785,30 @@
                 "plugin": "security",
                 "path": "x-pack/plugins/security/server/analytics/analytics_service.test.ts"
               },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
               {
                 "plugin": "@kbn/core-status-server-internal",
                 "path": "packages/core/status/core-status-server-internal/src/status_service.test.ts"
@@ -45224,6 +45352,32 @@
             "children": [],
             "returnComment": []
           },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.ISavedObjectTypeRegistry.getVisibleToHttpApisTypes",
+            "type": "Function",
+            "tags": [],
+            "label": "getVisibleToHttpApisTypes",
+            "description": [
+              "\nReturns all visible {@link SavedObjectsType | types} exposed to the global SO HTTP APIs\n\nA visibleToHttpApis type is a type that doesn't explicitly define `hidden=true` nor `hiddenFromHttpApis=true` during registration."
+            ],
+            "signature": [
+              "() => ",
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectsType",
+                "text": "SavedObjectsType"
+              },
+              "<any>[]"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/type_registry.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
           {
             "parentPluginId": "core",
             "id": "def-server.ISavedObjectTypeRegistry.getAllTypes",
@@ -45446,6 +45600,40 @@
             ],
             "returnComment": []
           },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.ISavedObjectTypeRegistry.isHiddenFromHttpApis",
+            "type": "Function",
+            "tags": [],
+            "label": "isHiddenFromHttpApis",
+            "description": [
+              "\nReturns the `hiddenFromHttpApis` property for a given type, or `false` if\nthe type is not registered"
+            ],
+            "signature": [
+              "(type: string) => boolean"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/type_registry.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "core",
+                "id": "def-server.ISavedObjectTypeRegistry.isHiddenFromHttpApis.$1",
+                "type": "string",
+                "tags": [],
+                "label": "type",
+                "description": [],
+                "signature": [
+                  "string"
+                ],
+                "path": "packages/core/saved-objects/core-saved-objects-server/src/type_registry.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
           {
             "parentPluginId": "core",
             "id": "def-server.ISavedObjectTypeRegistry.getIndex",
@@ -62587,6 +62775,22 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "core",
+            "id": "def-server.SavedObjectsType.hiddenFromHttpApis",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "hiddenFromHttpApis",
+            "description": [
+              "\nIs the type hidden from the http APIs. If `hiddenFromHttpApis:true`, repositories will have access to the type but the type is not exposed via the HTTP APIs.\nIt is recommended to hide types registered with 'hidden=false' from the httpApis for backward compatibility in the HTTP layer.\n"
+            ],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "core",
             "id": "def-server.SavedObjectsType.namespaceType",
diff --git a/api_docs/core.mdx b/api_docs/core.mdx
index 11fb66e31cd8ba..af4d87f06642e8 100644
--- a/api_docs/core.mdx
+++ b/api_docs/core.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/core
 title: "core"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the core plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'core']
 ---
 import coreObj from './core.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 2806 | 17 | 1017 | 0 |
+| 2810 | 17 | 1018 | 0 |
 
 ## Client
 
diff --git a/api_docs/custom_integrations.mdx b/api_docs/custom_integrations.mdx
index c07872138ad683..b18f322b9a33c2 100644
--- a/api_docs/custom_integrations.mdx
+++ b/api_docs/custom_integrations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/customIntegrations
 title: "customIntegrations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the customIntegrations plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'customIntegrations']
 ---
 import customIntegrationsObj from './custom_integrations.devdocs.json';
diff --git a/api_docs/dashboard.devdocs.json b/api_docs/dashboard.devdocs.json
index 38b159a4d1b1e8..66e3597db0e0f9 100644
--- a/api_docs/dashboard.devdocs.json
+++ b/api_docs/dashboard.devdocs.json
@@ -1,7 +1,1421 @@
 {
   "id": "dashboard",
   "client": {
-    "classes": [],
+    "classes": [
+      {
+        "parentPluginId": "dashboard",
+        "id": "def-public.DashboardContainer",
+        "type": "Class",
+        "tags": [],
+        "label": "DashboardContainer",
+        "description": [],
+        "signature": [
+          {
+            "pluginId": "dashboard",
+            "scope": "public",
+            "docId": "kibDashboardPluginApi",
+            "section": "def-public.DashboardContainer",
+            "text": "DashboardContainer"
+          },
+          " extends ",
+          {
+            "pluginId": "embeddable",
+            "scope": "public",
+            "docId": "kibEmbeddablePluginApi",
+            "section": "def-public.Container",
+            "text": "Container"
+          },
+          "<",
+          "InheritedChildInput",
+          ", ",
+          {
+            "pluginId": "dashboard",
+            "scope": "common",
+            "docId": "kibDashboardPluginApi",
+            "section": "def-common.DashboardContainerInput",
+            "text": "DashboardContainerInput"
+          },
+          ", ",
+          {
+            "pluginId": "embeddable",
+            "scope": "public",
+            "docId": "kibEmbeddablePluginApi",
+            "section": "def-public.ContainerOutput",
+            "text": "ContainerOutput"
+          },
+          ">"
+        ],
+        "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.type",
+            "type": "string",
+            "tags": [],
+            "label": "type",
+            "description": [],
+            "signature": [
+              "\"dashboard\""
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.controlGroup",
+            "type": "Object",
+            "tags": [],
+            "label": "controlGroup",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "controls",
+                "scope": "public",
+                "docId": "kibControlsPluginApi",
+                "section": "def-public.ControlGroupContainer",
+                "text": "ControlGroupContainer"
+              },
+              " | undefined"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.Unnamed",
+            "type": "Function",
+            "tags": [],
+            "label": "Constructor",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.Unnamed.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "initialInput",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "dashboard",
+                    "scope": "common",
+                    "docId": "kibDashboardPluginApi",
+                    "section": "def-common.DashboardContainerInput",
+                    "text": "DashboardContainerInput"
+                  }
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.Unnamed.$2",
+                "type": "number",
+                "tags": [],
+                "label": "dashboardCreationStartTime",
+                "description": [],
+                "signature": [
+                  "number | undefined"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": false
+              },
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.Unnamed.$3",
+                "type": "Object",
+                "tags": [],
+                "label": "parent",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "embeddable",
+                    "scope": "public",
+                    "docId": "kibEmbeddablePluginApi",
+                    "section": "def-public.Container",
+                    "text": "Container"
+                  },
+                  "<{}, ",
+                  {
+                    "pluginId": "embeddable",
+                    "scope": "public",
+                    "docId": "kibEmbeddablePluginApi",
+                    "section": "def-public.ContainerInput",
+                    "text": "ContainerInput"
+                  },
+                  "<{}>, ",
+                  {
+                    "pluginId": "embeddable",
+                    "scope": "public",
+                    "docId": "kibEmbeddablePluginApi",
+                    "section": "def-public.ContainerOutput",
+                    "text": "ContainerOutput"
+                  },
+                  "> | undefined"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": false
+              },
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.Unnamed.$4",
+                "type": "Object",
+                "tags": [],
+                "label": "creationOptions",
+                "description": [],
+                "signature": [
+                  "DashboardCreationOptions",
+                  " | undefined"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": false
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.getDashboardSavedObjectId",
+            "type": "Function",
+            "tags": [],
+            "label": "getDashboardSavedObjectId",
+            "description": [],
+            "signature": [
+              "() => string | undefined"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.getInputAsValueType",
+            "type": "Function",
+            "tags": [],
+            "label": "getInputAsValueType",
+            "description": [],
+            "signature": [
+              "() => ",
+              {
+                "pluginId": "dashboard",
+                "scope": "common",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-common.DashboardContainerByValueInput",
+                "text": "DashboardContainerByValueInput"
+              }
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.untilInitialized",
+            "type": "Function",
+            "tags": [],
+            "label": "untilInitialized",
+            "description": [],
+            "signature": [
+              "() => Promise<void>"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.reportPerformanceMetrics",
+            "type": "Function",
+            "tags": [],
+            "label": "reportPerformanceMetrics",
+            "description": [],
+            "signature": [
+              "(stats: ",
+              "DashboardRenderPerformanceStats",
+              ") => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.reportPerformanceMetrics.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "stats",
+                "description": [],
+                "signature": [
+                  "DashboardRenderPerformanceStats"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.createNewPanelState",
+            "type": "Function",
+            "tags": [],
+            "label": "createNewPanelState",
+            "description": [],
+            "signature": [
+              "<TEmbeddableInput extends ",
+              {
+                "pluginId": "embeddable",
+                "scope": "common",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-common.EmbeddableInput",
+                "text": "EmbeddableInput"
+              },
+              ", TEmbeddable extends ",
+              {
+                "pluginId": "embeddable",
+                "scope": "public",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-public.IEmbeddable",
+                "text": "IEmbeddable"
+              },
+              "<TEmbeddableInput, any, any>>(factory: ",
+              {
+                "pluginId": "embeddable",
+                "scope": "public",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-public.EmbeddableFactory",
+                "text": "EmbeddableFactory"
+              },
+              "<TEmbeddableInput, any, TEmbeddable, unknown>, partial?: Partial<TEmbeddableInput>) => ",
+              {
+                "pluginId": "dashboard",
+                "scope": "common",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-common.DashboardPanelState",
+                "text": "DashboardPanelState"
+              },
+              "<TEmbeddableInput>"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.createNewPanelState.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "factory",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "embeddable",
+                    "scope": "public",
+                    "docId": "kibEmbeddablePluginApi",
+                    "section": "def-public.EmbeddableFactory",
+                    "text": "EmbeddableFactory"
+                  },
+                  "<TEmbeddableInput, any, TEmbeddable, unknown>"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              },
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.createNewPanelState.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "partial",
+                "description": [],
+                "signature": [
+                  "Partial<TEmbeddableInput>"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.getExplicitInputIsEqual",
+            "type": "Function",
+            "tags": [],
+            "label": "getExplicitInputIsEqual",
+            "description": [],
+            "signature": [
+              "(lastExplicitInput: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "common",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-common.DashboardContainerByValueInput",
+                "text": "DashboardContainerByValueInput"
+              },
+              ") => Promise<boolean>"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.getExplicitInputIsEqual.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "lastExplicitInput",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "dashboard",
+                    "scope": "common",
+                    "docId": "kibDashboardPluginApi",
+                    "section": "def-common.DashboardContainerByValueInput",
+                    "text": "DashboardContainerByValueInput"
+                  }
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.getReduxEmbeddableTools",
+            "type": "Function",
+            "tags": [],
+            "label": "getReduxEmbeddableTools",
+            "description": [],
+            "signature": [
+              "() => ",
+              {
+                "pluginId": "presentationUtil",
+                "scope": "public",
+                "docId": "kibPresentationUtilPluginApi",
+                "section": "def-public.ReduxEmbeddableTools",
+                "text": "ReduxEmbeddableTools"
+              },
+              "<",
+              "DashboardReduxState",
+              ", { setControlGroupState: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: ",
+              {
+                "pluginId": "controls",
+                "scope": "common",
+                "docId": "kibControlsPluginApi",
+                "section": "def-common.PersistableControlGroupInput",
+                "text": "PersistableControlGroupInput"
+              },
+              " | undefined; type: string; }) => void; setPanels: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "common",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-common.DashboardPanelMap",
+                "text": "DashboardPanelMap"
+              },
+              "; type: string; }) => void; setStateFromSaveModal: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: ",
+              "DashboardStateFromSaveModal",
+              "; type: string; }) => void; setDescription: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: string | undefined; type: string; }) => void; setViewMode: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: ",
+              {
+                "pluginId": "embeddable",
+                "scope": "common",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-common.ViewMode",
+                "text": "ViewMode"
+              },
+              "; type: string; }) => void; setTags: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: string[]; type: string; }) => void; setTitle: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: string; type: string; }) => void; setSearchSessionId: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: string | undefined; type: string; }) => void; setHasUnsavedChanges: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: boolean | undefined; type: string; }) => void; setLastSavedInput: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "common",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-common.DashboardContainerByValueInput",
+                "text": "DashboardContainerByValueInput"
+              },
+              "; type: string; }) => void; resetToLastSavedInput: (state: ",
+              "DashboardReduxState",
+              ") => void; setUseMargins: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: boolean; type: string; }) => void; setSyncCursor: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: boolean; type: string; }) => void; setSyncColors: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: boolean; type: string; }) => void; setSyncTooltips: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: boolean; type: string; }) => void; setHidePanelTitles: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: boolean; type: string; }) => void; setFiltersAndQuery: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: Pick<",
+              {
+                "pluginId": "dashboard",
+                "scope": "common",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-common.DashboardContainerByValueInput",
+                "text": "DashboardContainerByValueInput"
+              },
+              ", \"query\" | \"filters\">; type: string; }) => void; setLastReloadRequestTimeToNow: (state: ",
+              "DashboardReduxState",
+              ") => void; setFilters: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: ",
+              {
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.Filter",
+                "text": "Filter"
+              },
+              "[]; type: string; }) => void; setQuery: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: ",
+              {
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.Query",
+                "text": "Query"
+              },
+              "; type: string; }) => void; setSavedQueryId: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: string | undefined; type: string; }) => void; setTimeRestore: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: boolean; type: string; }) => void; setTimeRange: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: ",
+              {
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.TimeRange",
+                "text": "TimeRange"
+              },
+              " | undefined; type: string; }) => void; setRefreshInterval: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: ",
+              {
+                "pluginId": "data",
+                "scope": "common",
+                "docId": "kibDataQueryPluginApi",
+                "section": "def-common.RefreshInterval",
+                "text": "RefreshInterval"
+              },
+              " | undefined; type: string; }) => void; setTimeslice: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: [number, number] | undefined; type: string; }) => void; setExpandedPanelId: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: string | undefined; type: string; }) => void; setFullScreenMode: (state: ",
+              "DashboardReduxState",
+              ", action: { payload: boolean; type: string; }) => void; }>"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.render",
+            "type": "Function",
+            "tags": [],
+            "label": "render",
+            "description": [],
+            "signature": [
+              "(dom: HTMLElement) => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.render.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "dom",
+                "description": [],
+                "signature": [
+                  "HTMLElement"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.getInheritedInput",
+            "type": "Function",
+            "tags": [],
+            "label": "getInheritedInput",
+            "description": [],
+            "signature": [
+              "(id: string) => ",
+              "InheritedChildInput"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.getInheritedInput.$1",
+                "type": "string",
+                "tags": [],
+                "label": "id",
+                "description": [],
+                "signature": [
+                  "string"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.destroy",
+            "type": "Function",
+            "tags": [],
+            "label": "destroy",
+            "description": [],
+            "signature": [
+              "() => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.isExpectingIdChange",
+            "type": "Function",
+            "tags": [],
+            "label": "isExpectingIdChange",
+            "description": [
+              "\nSometimes when the ID changes, it's due to a clone operation, or a save as operation. In these cases,\nmost of the state hasn't actually changed, so there isn't any reason to destroy this container and\nload up a fresh one. When an id change is in progress, the renderer can check this method, and if it returns\ntrue, the renderer can safely skip destroying and rebuilding the container."
+            ],
+            "signature": [
+              "() => boolean"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.expectIdChange",
+            "type": "Function",
+            "tags": [],
+            "label": "expectIdChange",
+            "description": [],
+            "signature": [
+              "() => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.runClone",
+            "type": "Function",
+            "tags": [],
+            "label": "runClone",
+            "description": [],
+            "signature": [
+              "(this: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "public",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-public.DashboardContainer",
+                "text": "DashboardContainer"
+              },
+              ") => Promise<",
+              "SaveDashboardReturn",
+              " | undefined>"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.runSaveAs",
+            "type": "Function",
+            "tags": [],
+            "label": "runSaveAs",
+            "description": [],
+            "signature": [
+              "(this: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "public",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-public.DashboardContainer",
+                "text": "DashboardContainer"
+              },
+              ") => Promise<",
+              "SaveDashboardReturn",
+              " | undefined>"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.runQuickSave",
+            "type": "Function",
+            "tags": [],
+            "label": "runQuickSave",
+            "description": [],
+            "signature": [
+              "(this: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "public",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-public.DashboardContainer",
+                "text": "DashboardContainer"
+              },
+              ") => Promise<",
+              "SaveDashboardReturn",
+              ">"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.showOptions",
+            "type": "Function",
+            "tags": [],
+            "label": "showOptions",
+            "description": [],
+            "signature": [
+              "(this: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "public",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-public.DashboardContainer",
+                "text": "DashboardContainer"
+              },
+              ", anchorElement: HTMLElement) => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.showOptions.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "anchorElement",
+                "description": [],
+                "signature": [
+                  "HTMLElement"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/api/show_options_popover.tsx",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.addFromLibrary",
+            "type": "Function",
+            "tags": [],
+            "label": "addFromLibrary",
+            "description": [],
+            "signature": [
+              "(this: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "public",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-public.DashboardContainer",
+                "text": "DashboardContainer"
+              },
+              ") => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.replacePanel",
+            "type": "Function",
+            "tags": [],
+            "label": "replacePanel",
+            "description": [],
+            "signature": [
+              "(this: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "public",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-public.DashboardContainer",
+                "text": "DashboardContainer"
+              },
+              ", previousPanelState: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "common",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-common.DashboardPanelState",
+                "text": "DashboardPanelState"
+              },
+              "<",
+              {
+                "pluginId": "embeddable",
+                "scope": "common",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-common.EmbeddableInput",
+                "text": "EmbeddableInput"
+              },
+              ">, newPanelState: Partial<",
+              {
+                "pluginId": "embeddable",
+                "scope": "common",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-common.PanelState",
+                "text": "PanelState"
+              },
+              "<{ id: string; }>>, generateNewId?: boolean | undefined) => Promise<void>"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.replacePanel.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "previousPanelState",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "dashboard",
+                    "scope": "common",
+                    "docId": "kibDashboardPluginApi",
+                    "section": "def-common.DashboardPanelState",
+                    "text": "DashboardPanelState"
+                  },
+                  "<",
+                  {
+                    "pluginId": "embeddable",
+                    "scope": "common",
+                    "docId": "kibEmbeddablePluginApi",
+                    "section": "def-common.EmbeddableInput",
+                    "text": "EmbeddableInput"
+                  },
+                  ">"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.replacePanel.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "newPanelState",
+                "description": [],
+                "signature": [
+                  "{ type?: string | undefined; explicitInput?: (Partial<{ id: string; }> & { id: string; }) | undefined; }"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.replacePanel.$3",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "generateNewId",
+                "description": [],
+                "signature": [
+                  "boolean | undefined"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.showPlaceholderUntil",
+            "type": "Function",
+            "tags": [],
+            "label": "showPlaceholderUntil",
+            "description": [],
+            "signature": [
+              "<TPlacementMethodArgs extends ",
+              "IPanelPlacementArgs",
+              ">(this: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "public",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-public.DashboardContainer",
+                "text": "DashboardContainer"
+              },
+              ", newStateComplete: Promise<Partial<",
+              {
+                "pluginId": "embeddable",
+                "scope": "common",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-common.PanelState",
+                "text": "PanelState"
+              },
+              "<{ id: string; }>>>, placementMethod?: ",
+              "PanelPlacementMethod",
+              "<TPlacementMethodArgs> | undefined, placementArgs?: TPlacementMethodArgs | undefined) => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.showPlaceholderUntil.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "newStateComplete",
+                "description": [],
+                "signature": [
+                  "Promise<Partial<",
+                  {
+                    "pluginId": "embeddable",
+                    "scope": "common",
+                    "docId": "kibEmbeddablePluginApi",
+                    "section": "def-common.PanelState",
+                    "text": "PanelState"
+                  },
+                  "<{ id: string; }>>>"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.showPlaceholderUntil.$2",
+                "type": "Function",
+                "tags": [],
+                "label": "placementMethod",
+                "description": [],
+                "signature": [
+                  "PanelPlacementMethod",
+                  "<TPlacementMethodArgs> | undefined"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.showPlaceholderUntil.$3",
+                "type": "Uncategorized",
+                "tags": [],
+                "label": "placementArgs",
+                "description": [],
+                "signature": [
+                  "TPlacementMethodArgs | undefined"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.addOrUpdateEmbeddable",
+            "type": "Function",
+            "tags": [],
+            "label": "addOrUpdateEmbeddable",
+            "description": [],
+            "signature": [
+              "<EEI extends ",
+              {
+                "pluginId": "embeddable",
+                "scope": "common",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-common.EmbeddableInput",
+                "text": "EmbeddableInput"
+              },
+              " = ",
+              {
+                "pluginId": "embeddable",
+                "scope": "common",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-common.EmbeddableInput",
+                "text": "EmbeddableInput"
+              },
+              ", EEO extends ",
+              {
+                "pluginId": "embeddable",
+                "scope": "public",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-public.EmbeddableOutput",
+                "text": "EmbeddableOutput"
+              },
+              " = ",
+              {
+                "pluginId": "embeddable",
+                "scope": "public",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-public.EmbeddableOutput",
+                "text": "EmbeddableOutput"
+              },
+              ", E extends ",
+              {
+                "pluginId": "embeddable",
+                "scope": "public",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-public.IEmbeddable",
+                "text": "IEmbeddable"
+              },
+              "<EEI, EEO, any> = ",
+              {
+                "pluginId": "embeddable",
+                "scope": "public",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-public.IEmbeddable",
+                "text": "IEmbeddable"
+              },
+              "<EEI, EEO, any>>(this: ",
+              {
+                "pluginId": "dashboard",
+                "scope": "public",
+                "docId": "kibDashboardPluginApi",
+                "section": "def-public.DashboardContainer",
+                "text": "DashboardContainer"
+              },
+              ", type: string, explicitInput: Partial<EEI>, embeddableId?: string | undefined) => Promise<void | ",
+              {
+                "pluginId": "embeddable",
+                "scope": "public",
+                "docId": "kibEmbeddablePluginApi",
+                "section": "def-public.ErrorEmbeddable",
+                "text": "ErrorEmbeddable"
+              },
+              " | E>"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "returnComment": [],
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.addOrUpdateEmbeddable.$1",
+                "type": "string",
+                "tags": [],
+                "label": "type",
+                "description": [],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.addOrUpdateEmbeddable.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "explicitInput",
+                "description": [],
+                "signature": [
+                  "{ [P in keyof EEI]?: EEI[P] | undefined; }"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.addOrUpdateEmbeddable.$3",
+                "type": "string",
+                "tags": [],
+                "label": "embeddableId",
+                "description": [],
+                "signature": [
+                  "string | undefined"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/api/panel_management.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.forceRefresh",
+            "type": "Function",
+            "tags": [],
+            "label": "forceRefresh",
+            "description": [],
+            "signature": [
+              "() => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.onDataViewsUpdate$",
+            "type": "Object",
+            "tags": [],
+            "label": "onDataViewsUpdate$",
+            "description": [],
+            "signature": [
+              "Subject",
+              "<",
+              {
+                "pluginId": "dataViews",
+                "scope": "common",
+                "docId": "kibDataViewsPluginApi",
+                "section": "def-common.DataView",
+                "text": "DataView"
+              },
+              "[]>"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.resetToLastSavedState",
+            "type": "Function",
+            "tags": [],
+            "label": "resetToLastSavedState",
+            "description": [],
+            "signature": [
+              "() => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.getAllDataViews",
+            "type": "Function",
+            "tags": [],
+            "label": "getAllDataViews",
+            "description": [
+              "\nGets all the dataviews that are actively being used in the dashboard"
+            ],
+            "signature": [
+              "() => ",
+              {
+                "pluginId": "dataViews",
+                "scope": "common",
+                "docId": "kibDataViewsPluginApi",
+                "section": "def-common.DataView",
+                "text": "DataView"
+              },
+              "[]"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": [
+              "An array of dataviews"
+            ]
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.setAllDataViews",
+            "type": "Function",
+            "tags": [],
+            "label": "setAllDataViews",
+            "description": [
+              "\nUse this to set the dataviews that are used in the dashboard when they change/update"
+            ],
+            "signature": [
+              "(newDataViews: ",
+              {
+                "pluginId": "dataViews",
+                "scope": "common",
+                "docId": "kibDataViewsPluginApi",
+                "section": "def-common.DataView",
+                "text": "DataView"
+              },
+              "[]) => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.setAllDataViews.$1",
+                "type": "Array",
+                "tags": [],
+                "label": "newDataViews",
+                "description": [
+                  "The new array of dataviews that will overwrite the old dataviews array"
+                ],
+                "signature": [
+                  {
+                    "pluginId": "dataViews",
+                    "scope": "common",
+                    "docId": "kibDataViewsPluginApi",
+                    "section": "def-common.DataView",
+                    "text": "DataView"
+                  },
+                  "[]"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.getExpandedPanelId",
+            "type": "Function",
+            "tags": [],
+            "label": "getExpandedPanelId",
+            "description": [],
+            "signature": [
+              "() => string | undefined"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.openOverlay",
+            "type": "Function",
+            "tags": [],
+            "label": "openOverlay",
+            "description": [],
+            "signature": [
+              "(ref: ",
+              {
+                "pluginId": "@kbn/core-mount-utils-browser",
+                "scope": "common",
+                "docId": "kibKbnCoreMountUtilsBrowserPluginApi",
+                "section": "def-common.OverlayRef",
+                "text": "OverlayRef"
+              },
+              ") => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.openOverlay.$1",
+                "type": "Object",
+                "tags": [],
+                "label": "ref",
+                "description": [],
+                "signature": [
+                  {
+                    "pluginId": "@kbn/core-mount-utils-browser",
+                    "scope": "common",
+                    "docId": "kibKbnCoreMountUtilsBrowserPluginApi",
+                    "section": "def-common.OverlayRef",
+                    "text": "OverlayRef"
+                  }
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.clearOverlays",
+            "type": "Function",
+            "tags": [],
+            "label": "clearOverlays",
+            "description": [],
+            "signature": [
+              "() => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.setExpandedPanelId",
+            "type": "Function",
+            "tags": [],
+            "label": "setExpandedPanelId",
+            "description": [],
+            "signature": [
+              "(newId?: string | undefined) => void"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "dashboard",
+                "id": "def-public.DashboardContainer.setExpandedPanelId.$1",
+                "type": "string",
+                "tags": [],
+                "label": "newId",
+                "description": [],
+                "signature": [
+                  "string | undefined"
+                ],
+                "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": false
+              }
+            ],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.getPanelCount",
+            "type": "Function",
+            "tags": [],
+            "label": "getPanelCount",
+            "description": [],
+            "signature": [
+              "() => number"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
+          {
+            "parentPluginId": "dashboard",
+            "id": "def-public.DashboardContainer.getPanelTitles",
+            "type": "Function",
+            "tags": [],
+            "label": "getPanelTitles",
+            "description": [],
+            "signature": [
+              "() => Promise<string[]>"
+            ],
+            "path": "src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
     "functions": [
       {
         "parentPluginId": "dashboard",
@@ -1957,16 +3371,16 @@
             "pluginId": "dashboard",
             "scope": "common",
             "docId": "kibDashboardPluginApi",
-            "section": "def-common.DashboardContainerByValueInput",
-            "text": "DashboardContainerByValueInput"
+            "section": "def-common.DashboardContainerByReferenceInput",
+            "text": "DashboardContainerByReferenceInput"
           },
           " | ",
           {
             "pluginId": "dashboard",
             "scope": "common",
             "docId": "kibDashboardPluginApi",
-            "section": "def-common.DashboardContainerByReferenceInput",
-            "text": "DashboardContainerByReferenceInput"
+            "section": "def-common.DashboardContainerByValueInput",
+            "text": "DashboardContainerByValueInput"
           }
         ],
         "path": "src/plugins/dashboard/common/dashboard_container/types.ts",
@@ -2079,7 +3493,7 @@
             "section": "def-common.PersistableControlGroupInput",
             "text": "PersistableControlGroupInput"
           },
-          " | undefined; isEmbeddedExternally?: boolean | undefined; timeRestore?: boolean | undefined; refreshInterval?: ",
+          " | undefined; timeRestore?: boolean | undefined; refreshInterval?: ",
           {
             "pluginId": "data",
             "scope": "common",
@@ -2087,7 +3501,7 @@
             "section": "def-common.RefreshInterval",
             "text": "RefreshInterval"
           },
-          " | undefined; useMargins?: boolean | undefined; panels?: ",
+          " | undefined; isEmbeddedExternally?: boolean | undefined; useMargins?: boolean | undefined; panels?: ",
           {
             "pluginId": "dashboard",
             "scope": "common",
diff --git a/api_docs/dashboard.mdx b/api_docs/dashboard.mdx
index 703856322f24f8..2c1bcc15ceb436 100644
--- a/api_docs/dashboard.mdx
+++ b/api_docs/dashboard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboard
 title: "dashboard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboard plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboard']
 ---
 import dashboardObj from './dashboard.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-prese
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 113 | 0 | 109 | 2 |
+| 171 | 0 | 163 | 10 |
 
 ## Client
 
@@ -34,6 +34,9 @@ Contact [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-prese
 ### Functions
 <DocDefinitionList data={dashboardObj.client.functions}/>
 
+### Classes
+<DocDefinitionList data={dashboardObj.client.classes}/>
+
 ### Interfaces
 <DocDefinitionList data={dashboardObj.client.interfaces}/>
 
diff --git a/api_docs/dashboard_enhanced.mdx b/api_docs/dashboard_enhanced.mdx
index 4492855f0c83e1..c2bfbeccee8c15 100644
--- a/api_docs/dashboard_enhanced.mdx
+++ b/api_docs/dashboard_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboardEnhanced
 title: "dashboardEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dashboardEnhanced plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboardEnhanced']
 ---
 import dashboardEnhancedObj from './dashboard_enhanced.devdocs.json';
diff --git a/api_docs/data.devdocs.json b/api_docs/data.devdocs.json
index 54ed4d3dcfef13..403980306ecd48 100644
--- a/api_docs/data.devdocs.json
+++ b/api_docs/data.devdocs.json
@@ -11737,6 +11737,18 @@
             "plugin": "cases",
             "path": "x-pack/plugins/cases/server/common/types.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
           {
             "plugin": "synthetics",
             "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts"
@@ -11809,6 +11821,50 @@
             "plugin": "alerting",
             "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
           {
             "plugin": "fleet",
             "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts"
@@ -30442,6 +30498,18 @@
             "plugin": "cases",
             "path": "x-pack/plugins/cases/server/common/types.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
           {
             "plugin": "synthetics",
             "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts"
@@ -30514,6 +30582,50 @@
             "plugin": "alerting",
             "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
           {
             "plugin": "fleet",
             "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts"
diff --git a/api_docs/data.mdx b/api_docs/data.mdx
index fbdbddfe7bd5c1..654ddf72d4e443 100644
--- a/api_docs/data.mdx
+++ b/api_docs/data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data
 title: "data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data']
 ---
 import dataObj from './data.devdocs.json';
diff --git a/api_docs/data_query.devdocs.json b/api_docs/data_query.devdocs.json
index 98f5d2f670e1ea..4287318f3d825b 100644
--- a/api_docs/data_query.devdocs.json
+++ b/api_docs/data_query.devdocs.json
@@ -1832,14 +1832,6 @@
             "text": "Filter"
           },
           ", indexPatterns: ",
-          {
-            "pluginId": "@kbn/es-query",
-            "scope": "common",
-            "docId": "kibKbnEsQueryPluginApi",
-            "section": "def-common.DataViewBase",
-            "text": "DataViewBase"
-          },
-          "[] | ",
           {
             "pluginId": "dataViews",
             "scope": "common",
@@ -1847,6 +1839,14 @@
             "section": "def-common.DataView",
             "text": "DataView"
           },
+          "[] | ",
+          {
+            "pluginId": "@kbn/es-query",
+            "scope": "common",
+            "docId": "kibKbnEsQueryPluginApi",
+            "section": "def-common.DataViewBase",
+            "text": "DataViewBase"
+          },
           "[]) => string"
         ],
         "path": "src/plugins/data/public/query/filter_manager/lib/get_display_value.ts",
@@ -1882,14 +1882,6 @@
             "label": "indexPatterns",
             "description": [],
             "signature": [
-              {
-                "pluginId": "@kbn/es-query",
-                "scope": "common",
-                "docId": "kibKbnEsQueryPluginApi",
-                "section": "def-common.DataViewBase",
-                "text": "DataViewBase"
-              },
-              "[] | ",
               {
                 "pluginId": "dataViews",
                 "scope": "common",
@@ -1897,6 +1889,14 @@
                 "section": "def-common.DataView",
                 "text": "DataView"
               },
+              "[] | ",
+              {
+                "pluginId": "@kbn/es-query",
+                "scope": "common",
+                "docId": "kibKbnEsQueryPluginApi",
+                "section": "def-common.DataViewBase",
+                "text": "DataViewBase"
+              },
               "[]"
             ],
             "path": "src/plugins/data/public/query/filter_manager/lib/get_display_value.ts",
diff --git a/api_docs/data_query.mdx b/api_docs/data_query.mdx
index 9f8b6bcca7a44a..ee16a8981997db 100644
--- a/api_docs/data_query.mdx
+++ b/api_docs/data_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-query
 title: "data.query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.query plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.query']
 ---
 import dataQueryObj from './data_query.devdocs.json';
diff --git a/api_docs/data_search.devdocs.json b/api_docs/data_search.devdocs.json
index 7a787eaa2a6666..bff96335cd044b 100644
--- a/api_docs/data_search.devdocs.json
+++ b/api_docs/data_search.devdocs.json
@@ -26198,7 +26198,7 @@
             "label": "aggregate",
             "description": [],
             "signature": [
-              "\"min\" | \"max\" | \"sum\" | \"average\" | \"concat\""
+              "\"min\" | \"max\" | \"concat\" | \"sum\" | \"average\""
             ],
             "path": "src/plugins/data/common/search/aggs/metrics/top_hit.ts",
             "deprecated": false,
diff --git a/api_docs/data_search.mdx b/api_docs/data_search.mdx
index b3d81687707609..6346e509e19581 100644
--- a/api_docs/data_search.mdx
+++ b/api_docs/data_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-search
 title: "data.search"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the data.search plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.search']
 ---
 import dataSearchObj from './data_search.devdocs.json';
diff --git a/api_docs/data_view_editor.mdx b/api_docs/data_view_editor.mdx
index 7b012a86f90df7..a9333f758afc31 100644
--- a/api_docs/data_view_editor.mdx
+++ b/api_docs/data_view_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewEditor
 title: "dataViewEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewEditor plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewEditor']
 ---
 import dataViewEditorObj from './data_view_editor.devdocs.json';
diff --git a/api_docs/data_view_field_editor.mdx b/api_docs/data_view_field_editor.mdx
index dd9454f0f63de4..9d68b3c6ba463b 100644
--- a/api_docs/data_view_field_editor.mdx
+++ b/api_docs/data_view_field_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewFieldEditor
 title: "dataViewFieldEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewFieldEditor plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewFieldEditor']
 ---
 import dataViewFieldEditorObj from './data_view_field_editor.devdocs.json';
diff --git a/api_docs/data_view_management.mdx b/api_docs/data_view_management.mdx
index bc6d6f1ae8f685..29097445d47249 100644
--- a/api_docs/data_view_management.mdx
+++ b/api_docs/data_view_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewManagement
 title: "dataViewManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViewManagement plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewManagement']
 ---
 import dataViewManagementObj from './data_view_management.devdocs.json';
diff --git a/api_docs/data_views.devdocs.json b/api_docs/data_views.devdocs.json
index c8c66a842fcf8e..33efa3cad42bbb 100644
--- a/api_docs/data_views.devdocs.json
+++ b/api_docs/data_views.devdocs.json
@@ -26948,6 +26948,18 @@
             "plugin": "cases",
             "path": "x-pack/plugins/cases/server/common/types.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
           {
             "plugin": "synthetics",
             "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts"
@@ -27020,6 +27032,50 @@
             "plugin": "alerting",
             "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
           {
             "plugin": "fleet",
             "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts"
diff --git a/api_docs/data_views.mdx b/api_docs/data_views.mdx
index ab8c80d61f8179..e768c489ceb0dd 100644
--- a/api_docs/data_views.mdx
+++ b/api_docs/data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViews
 title: "dataViews"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataViews plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViews']
 ---
 import dataViewsObj from './data_views.devdocs.json';
diff --git a/api_docs/data_visualizer.mdx b/api_docs/data_visualizer.mdx
index 179199a6ed2677..81adb92fe00b81 100644
--- a/api_docs/data_visualizer.mdx
+++ b/api_docs/data_visualizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataVisualizer
 title: "dataVisualizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the dataVisualizer plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataVisualizer']
 ---
 import dataVisualizerObj from './data_visualizer.devdocs.json';
diff --git a/api_docs/deprecations_by_api.mdx b/api_docs/deprecations_by_api.mdx
index 7c1d32518069ce..00f340eb9e9ed1 100644
--- a/api_docs/deprecations_by_api.mdx
+++ b/api_docs/deprecations_by_api.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByApi
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-api
 title: Deprecated API usage by API
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -124,7 +124,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnCoreSavedObjectsBrowserMocksPluginApi" section="def-common.savedObjectsServiceMock" text="savedObjectsServiceMock"/> | @kbn/core-lifecycle-browser-mocks, core, ml, dashboard, dataViews, savedSearch, @kbn/core-plugins-browser-internal | - |
 | <DocLink id="kibKbnCoreSavedObjectsBrowserMocksPluginApi" section="def-common.simpleSavedObjectMock" text="simpleSavedObjectMock"/> | core, lens, savedObjects, visualizations | - |
 | <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectAttributeSingle" text="SavedObjectAttributeSingle"/> | core | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaPageTemplate" text="KibanaPageTemplate"/> | home, ml, canvas, osquery | - |
+| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaPageTemplate" text="KibanaPageTemplate"/> | home, canvas, osquery | - |
 | <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | home, data, esUiShared, spaces, savedObjectsManagement, fleet, observability, ml, apm, indexLifecycleManagement, synthetics, upgradeAssistant, ux, kibanaOverview | - |
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.flattenHit" text="flattenHit"/> | dataViews, maps | - |
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.removeScriptedField" text="removeScriptedField"/> | dataViewManagement, dataViews | - |
diff --git a/api_docs/deprecations_by_plugin.mdx b/api_docs/deprecations_by_plugin.mdx
index 89adefbf1c2ab3..da4e8add41adb8 100644
--- a/api_docs/deprecations_by_plugin.mdx
+++ b/api_docs/deprecations_by_plugin.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByPlugin
 slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-plugin
 title: Deprecated API usage by plugin
 description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by.
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -502,19 +502,19 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Deprecated API | Reference location(s) | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibDataPluginApi" section="def-public.SavedObject" text="SavedObject"/> | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject)+ 14 more | - |
-| <DocLink id="kibDataPluginApi" section="def-common.SavedObject" text="SavedObject"/> | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject)+ 26 more | - |
+| <DocLink id="kibDataPluginApi" section="def-public.SavedObject" text="SavedObject"/> | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject)+ 42 more | - |
+| <DocLink id="kibDataPluginApi" section="def-common.SavedObject" text="SavedObject"/> | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject)+ 68 more | - |
 | <DocLink id="kibCorePluginApi" section="def-public.SavedObjectsClientContract.find" text="find"/> | [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=find) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.SimpleSavedObject" text="SimpleSavedObject"/> | [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject)+ 1 more | - |
 | <DocLink id="kibCorePluginApi" section="def-public.ResolvedSimpleSavedObject" text="ResolvedSimpleSavedObject"/> | [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject) | - |
-| <DocLink id="kibCorePluginApi" section="def-public.SavedObjectReference" text="SavedObjectReference"/> | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference) | - |
+| <DocLink id="kibCorePluginApi" section="def-public.SavedObjectReference" text="SavedObjectReference"/> | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObjectReference), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObjectReference) | - |
 | <DocLink id="kibCorePluginApi" section="def-public.CoreStart.savedObjects" text="savedObjects"/> | [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=savedObjects), [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/plugin.tsx#:~:text=savedObjects) | - |
 | <DocLink id="kibCorePluginApi" section="def-server.SavedObjectsType.convertToMultiNamespaceTypeVersion" text="convertToMultiNamespaceTypeVersion"/> | [cases.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/saved_object_types/cases.ts#:~:text=convertToMultiNamespaceTypeVersion), [configure.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/saved_object_types/configure.ts#:~:text=convertToMultiNamespaceTypeVersion), [comments.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/saved_object_types/comments.ts#:~:text=convertToMultiNamespaceTypeVersion), [user_actions.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/saved_object_types/user_actions.ts#:~:text=convertToMultiNamespaceTypeVersion), [connector_mappings.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/saved_object_types/connector_mappings.ts#:~:text=convertToMultiNamespaceTypeVersion) | - |
 | <DocLink id="kibKbnCoreLifecycleBrowserPluginApi" section="def-common.CoreStart.savedObjects" text="savedObjects"/> | [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=savedObjects), [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/plugin.tsx#:~:text=savedObjects) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SavedObjectsClientContract.find" text="find"/> | [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=find) | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.SimpleSavedObject" text="SimpleSavedObject"/> | [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject)+ 1 more | - |
 | <DocLink id="kibKbnCoreSavedObjectsApiBrowserPluginApi" section="def-common.ResolvedSimpleSavedObject" text="ResolvedSimpleSavedObject"/> | [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject) | - |
-| <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectReference" text="SavedObjectReference"/> | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference) | - |
+| <DocLink id="kibKbnCoreSavedObjectsCommonPluginApi" section="def-common.SavedObjectReference" text="SavedObjectReference"/> | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/attachment_framework/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObjectReference), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObjectReference), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObjectReference) | - |
 | <DocLink id="kibKbnCoreSavedObjectsServerPluginApi" section="def-common.SavedObjectsType.convertToMultiNamespaceTypeVersion" text="convertToMultiNamespaceTypeVersion"/> | [cases.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/saved_object_types/cases.ts#:~:text=convertToMultiNamespaceTypeVersion), [configure.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/saved_object_types/configure.ts#:~:text=convertToMultiNamespaceTypeVersion), [comments.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/saved_object_types/comments.ts#:~:text=convertToMultiNamespaceTypeVersion), [user_actions.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/saved_object_types/user_actions.ts#:~:text=convertToMultiNamespaceTypeVersion), [connector_mappings.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/saved_object_types/connector_mappings.ts#:~:text=convertToMultiNamespaceTypeVersion) | - |
 
 
@@ -1175,8 +1175,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibDataPluginApi" section="def-common.DataView.title" text="title"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=title), [rollup.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=title), [alerting_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts#:~:text=title), [data_recognizer.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=title), [configuration_step_details.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_details.tsx#:~:text=title), [data_loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title)+ 50 more | - |
 | <DocLink id="kibDataPluginApi" section="def-server.DataView.title" text="title"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=title), [rollup.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=title), [alerting_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts#:~:text=title), [data_recognizer.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=title), [configuration_step_details.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_details.tsx#:~:text=title), [data_loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title)+ 50 more | - |
 | <DocLink id="kibDataViewsPluginApi" section="def-public.DataView.title" text="title"/> | [index_patterns.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts#:~:text=title), [rollup.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts#:~:text=title), [alerting_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/lib/alerts/alerting_service.ts#:~:text=title), [data_recognizer.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts#:~:text=title), [configuration_step_details.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_details.tsx#:~:text=title), [data_loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title), [use_index_data.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts#:~:text=title)+ 20 more | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.KibanaPageTemplate" text="KibanaPageTemplate"/> | [ml_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx#:~:text=KibanaPageTemplate), [ml_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx#:~:text=KibanaPageTemplate), [ml_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx#:~:text=KibanaPageTemplate) | - |
-| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [ml_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx#:~:text=RedirectAppLinks), [ml_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx#:~:text=RedirectAppLinks), [ml_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx#:~:text=RedirectAppLinks), [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks), [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks), [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks) | - |
+| <DocLink id="kibKibanaReactPluginApi" section="def-public.RedirectAppLinks" text="RedirectAppLinks"/> | [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks), [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks), [jobs_list_page.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx#:~:text=RedirectAppLinks) | - |
 | <DocLink id="kibLicensingPluginApi" section="def-public.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/public/plugin.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibLicensingPluginApi" section="def-server.LicensingPluginSetup.license$" text="license$"/> | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/plugin.ts#:~:text=license%24) | 8.8.0 |
 | <DocLink id="kibSecurityPluginApi" section="def-server.SecurityPluginSetup.authc" text="authc"/> | [annotations.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/ml/server/routes/annotations.ts#:~:text=authc) | - |
diff --git a/api_docs/deprecations_by_team.mdx b/api_docs/deprecations_by_team.mdx
index 9f73589003491c..d8f278d73c7780 100644
--- a/api_docs/deprecations_by_team.mdx
+++ b/api_docs/deprecations_by_team.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsDueByTeam
 slug: /kibana-dev-docs/api-meta/deprecations-due-by-team
 title: Deprecated APIs due to be removed, by team
 description: Lists the teams that are referencing deprecated APIs with a remove by date.
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
diff --git a/api_docs/dev_tools.mdx b/api_docs/dev_tools.mdx
index e16ed19cfd0bd0..3a56b077d95d36 100644
--- a/api_docs/dev_tools.mdx
+++ b/api_docs/dev_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/devTools
 title: "devTools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the devTools plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'devTools']
 ---
 import devToolsObj from './dev_tools.devdocs.json';
diff --git a/api_docs/discover.mdx b/api_docs/discover.mdx
index 565b0c4d7f7cc1..635d2e8f96759c 100644
--- a/api_docs/discover.mdx
+++ b/api_docs/discover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discover
 title: "discover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discover plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discover']
 ---
 import discoverObj from './discover.devdocs.json';
diff --git a/api_docs/discover_enhanced.mdx b/api_docs/discover_enhanced.mdx
index cfea72b74deede..8979b9bf90993b 100644
--- a/api_docs/discover_enhanced.mdx
+++ b/api_docs/discover_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discoverEnhanced
 title: "discoverEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the discoverEnhanced plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discoverEnhanced']
 ---
 import discoverEnhancedObj from './discover_enhanced.devdocs.json';
diff --git a/api_docs/embeddable.mdx b/api_docs/embeddable.mdx
index 7cf851f2664827..3f599220eb93ea 100644
--- a/api_docs/embeddable.mdx
+++ b/api_docs/embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddable
 title: "embeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddable plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddable']
 ---
 import embeddableObj from './embeddable.devdocs.json';
diff --git a/api_docs/embeddable_enhanced.mdx b/api_docs/embeddable_enhanced.mdx
index ca3ea6630622de..d9e812b297e966 100644
--- a/api_docs/embeddable_enhanced.mdx
+++ b/api_docs/embeddable_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddableEnhanced
 title: "embeddableEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the embeddableEnhanced plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddableEnhanced']
 ---
 import embeddableEnhancedObj from './embeddable_enhanced.devdocs.json';
diff --git a/api_docs/encrypted_saved_objects.mdx b/api_docs/encrypted_saved_objects.mdx
index 82087851680ec4..62b0a673bb7cd2 100644
--- a/api_docs/encrypted_saved_objects.mdx
+++ b/api_docs/encrypted_saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/encryptedSavedObjects
 title: "encryptedSavedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the encryptedSavedObjects plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'encryptedSavedObjects']
 ---
 import encryptedSavedObjectsObj from './encrypted_saved_objects.devdocs.json';
diff --git a/api_docs/enterprise_search.mdx b/api_docs/enterprise_search.mdx
index d74e7509a5329a..65d10d0825dc09 100644
--- a/api_docs/enterprise_search.mdx
+++ b/api_docs/enterprise_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/enterpriseSearch
 title: "enterpriseSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the enterpriseSearch plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'enterpriseSearch']
 ---
 import enterpriseSearchObj from './enterprise_search.devdocs.json';
diff --git a/api_docs/es_ui_shared.mdx b/api_docs/es_ui_shared.mdx
index 79cb8cd8f1ab55..bfc0712dafc9c9 100644
--- a/api_docs/es_ui_shared.mdx
+++ b/api_docs/es_ui_shared.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/esUiShared
 title: "esUiShared"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the esUiShared plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'esUiShared']
 ---
 import esUiSharedObj from './es_ui_shared.devdocs.json';
diff --git a/api_docs/event_annotation.mdx b/api_docs/event_annotation.mdx
index 291ef13aa8a94b..bb5e46e84bb457 100644
--- a/api_docs/event_annotation.mdx
+++ b/api_docs/event_annotation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventAnnotation
 title: "eventAnnotation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventAnnotation plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventAnnotation']
 ---
 import eventAnnotationObj from './event_annotation.devdocs.json';
diff --git a/api_docs/event_log.devdocs.json b/api_docs/event_log.devdocs.json
index e847693888d031..a0ae8ae8dd26ff 100644
--- a/api_docs/event_log.devdocs.json
+++ b/api_docs/event_log.devdocs.json
@@ -1228,7 +1228,7 @@
               },
               ", options?: Partial<",
               "AggregateOptionsType",
-              "> | undefined, namespaces?: (string | undefined)[] | undefined) => Promise<",
+              "> | undefined, namespaces?: (string | undefined)[] | undefined, includeSpaceAgnostic?: boolean | undefined) => Promise<",
               {
                 "pluginId": "eventLog",
                 "scope": "server",
@@ -1309,6 +1309,21 @@
                 "deprecated": false,
                 "trackAdoption": false,
                 "isRequired": false
+              },
+              {
+                "parentPluginId": "eventLog",
+                "id": "def-server.IEventLogClient.aggregateEventsWithAuthFilter.$5",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "includeSpaceAgnostic",
+                "description": [],
+                "signature": [
+                  "boolean | undefined"
+                ],
+                "path": "x-pack/plugins/event_log/server/types.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": false
               }
             ],
             "returnComment": []
@@ -1499,7 +1514,7 @@
             "label": "data",
             "description": [],
             "signature": [
-              "(Readonly<{ error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; message?: string | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: string | number | undefined; number_of_generated_actions?: string | number | undefined; alert_counts?: Readonly<{ recovered?: string | number | undefined; active?: string | number | undefined; new?: string | number | undefined; } & {}> | undefined; number_of_searches?: string | number | undefined; total_indexing_duration_ms?: string | number | undefined; es_search_duration_ms?: string | number | undefined; total_search_duration_ms?: string | number | undefined; execution_gap_duration_s?: string | number | undefined; rule_type_run_duration_ms?: string | number | undefined; process_alerts_duration_ms?: string | number | undefined; trigger_actions_duration_ms?: string | number | undefined; process_rule_duration_ms?: string | number | undefined; claim_to_start_duration_ms?: string | number | undefined; prepare_rule_duration_ms?: string | number | undefined; total_run_duration_ms?: string | number | undefined; total_enrichment_duration_ms?: string | number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: string | number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; flapping?: boolean | undefined; } & {}> | undefined; version?: string | undefined; alerting?: Readonly<{ status?: string | undefined; outcome?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: string | number | undefined; scheduled?: string | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; space_ids?: string[] | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; rule?: Readonly<{ name?: string | undefined; description?: string | undefined; category?: string | undefined; id?: string | undefined; version?: string | undefined; license?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; category?: string[] | undefined; type?: string[] | undefined; id?: string | undefined; reason?: string | undefined; created?: string | undefined; outcome?: string | undefined; end?: string | undefined; original?: string | undefined; duration?: string | number | undefined; kind?: string | undefined; hash?: string | undefined; code?: string | undefined; url?: string | undefined; action?: string | undefined; severity?: string | number | undefined; dataset?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: string | number | undefined; timezone?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; } & {}> | undefined)[]"
+              "(Readonly<{ error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; message?: string | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: string | number | undefined; number_of_generated_actions?: string | number | undefined; alert_counts?: Readonly<{ recovered?: string | number | undefined; active?: string | number | undefined; new?: string | number | undefined; } & {}> | undefined; number_of_searches?: string | number | undefined; total_indexing_duration_ms?: string | number | undefined; es_search_duration_ms?: string | number | undefined; total_search_duration_ms?: string | number | undefined; execution_gap_duration_s?: string | number | undefined; rule_type_run_duration_ms?: string | number | undefined; process_alerts_duration_ms?: string | number | undefined; trigger_actions_duration_ms?: string | number | undefined; process_rule_duration_ms?: string | number | undefined; claim_to_start_duration_ms?: string | number | undefined; prepare_rule_duration_ms?: string | number | undefined; total_run_duration_ms?: string | number | undefined; total_enrichment_duration_ms?: string | number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: string | number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; flapping?: boolean | undefined; } & {}> | undefined; version?: string | undefined; action?: Readonly<{ name?: string | undefined; id?: string | undefined; execution?: Readonly<{ uuid?: string | undefined; } & {}> | undefined; } & {}> | undefined; alerting?: Readonly<{ status?: string | undefined; outcome?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: string | number | undefined; scheduled?: string | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; space_agnostic?: boolean | undefined; } & {}>[] | undefined; space_ids?: string[] | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; rule?: Readonly<{ name?: string | undefined; description?: string | undefined; category?: string | undefined; id?: string | undefined; version?: string | undefined; license?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; category?: string[] | undefined; type?: string[] | undefined; id?: string | undefined; reason?: string | undefined; created?: string | undefined; outcome?: string | undefined; end?: string | undefined; original?: string | undefined; duration?: string | number | undefined; kind?: string | undefined; hash?: string | undefined; code?: string | undefined; url?: string | undefined; action?: string | undefined; severity?: string | number | undefined; dataset?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: string | number | undefined; timezone?: string | undefined; } & {}> | undefined; } & {}> | undefined)[]"
             ],
             "path": "x-pack/plugins/event_log/server/es/cluster_client_adapter.ts",
             "deprecated": false,
@@ -1519,7 +1534,7 @@
         "label": "IEvent",
         "description": [],
         "signature": [
-          "DeepPartial<DeepWriteable<Readonly<{ error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; message?: string | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: string | number | undefined; number_of_generated_actions?: string | number | undefined; alert_counts?: Readonly<{ recovered?: string | number | undefined; active?: string | number | undefined; new?: string | number | undefined; } & {}> | undefined; number_of_searches?: string | number | undefined; total_indexing_duration_ms?: string | number | undefined; es_search_duration_ms?: string | number | undefined; total_search_duration_ms?: string | number | undefined; execution_gap_duration_s?: string | number | undefined; rule_type_run_duration_ms?: string | number | undefined; process_alerts_duration_ms?: string | number | undefined; trigger_actions_duration_ms?: string | number | undefined; process_rule_duration_ms?: string | number | undefined; claim_to_start_duration_ms?: string | number | undefined; prepare_rule_duration_ms?: string | number | undefined; total_run_duration_ms?: string | number | undefined; total_enrichment_duration_ms?: string | number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: string | number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; flapping?: boolean | undefined; } & {}> | undefined; version?: string | undefined; alerting?: Readonly<{ status?: string | undefined; outcome?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: string | number | undefined; scheduled?: string | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; space_ids?: string[] | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; rule?: Readonly<{ name?: string | undefined; description?: string | undefined; category?: string | undefined; id?: string | undefined; version?: string | undefined; license?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; category?: string[] | undefined; type?: string[] | undefined; id?: string | undefined; reason?: string | undefined; created?: string | undefined; outcome?: string | undefined; end?: string | undefined; original?: string | undefined; duration?: string | number | undefined; kind?: string | undefined; hash?: string | undefined; code?: string | undefined; url?: string | undefined; action?: string | undefined; severity?: string | number | undefined; dataset?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: string | number | undefined; timezone?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; } & {}>>> | undefined"
+          "DeepPartial<DeepWriteable<Readonly<{ error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; message?: string | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: string | number | undefined; number_of_generated_actions?: string | number | undefined; alert_counts?: Readonly<{ recovered?: string | number | undefined; active?: string | number | undefined; new?: string | number | undefined; } & {}> | undefined; number_of_searches?: string | number | undefined; total_indexing_duration_ms?: string | number | undefined; es_search_duration_ms?: string | number | undefined; total_search_duration_ms?: string | number | undefined; execution_gap_duration_s?: string | number | undefined; rule_type_run_duration_ms?: string | number | undefined; process_alerts_duration_ms?: string | number | undefined; trigger_actions_duration_ms?: string | number | undefined; process_rule_duration_ms?: string | number | undefined; claim_to_start_duration_ms?: string | number | undefined; prepare_rule_duration_ms?: string | number | undefined; total_run_duration_ms?: string | number | undefined; total_enrichment_duration_ms?: string | number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: string | number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; flapping?: boolean | undefined; } & {}> | undefined; version?: string | undefined; action?: Readonly<{ name?: string | undefined; id?: string | undefined; execution?: Readonly<{ uuid?: string | undefined; } & {}> | undefined; } & {}> | undefined; alerting?: Readonly<{ status?: string | undefined; outcome?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: string | number | undefined; scheduled?: string | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; space_agnostic?: boolean | undefined; } & {}>[] | undefined; space_ids?: string[] | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; rule?: Readonly<{ name?: string | undefined; description?: string | undefined; category?: string | undefined; id?: string | undefined; version?: string | undefined; license?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; category?: string[] | undefined; type?: string[] | undefined; id?: string | undefined; reason?: string | undefined; created?: string | undefined; outcome?: string | undefined; end?: string | undefined; original?: string | undefined; duration?: string | number | undefined; kind?: string | undefined; hash?: string | undefined; code?: string | undefined; url?: string | undefined; action?: string | undefined; severity?: string | number | undefined; dataset?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: string | number | undefined; timezone?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
         ],
         "path": "x-pack/plugins/event_log/generated/schemas.ts",
         "deprecated": false,
@@ -1534,7 +1549,7 @@
         "label": "IValidatedEvent",
         "description": [],
         "signature": [
-          "Readonly<{ error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; message?: string | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: string | number | undefined; number_of_generated_actions?: string | number | undefined; alert_counts?: Readonly<{ recovered?: string | number | undefined; active?: string | number | undefined; new?: string | number | undefined; } & {}> | undefined; number_of_searches?: string | number | undefined; total_indexing_duration_ms?: string | number | undefined; es_search_duration_ms?: string | number | undefined; total_search_duration_ms?: string | number | undefined; execution_gap_duration_s?: string | number | undefined; rule_type_run_duration_ms?: string | number | undefined; process_alerts_duration_ms?: string | number | undefined; trigger_actions_duration_ms?: string | number | undefined; process_rule_duration_ms?: string | number | undefined; claim_to_start_duration_ms?: string | number | undefined; prepare_rule_duration_ms?: string | number | undefined; total_run_duration_ms?: string | number | undefined; total_enrichment_duration_ms?: string | number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: string | number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; flapping?: boolean | undefined; } & {}> | undefined; version?: string | undefined; alerting?: Readonly<{ status?: string | undefined; outcome?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: string | number | undefined; scheduled?: string | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; } & {}>[] | undefined; space_ids?: string[] | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; rule?: Readonly<{ name?: string | undefined; description?: string | undefined; category?: string | undefined; id?: string | undefined; version?: string | undefined; license?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; category?: string[] | undefined; type?: string[] | undefined; id?: string | undefined; reason?: string | undefined; created?: string | undefined; outcome?: string | undefined; end?: string | undefined; original?: string | undefined; duration?: string | number | undefined; kind?: string | undefined; hash?: string | undefined; code?: string | undefined; url?: string | undefined; action?: string | undefined; severity?: string | number | undefined; dataset?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: string | number | undefined; timezone?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; } & {}> | undefined"
+          "Readonly<{ error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; tags?: string[] | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; message?: string | undefined; kibana?: Readonly<{ alert?: Readonly<{ rule?: Readonly<{ consumer?: string | undefined; execution?: Readonly<{ status?: string | undefined; metrics?: Readonly<{ number_of_triggered_actions?: string | number | undefined; number_of_generated_actions?: string | number | undefined; alert_counts?: Readonly<{ recovered?: string | number | undefined; active?: string | number | undefined; new?: string | number | undefined; } & {}> | undefined; number_of_searches?: string | number | undefined; total_indexing_duration_ms?: string | number | undefined; es_search_duration_ms?: string | number | undefined; total_search_duration_ms?: string | number | undefined; execution_gap_duration_s?: string | number | undefined; rule_type_run_duration_ms?: string | number | undefined; process_alerts_duration_ms?: string | number | undefined; trigger_actions_duration_ms?: string | number | undefined; process_rule_duration_ms?: string | number | undefined; claim_to_start_duration_ms?: string | number | undefined; prepare_rule_duration_ms?: string | number | undefined; total_run_duration_ms?: string | number | undefined; total_enrichment_duration_ms?: string | number | undefined; } & {}> | undefined; uuid?: string | undefined; status_order?: string | number | undefined; } & {}> | undefined; rule_type_id?: string | undefined; } & {}> | undefined; flapping?: boolean | undefined; } & {}> | undefined; version?: string | undefined; action?: Readonly<{ name?: string | undefined; id?: string | undefined; execution?: Readonly<{ uuid?: string | undefined; } & {}> | undefined; } & {}> | undefined; alerting?: Readonly<{ status?: string | undefined; outcome?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; task?: Readonly<{ id?: string | undefined; schedule_delay?: string | number | undefined; scheduled?: string | undefined; } & {}> | undefined; saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; namespace?: string | undefined; rel?: string | undefined; type_id?: string | undefined; space_agnostic?: boolean | undefined; } & {}>[] | undefined; space_ids?: string[] | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; '@timestamp'?: string | undefined; rule?: Readonly<{ name?: string | undefined; description?: string | undefined; category?: string | undefined; id?: string | undefined; version?: string | undefined; license?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; event?: Readonly<{ start?: string | undefined; category?: string[] | undefined; type?: string[] | undefined; id?: string | undefined; reason?: string | undefined; created?: string | undefined; outcome?: string | undefined; end?: string | undefined; original?: string | undefined; duration?: string | number | undefined; kind?: string | undefined; hash?: string | undefined; code?: string | undefined; url?: string | undefined; action?: string | undefined; severity?: string | number | undefined; dataset?: string | undefined; ingested?: string | undefined; module?: string | undefined; provider?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: string | number | undefined; timezone?: string | undefined; } & {}> | undefined; } & {}> | undefined"
         ],
         "path": "x-pack/plugins/event_log/generated/schemas.ts",
         "deprecated": false,
diff --git a/api_docs/event_log.mdx b/api_docs/event_log.mdx
index fc2109c0d7dca2..55a604878d1449 100644
--- a/api_docs/event_log.mdx
+++ b/api_docs/event_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventLog
 title: "eventLog"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the eventLog plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventLog']
 ---
 import eventLogObj from './event_log.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Response Ops](https://github.com/orgs/elastic/teams/response-ops) for q
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 115 | 0 | 115 | 11 |
+| 116 | 0 | 116 | 11 |
 
 ## Server
 
diff --git a/api_docs/expression_error.mdx b/api_docs/expression_error.mdx
index 03dde1c9271345..f44cfffda3f225 100644
--- a/api_docs/expression_error.mdx
+++ b/api_docs/expression_error.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionError
 title: "expressionError"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionError plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionError']
 ---
 import expressionErrorObj from './expression_error.devdocs.json';
diff --git a/api_docs/expression_gauge.mdx b/api_docs/expression_gauge.mdx
index a5727fca7e0851..a04a2957503b2a 100644
--- a/api_docs/expression_gauge.mdx
+++ b/api_docs/expression_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionGauge
 title: "expressionGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionGauge plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionGauge']
 ---
 import expressionGaugeObj from './expression_gauge.devdocs.json';
diff --git a/api_docs/expression_heatmap.mdx b/api_docs/expression_heatmap.mdx
index 836bb3313c2c94..2fadac1a093404 100644
--- a/api_docs/expression_heatmap.mdx
+++ b/api_docs/expression_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionHeatmap
 title: "expressionHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionHeatmap plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionHeatmap']
 ---
 import expressionHeatmapObj from './expression_heatmap.devdocs.json';
diff --git a/api_docs/expression_image.mdx b/api_docs/expression_image.mdx
index 14604257af610b..f05ebe8c92eeb7 100644
--- a/api_docs/expression_image.mdx
+++ b/api_docs/expression_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionImage
 title: "expressionImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionImage plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionImage']
 ---
 import expressionImageObj from './expression_image.devdocs.json';
diff --git a/api_docs/expression_legacy_metric_vis.mdx b/api_docs/expression_legacy_metric_vis.mdx
index bfc5df0096f61a..903e5983afa5ea 100644
--- a/api_docs/expression_legacy_metric_vis.mdx
+++ b/api_docs/expression_legacy_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionLegacyMetricVis
 title: "expressionLegacyMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionLegacyMetricVis plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionLegacyMetricVis']
 ---
 import expressionLegacyMetricVisObj from './expression_legacy_metric_vis.devdocs.json';
diff --git a/api_docs/expression_metric.mdx b/api_docs/expression_metric.mdx
index 3349475198cf6c..ac58336f0cfc1b 100644
--- a/api_docs/expression_metric.mdx
+++ b/api_docs/expression_metric.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetric
 title: "expressionMetric"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetric plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetric']
 ---
 import expressionMetricObj from './expression_metric.devdocs.json';
diff --git a/api_docs/expression_metric_vis.mdx b/api_docs/expression_metric_vis.mdx
index b55cf7dd6a34a3..229f0f2ae93d07 100644
--- a/api_docs/expression_metric_vis.mdx
+++ b/api_docs/expression_metric_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetricVis
 title: "expressionMetricVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionMetricVis plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetricVis']
 ---
 import expressionMetricVisObj from './expression_metric_vis.devdocs.json';
diff --git a/api_docs/expression_partition_vis.mdx b/api_docs/expression_partition_vis.mdx
index 576953499ecf5c..87ae065fedd549 100644
--- a/api_docs/expression_partition_vis.mdx
+++ b/api_docs/expression_partition_vis.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionPartitionVis
 title: "expressionPartitionVis"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionPartitionVis plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionPartitionVis']
 ---
 import expressionPartitionVisObj from './expression_partition_vis.devdocs.json';
diff --git a/api_docs/expression_repeat_image.mdx b/api_docs/expression_repeat_image.mdx
index 87da8eee58ebf4..cf907eaf211a14 100644
--- a/api_docs/expression_repeat_image.mdx
+++ b/api_docs/expression_repeat_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRepeatImage
 title: "expressionRepeatImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRepeatImage plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRepeatImage']
 ---
 import expressionRepeatImageObj from './expression_repeat_image.devdocs.json';
diff --git a/api_docs/expression_reveal_image.mdx b/api_docs/expression_reveal_image.mdx
index ec8c9a1a71a173..97ce462e90ef4e 100644
--- a/api_docs/expression_reveal_image.mdx
+++ b/api_docs/expression_reveal_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRevealImage
 title: "expressionRevealImage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionRevealImage plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRevealImage']
 ---
 import expressionRevealImageObj from './expression_reveal_image.devdocs.json';
diff --git a/api_docs/expression_shape.mdx b/api_docs/expression_shape.mdx
index 660533d209edf6..b18d830e6d9378 100644
--- a/api_docs/expression_shape.mdx
+++ b/api_docs/expression_shape.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionShape
 title: "expressionShape"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionShape plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionShape']
 ---
 import expressionShapeObj from './expression_shape.devdocs.json';
diff --git a/api_docs/expression_tagcloud.mdx b/api_docs/expression_tagcloud.mdx
index 28d1142fed4ec2..f66a0e66466223 100644
--- a/api_docs/expression_tagcloud.mdx
+++ b/api_docs/expression_tagcloud.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionTagcloud
 title: "expressionTagcloud"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionTagcloud plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionTagcloud']
 ---
 import expressionTagcloudObj from './expression_tagcloud.devdocs.json';
diff --git a/api_docs/expression_x_y.mdx b/api_docs/expression_x_y.mdx
index 1e75b8cf5945cc..93691067e1d8e6 100644
--- a/api_docs/expression_x_y.mdx
+++ b/api_docs/expression_x_y.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionXY
 title: "expressionXY"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressionXY plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionXY']
 ---
 import expressionXYObj from './expression_x_y.devdocs.json';
diff --git a/api_docs/expressions.mdx b/api_docs/expressions.mdx
index 8b8ddd01e44e09..b6635cc643d269 100644
--- a/api_docs/expressions.mdx
+++ b/api_docs/expressions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressions
 title: "expressions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the expressions plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressions']
 ---
 import expressionsObj from './expressions.devdocs.json';
diff --git a/api_docs/features.mdx b/api_docs/features.mdx
index 685c5af44bf663..4f153b0d369fa4 100644
--- a/api_docs/features.mdx
+++ b/api_docs/features.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/features
 title: "features"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the features plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'features']
 ---
 import featuresObj from './features.devdocs.json';
diff --git a/api_docs/field_formats.mdx b/api_docs/field_formats.mdx
index 4a995c07595568..2092476ac17bb1 100644
--- a/api_docs/field_formats.mdx
+++ b/api_docs/field_formats.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fieldFormats
 title: "fieldFormats"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fieldFormats plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fieldFormats']
 ---
 import fieldFormatsObj from './field_formats.devdocs.json';
diff --git a/api_docs/file_upload.mdx b/api_docs/file_upload.mdx
index e1ad0971791c62..7cb01a67883d0e 100644
--- a/api_docs/file_upload.mdx
+++ b/api_docs/file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fileUpload
 title: "fileUpload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fileUpload plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fileUpload']
 ---
 import fileUploadObj from './file_upload.devdocs.json';
diff --git a/api_docs/files.mdx b/api_docs/files.mdx
index a68ca7b2dbd978..0ab83d5606956c 100644
--- a/api_docs/files.mdx
+++ b/api_docs/files.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/files
 title: "files"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the files plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'files']
 ---
 import filesObj from './files.devdocs.json';
diff --git a/api_docs/files_management.mdx b/api_docs/files_management.mdx
index e13d523ab4b56a..99cf4542f5de0f 100644
--- a/api_docs/files_management.mdx
+++ b/api_docs/files_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/filesManagement
 title: "filesManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the filesManagement plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'filesManagement']
 ---
 import filesManagementObj from './files_management.devdocs.json';
diff --git a/api_docs/fleet.devdocs.json b/api_docs/fleet.devdocs.json
index 54d1eaeee0c992..f3e224cdb290de 100644
--- a/api_docs/fleet.devdocs.json
+++ b/api_docs/fleet.devdocs.json
@@ -9155,6 +9155,21 @@
             "path": "x-pack/plugins/fleet/common/types/models/agent.ts",
             "deprecated": false,
             "trackAdoption": false
+          },
+          {
+            "parentPluginId": "fleet",
+            "id": "def-common.Agent.metrics",
+            "type": "Object",
+            "tags": [],
+            "label": "metrics",
+            "description": [],
+            "signature": [
+              "AgentMetrics",
+              " | undefined"
+            ],
+            "path": "x-pack/plugins/fleet/common/types/models/agent.ts",
+            "deprecated": false,
+            "trackAdoption": false
           }
         ],
         "initialIsOpen": false
diff --git a/api_docs/fleet.mdx b/api_docs/fleet.mdx
index ed7baca4ce876b..821e254c501563 100644
--- a/api_docs/fleet.mdx
+++ b/api_docs/fleet.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fleet
 title: "fleet"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the fleet plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fleet']
 ---
 import fleetObj from './fleet.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Fleet](https://github.com/orgs/elastic/teams/fleet) for questions regar
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 1039 | 3 | 934 | 24 |
+| 1040 | 3 | 935 | 25 |
 
 ## Client
 
diff --git a/api_docs/global_search.mdx b/api_docs/global_search.mdx
index 654e51d6c43ae2..150d16bb72c931 100644
--- a/api_docs/global_search.mdx
+++ b/api_docs/global_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/globalSearch
 title: "globalSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the globalSearch plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'globalSearch']
 ---
 import globalSearchObj from './global_search.devdocs.json';
diff --git a/api_docs/guided_onboarding.mdx b/api_docs/guided_onboarding.mdx
index 64a6caf49b723a..3a528d8f23559c 100644
--- a/api_docs/guided_onboarding.mdx
+++ b/api_docs/guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/guidedOnboarding
 title: "guidedOnboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the guidedOnboarding plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'guidedOnboarding']
 ---
 import guidedOnboardingObj from './guided_onboarding.devdocs.json';
diff --git a/api_docs/home.mdx b/api_docs/home.mdx
index 77ad2143f7b2a2..2283ab599fa41b 100644
--- a/api_docs/home.mdx
+++ b/api_docs/home.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/home
 title: "home"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the home plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'home']
 ---
 import homeObj from './home.devdocs.json';
diff --git a/api_docs/image_embeddable.mdx b/api_docs/image_embeddable.mdx
index 4440519f019a88..7c4e2831dc9eea 100644
--- a/api_docs/image_embeddable.mdx
+++ b/api_docs/image_embeddable.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/imageEmbeddable
 title: "imageEmbeddable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the imageEmbeddable plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'imageEmbeddable']
 ---
 import imageEmbeddableObj from './image_embeddable.devdocs.json';
diff --git a/api_docs/index_lifecycle_management.mdx b/api_docs/index_lifecycle_management.mdx
index 317230f20ad2c0..3e031c32d4b2dd 100644
--- a/api_docs/index_lifecycle_management.mdx
+++ b/api_docs/index_lifecycle_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexLifecycleManagement
 title: "indexLifecycleManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexLifecycleManagement plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexLifecycleManagement']
 ---
 import indexLifecycleManagementObj from './index_lifecycle_management.devdocs.json';
diff --git a/api_docs/index_management.mdx b/api_docs/index_management.mdx
index 5559e846835759..cb17975618c535 100644
--- a/api_docs/index_management.mdx
+++ b/api_docs/index_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexManagement
 title: "indexManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the indexManagement plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexManagement']
 ---
 import indexManagementObj from './index_management.devdocs.json';
diff --git a/api_docs/infra.devdocs.json b/api_docs/infra.devdocs.json
index 78b72a4e776fa5..a72f1be0fe3348 100644
--- a/api_docs/infra.devdocs.json
+++ b/api_docs/infra.devdocs.json
@@ -337,6 +337,20 @@
           "deprecated": false,
           "trackAdoption": false
         },
+        {
+          "parentPluginId": "infra",
+          "id": "def-public.InfraClientStartExports.telemetry",
+          "type": "Object",
+          "tags": [],
+          "label": "telemetry",
+          "description": [],
+          "signature": [
+            "ITelemetryClient"
+          ],
+          "path": "x-pack/plugins/infra/public/types.ts",
+          "deprecated": false,
+          "trackAdoption": false
+        },
         {
           "parentPluginId": "infra",
           "id": "def-public.InfraClientStartExports.ContainerMetricsTable",
diff --git a/api_docs/infra.mdx b/api_docs/infra.mdx
index 6d60a22acbdc6e..4c0c6adc0c5012 100644
--- a/api_docs/infra.mdx
+++ b/api_docs/infra.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/infra
 title: "infra"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the infra plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'infra']
 ---
 import infraObj from './infra.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Logs and Metrics UI](https://github.com/orgs/elastic/teams/logs-metrics
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 42 | 0 | 39 | 8 |
+| 43 | 0 | 40 | 9 |
 
 ## Client
 
diff --git a/api_docs/inspector.mdx b/api_docs/inspector.mdx
index c1cf59533b5659..0b32fc334b641c 100644
--- a/api_docs/inspector.mdx
+++ b/api_docs/inspector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/inspector
 title: "inspector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the inspector plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'inspector']
 ---
 import inspectorObj from './inspector.devdocs.json';
diff --git a/api_docs/interactive_setup.mdx b/api_docs/interactive_setup.mdx
index 207535b488d0e5..ac6ca29095a6cc 100644
--- a/api_docs/interactive_setup.mdx
+++ b/api_docs/interactive_setup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/interactiveSetup
 title: "interactiveSetup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the interactiveSetup plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'interactiveSetup']
 ---
 import interactiveSetupObj from './interactive_setup.devdocs.json';
diff --git a/api_docs/kbn_ace.mdx b/api_docs/kbn_ace.mdx
index 647c83071adf42..fac86811fdce4e 100644
--- a/api_docs/kbn_ace.mdx
+++ b/api_docs/kbn_ace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ace
 title: "@kbn/ace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ace plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ace']
 ---
 import kbnAceObj from './kbn_ace.devdocs.json';
diff --git a/api_docs/kbn_aiops_components.mdx b/api_docs/kbn_aiops_components.mdx
index 0a861cecc1ec65..9523d4da7a6f78 100644
--- a/api_docs/kbn_aiops_components.mdx
+++ b/api_docs/kbn_aiops_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-components
 title: "@kbn/aiops-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-components plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-components']
 ---
 import kbnAiopsComponentsObj from './kbn_aiops_components.devdocs.json';
diff --git a/api_docs/kbn_aiops_utils.mdx b/api_docs/kbn_aiops_utils.mdx
index e895507a8bf912..3658c5b1c973fb 100644
--- a/api_docs/kbn_aiops_utils.mdx
+++ b/api_docs/kbn_aiops_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-utils
 title: "@kbn/aiops-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/aiops-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-utils']
 ---
 import kbnAiopsUtilsObj from './kbn_aiops_utils.devdocs.json';
diff --git a/api_docs/kbn_alerts.mdx b/api_docs/kbn_alerts.mdx
index cf0d2f46adbec7..ee1c6e83f952ef 100644
--- a/api_docs/kbn_alerts.mdx
+++ b/api_docs/kbn_alerts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerts
 title: "@kbn/alerts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/alerts plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts']
 ---
 import kbnAlertsObj from './kbn_alerts.devdocs.json';
diff --git a/api_docs/kbn_analytics.mdx b/api_docs/kbn_analytics.mdx
index 3608cf3a13b81c..9d3dce0e9d663a 100644
--- a/api_docs/kbn_analytics.mdx
+++ b/api_docs/kbn_analytics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics
 title: "@kbn/analytics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics']
 ---
 import kbnAnalyticsObj from './kbn_analytics.devdocs.json';
diff --git a/api_docs/kbn_analytics_client.devdocs.json b/api_docs/kbn_analytics_client.devdocs.json
index e078afaecdacf0..47bd94ed1644f4 100644
--- a/api_docs/kbn_analytics_client.devdocs.json
+++ b/api_docs/kbn_analytics_client.devdocs.json
@@ -710,6 +710,14 @@
                 "plugin": "fleet",
                 "path": "x-pack/plugins/fleet/server/services/telemetry/fleet_usage_sender.ts"
               },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_client.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_client.ts"
+              },
               {
                 "plugin": "osquery",
                 "path": "x-pack/plugins/osquery/server/lib/telemetry/sender.ts"
@@ -778,6 +786,30 @@
                 "plugin": "security",
                 "path": "x-pack/plugins/security/server/analytics/analytics_service.test.ts"
               },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
+              {
+                "plugin": "infra",
+                "path": "x-pack/plugins/infra/public/services/telemetry/telemetry_service.test.ts"
+              },
               {
                 "plugin": "@kbn/core-status-server-internal",
                 "path": "packages/core/status/core-status-server-internal/src/status_service.test.ts"
diff --git a/api_docs/kbn_analytics_client.mdx b/api_docs/kbn_analytics_client.mdx
index 7b1769cff3cbd9..fe7efff171e88e 100644
--- a/api_docs/kbn_analytics_client.mdx
+++ b/api_docs/kbn_analytics_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-client
 title: "@kbn/analytics-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-client plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-client']
 ---
 import kbnAnalyticsClientObj from './kbn_analytics_client.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
index fcf036f77b5632..22bee408c209a6 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-browser
 title: "@kbn/analytics-shippers-elastic-v3-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-browser']
 ---
 import kbnAnalyticsShippersElasticV3BrowserObj from './kbn_analytics_shippers_elastic_v3_browser.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
index 29a259b8828c7a..e67370d7f53b61 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-common
 title: "@kbn/analytics-shippers-elastic-v3-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-common plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-common']
 ---
 import kbnAnalyticsShippersElasticV3CommonObj from './kbn_analytics_shippers_elastic_v3_common.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
index 9a1c30af89cd0d..ee2ae4c4cf208d 100644
--- a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
+++ b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-server
 title: "@kbn/analytics-shippers-elastic-v3-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-elastic-v3-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-server']
 ---
 import kbnAnalyticsShippersElasticV3ServerObj from './kbn_analytics_shippers_elastic_v3_server.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_fullstory.mdx b/api_docs/kbn_analytics_shippers_fullstory.mdx
index cb8390087c8731..f504e359989fbd 100644
--- a/api_docs/kbn_analytics_shippers_fullstory.mdx
+++ b/api_docs/kbn_analytics_shippers_fullstory.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-fullstory
 title: "@kbn/analytics-shippers-fullstory"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-fullstory plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-fullstory']
 ---
 import kbnAnalyticsShippersFullstoryObj from './kbn_analytics_shippers_fullstory.devdocs.json';
diff --git a/api_docs/kbn_analytics_shippers_gainsight.mdx b/api_docs/kbn_analytics_shippers_gainsight.mdx
index e4c5124db35fd8..33d0840e0d6f0b 100644
--- a/api_docs/kbn_analytics_shippers_gainsight.mdx
+++ b/api_docs/kbn_analytics_shippers_gainsight.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-gainsight
 title: "@kbn/analytics-shippers-gainsight"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/analytics-shippers-gainsight plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-gainsight']
 ---
 import kbnAnalyticsShippersGainsightObj from './kbn_analytics_shippers_gainsight.devdocs.json';
diff --git a/api_docs/kbn_apm_config_loader.mdx b/api_docs/kbn_apm_config_loader.mdx
index 97321b2ba43227..535f185f730e95 100644
--- a/api_docs/kbn_apm_config_loader.mdx
+++ b/api_docs/kbn_apm_config_loader.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-config-loader
 title: "@kbn/apm-config-loader"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-config-loader plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-config-loader']
 ---
 import kbnApmConfigLoaderObj from './kbn_apm_config_loader.devdocs.json';
diff --git a/api_docs/kbn_apm_synthtrace.mdx b/api_docs/kbn_apm_synthtrace.mdx
index 5bdc3f4fc1fca6..b0c73499eb35f1 100644
--- a/api_docs/kbn_apm_synthtrace.mdx
+++ b/api_docs/kbn_apm_synthtrace.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace
 title: "@kbn/apm-synthtrace"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace']
 ---
 import kbnApmSynthtraceObj from './kbn_apm_synthtrace.devdocs.json';
diff --git a/api_docs/kbn_apm_synthtrace_client.mdx b/api_docs/kbn_apm_synthtrace_client.mdx
index bb35b450cc1925..84f2cd32521f7c 100644
--- a/api_docs/kbn_apm_synthtrace_client.mdx
+++ b/api_docs/kbn_apm_synthtrace_client.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace-client
 title: "@kbn/apm-synthtrace-client"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-synthtrace-client plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace-client']
 ---
 import kbnApmSynthtraceClientObj from './kbn_apm_synthtrace_client.devdocs.json';
diff --git a/api_docs/kbn_apm_utils.mdx b/api_docs/kbn_apm_utils.mdx
index b27258335c6918..f34ba6396445d1 100644
--- a/api_docs/kbn_apm_utils.mdx
+++ b/api_docs/kbn_apm_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-utils
 title: "@kbn/apm-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/apm-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-utils']
 ---
 import kbnApmUtilsObj from './kbn_apm_utils.devdocs.json';
diff --git a/api_docs/kbn_axe_config.mdx b/api_docs/kbn_axe_config.mdx
index 0eca8f52fc3df1..66c0531adba68c 100644
--- a/api_docs/kbn_axe_config.mdx
+++ b/api_docs/kbn_axe_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-axe-config
 title: "@kbn/axe-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/axe-config plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/axe-config']
 ---
 import kbnAxeConfigObj from './kbn_axe_config.devdocs.json';
diff --git a/api_docs/kbn_cases_components.mdx b/api_docs/kbn_cases_components.mdx
index 6b2e9df19fa436..22074415bac7a0 100644
--- a/api_docs/kbn_cases_components.mdx
+++ b/api_docs/kbn_cases_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cases-components
 title: "@kbn/cases-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cases-components plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cases-components']
 ---
 import kbnCasesComponentsObj from './kbn_cases_components.devdocs.json';
diff --git a/api_docs/kbn_cell_actions.mdx b/api_docs/kbn_cell_actions.mdx
index 377d46d92f2282..798d1ea47cc443 100644
--- a/api_docs/kbn_cell_actions.mdx
+++ b/api_docs/kbn_cell_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cell-actions
 title: "@kbn/cell-actions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cell-actions plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cell-actions']
 ---
 import kbnCellActionsObj from './kbn_cell_actions.devdocs.json';
diff --git a/api_docs/kbn_chart_icons.mdx b/api_docs/kbn_chart_icons.mdx
index 52af95292454a1..c7e89ef4fda083 100644
--- a/api_docs/kbn_chart_icons.mdx
+++ b/api_docs/kbn_chart_icons.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-chart-icons
 title: "@kbn/chart-icons"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/chart-icons plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/chart-icons']
 ---
 import kbnChartIconsObj from './kbn_chart_icons.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_core.mdx b/api_docs/kbn_ci_stats_core.mdx
index c7505d1eced66b..62fd9645d31ad2 100644
--- a/api_docs/kbn_ci_stats_core.mdx
+++ b/api_docs/kbn_ci_stats_core.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-core
 title: "@kbn/ci-stats-core"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-core plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-core']
 ---
 import kbnCiStatsCoreObj from './kbn_ci_stats_core.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_performance_metrics.mdx b/api_docs/kbn_ci_stats_performance_metrics.mdx
index 54136bd2a7f49e..d41d712332035c 100644
--- a/api_docs/kbn_ci_stats_performance_metrics.mdx
+++ b/api_docs/kbn_ci_stats_performance_metrics.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-performance-metrics
 title: "@kbn/ci-stats-performance-metrics"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-performance-metrics plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-performance-metrics']
 ---
 import kbnCiStatsPerformanceMetricsObj from './kbn_ci_stats_performance_metrics.devdocs.json';
diff --git a/api_docs/kbn_ci_stats_reporter.mdx b/api_docs/kbn_ci_stats_reporter.mdx
index 8d2d4da328de4f..ccd4730a24b7c4 100644
--- a/api_docs/kbn_ci_stats_reporter.mdx
+++ b/api_docs/kbn_ci_stats_reporter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-reporter
 title: "@kbn/ci-stats-reporter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ci-stats-reporter plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-reporter']
 ---
 import kbnCiStatsReporterObj from './kbn_ci_stats_reporter.devdocs.json';
diff --git a/api_docs/kbn_cli_dev_mode.mdx b/api_docs/kbn_cli_dev_mode.mdx
index 5833acfb320bf9..68ff2a75efc683 100644
--- a/api_docs/kbn_cli_dev_mode.mdx
+++ b/api_docs/kbn_cli_dev_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cli-dev-mode
 title: "@kbn/cli-dev-mode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cli-dev-mode plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cli-dev-mode']
 ---
 import kbnCliDevModeObj from './kbn_cli_dev_mode.devdocs.json';
diff --git a/api_docs/kbn_coloring.mdx b/api_docs/kbn_coloring.mdx
index ce6d0657d130b4..72d29bf9709a93 100644
--- a/api_docs/kbn_coloring.mdx
+++ b/api_docs/kbn_coloring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-coloring
 title: "@kbn/coloring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/coloring plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/coloring']
 ---
 import kbnColoringObj from './kbn_coloring.devdocs.json';
diff --git a/api_docs/kbn_config.mdx b/api_docs/kbn_config.mdx
index 476811ca4558b0..8b3dffb1858c56 100644
--- a/api_docs/kbn_config.mdx
+++ b/api_docs/kbn_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config
 title: "@kbn/config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config']
 ---
 import kbnConfigObj from './kbn_config.devdocs.json';
diff --git a/api_docs/kbn_config_mocks.mdx b/api_docs/kbn_config_mocks.mdx
index 80231df0931400..52c56bf87d4a52 100644
--- a/api_docs/kbn_config_mocks.mdx
+++ b/api_docs/kbn_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-mocks
 title: "@kbn/config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-mocks']
 ---
 import kbnConfigMocksObj from './kbn_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_config_schema.mdx b/api_docs/kbn_config_schema.mdx
index 3d28d2b615eb69..222f3df422cbc3 100644
--- a/api_docs/kbn_config_schema.mdx
+++ b/api_docs/kbn_config_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-schema
 title: "@kbn/config-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/config-schema plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-schema']
 ---
 import kbnConfigSchemaObj from './kbn_config_schema.devdocs.json';
diff --git a/api_docs/kbn_content_management_content_editor.mdx b/api_docs/kbn_content_management_content_editor.mdx
index 5254c0366a7489..4a09f794309787 100644
--- a/api_docs/kbn_content_management_content_editor.mdx
+++ b/api_docs/kbn_content_management_content_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-content-editor
 title: "@kbn/content-management-content-editor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-content-editor plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-content-editor']
 ---
 import kbnContentManagementContentEditorObj from './kbn_content_management_content_editor.devdocs.json';
diff --git a/api_docs/kbn_content_management_table_list.mdx b/api_docs/kbn_content_management_table_list.mdx
index 895bf144d26dc7..6af82a887451c2 100644
--- a/api_docs/kbn_content_management_table_list.mdx
+++ b/api_docs/kbn_content_management_table_list.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-table-list
 title: "@kbn/content-management-table-list"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/content-management-table-list plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-table-list']
 ---
 import kbnContentManagementTableListObj from './kbn_content_management_table_list.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser.mdx b/api_docs/kbn_core_analytics_browser.mdx
index 3a32fe0dc523bc..9e766ec2e133b6 100644
--- a/api_docs/kbn_core_analytics_browser.mdx
+++ b/api_docs/kbn_core_analytics_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser
 title: "@kbn/core-analytics-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser']
 ---
 import kbnCoreAnalyticsBrowserObj from './kbn_core_analytics_browser.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_internal.mdx b/api_docs/kbn_core_analytics_browser_internal.mdx
index cd7600238a5c6b..5e2c89aaaa06ff 100644
--- a/api_docs/kbn_core_analytics_browser_internal.mdx
+++ b/api_docs/kbn_core_analytics_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-internal
 title: "@kbn/core-analytics-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-internal']
 ---
 import kbnCoreAnalyticsBrowserInternalObj from './kbn_core_analytics_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_browser_mocks.mdx b/api_docs/kbn_core_analytics_browser_mocks.mdx
index 848a7ab61c7f21..80032ec0235283 100644
--- a/api_docs/kbn_core_analytics_browser_mocks.mdx
+++ b/api_docs/kbn_core_analytics_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-mocks
 title: "@kbn/core-analytics-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-mocks']
 ---
 import kbnCoreAnalyticsBrowserMocksObj from './kbn_core_analytics_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server.mdx b/api_docs/kbn_core_analytics_server.mdx
index 39772b9012db36..6b58db6685a1a3 100644
--- a/api_docs/kbn_core_analytics_server.mdx
+++ b/api_docs/kbn_core_analytics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server
 title: "@kbn/core-analytics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server']
 ---
 import kbnCoreAnalyticsServerObj from './kbn_core_analytics_server.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_internal.mdx b/api_docs/kbn_core_analytics_server_internal.mdx
index b0673db8e595cb..5aa03d4cfe624b 100644
--- a/api_docs/kbn_core_analytics_server_internal.mdx
+++ b/api_docs/kbn_core_analytics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-internal
 title: "@kbn/core-analytics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-internal']
 ---
 import kbnCoreAnalyticsServerInternalObj from './kbn_core_analytics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_analytics_server_mocks.mdx b/api_docs/kbn_core_analytics_server_mocks.mdx
index 931895d86d683c..5f5251fd39c7b2 100644
--- a/api_docs/kbn_core_analytics_server_mocks.mdx
+++ b/api_docs/kbn_core_analytics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-mocks
 title: "@kbn/core-analytics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-analytics-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-mocks']
 ---
 import kbnCoreAnalyticsServerMocksObj from './kbn_core_analytics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser.mdx b/api_docs/kbn_core_application_browser.mdx
index 1b000222f38dfb..64a1af8376e16c 100644
--- a/api_docs/kbn_core_application_browser.mdx
+++ b/api_docs/kbn_core_application_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser
 title: "@kbn/core-application-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser']
 ---
 import kbnCoreApplicationBrowserObj from './kbn_core_application_browser.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_internal.mdx b/api_docs/kbn_core_application_browser_internal.mdx
index 19d0499b0d44b1..f1084c72fd024f 100644
--- a/api_docs/kbn_core_application_browser_internal.mdx
+++ b/api_docs/kbn_core_application_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-internal
 title: "@kbn/core-application-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-internal']
 ---
 import kbnCoreApplicationBrowserInternalObj from './kbn_core_application_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_application_browser_mocks.mdx b/api_docs/kbn_core_application_browser_mocks.mdx
index 13bca83e605e00..7e07f95b9f9d74 100644
--- a/api_docs/kbn_core_application_browser_mocks.mdx
+++ b/api_docs/kbn_core_application_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-mocks
 title: "@kbn/core-application-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-mocks']
 ---
 import kbnCoreApplicationBrowserMocksObj from './kbn_core_application_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_application_common.mdx b/api_docs/kbn_core_application_common.mdx
index f99343223f08a3..db1f77402c1d87 100644
--- a/api_docs/kbn_core_application_common.mdx
+++ b/api_docs/kbn_core_application_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-common
 title: "@kbn/core-application-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-application-common plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-common']
 ---
 import kbnCoreApplicationCommonObj from './kbn_core_application_common.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_internal.mdx b/api_docs/kbn_core_apps_browser_internal.mdx
index 2f932e711b1108..c316f8c6ab3f20 100644
--- a/api_docs/kbn_core_apps_browser_internal.mdx
+++ b/api_docs/kbn_core_apps_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-internal
 title: "@kbn/core-apps-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-internal']
 ---
 import kbnCoreAppsBrowserInternalObj from './kbn_core_apps_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_apps_browser_mocks.mdx b/api_docs/kbn_core_apps_browser_mocks.mdx
index 1529828daf5460..726af557d00b58 100644
--- a/api_docs/kbn_core_apps_browser_mocks.mdx
+++ b/api_docs/kbn_core_apps_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-mocks
 title: "@kbn/core-apps-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-mocks']
 ---
 import kbnCoreAppsBrowserMocksObj from './kbn_core_apps_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_apps_server_internal.mdx b/api_docs/kbn_core_apps_server_internal.mdx
index 183c14f1074b81..ff8abdcb2b50a5 100644
--- a/api_docs/kbn_core_apps_server_internal.mdx
+++ b/api_docs/kbn_core_apps_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-server-internal
 title: "@kbn/core-apps-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-apps-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-server-internal']
 ---
 import kbnCoreAppsServerInternalObj from './kbn_core_apps_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_browser_mocks.mdx b/api_docs/kbn_core_base_browser_mocks.mdx
index 2d43ce87eb23ba..65d3fcd35af2eb 100644
--- a/api_docs/kbn_core_base_browser_mocks.mdx
+++ b/api_docs/kbn_core_base_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-browser-mocks
 title: "@kbn/core-base-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-browser-mocks']
 ---
 import kbnCoreBaseBrowserMocksObj from './kbn_core_base_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_base_common.mdx b/api_docs/kbn_core_base_common.mdx
index 873cef04fdd0f3..12776a9260da13 100644
--- a/api_docs/kbn_core_base_common.mdx
+++ b/api_docs/kbn_core_base_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-common
 title: "@kbn/core-base-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-common plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-common']
 ---
 import kbnCoreBaseCommonObj from './kbn_core_base_common.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_internal.mdx b/api_docs/kbn_core_base_server_internal.mdx
index 098e8edbb8a966..f9418e8420a0d9 100644
--- a/api_docs/kbn_core_base_server_internal.mdx
+++ b/api_docs/kbn_core_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-internal
 title: "@kbn/core-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-internal']
 ---
 import kbnCoreBaseServerInternalObj from './kbn_core_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_base_server_mocks.mdx b/api_docs/kbn_core_base_server_mocks.mdx
index 7b250f1e872145..6a8bee0c7e79bb 100644
--- a/api_docs/kbn_core_base_server_mocks.mdx
+++ b/api_docs/kbn_core_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-mocks
 title: "@kbn/core-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-base-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-mocks']
 ---
 import kbnCoreBaseServerMocksObj from './kbn_core_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_browser_mocks.mdx b/api_docs/kbn_core_capabilities_browser_mocks.mdx
index dc8063c1895e4c..69274413d9f415 100644
--- a/api_docs/kbn_core_capabilities_browser_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-browser-mocks
 title: "@kbn/core-capabilities-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-browser-mocks']
 ---
 import kbnCoreCapabilitiesBrowserMocksObj from './kbn_core_capabilities_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_common.mdx b/api_docs/kbn_core_capabilities_common.mdx
index 2eb70a4ab56b4d..86d77bfdffbc92 100644
--- a/api_docs/kbn_core_capabilities_common.mdx
+++ b/api_docs/kbn_core_capabilities_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-common
 title: "@kbn/core-capabilities-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-common plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-common']
 ---
 import kbnCoreCapabilitiesCommonObj from './kbn_core_capabilities_common.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server.mdx b/api_docs/kbn_core_capabilities_server.mdx
index e2b31bbf1094fd..d3a5adc910f28d 100644
--- a/api_docs/kbn_core_capabilities_server.mdx
+++ b/api_docs/kbn_core_capabilities_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server
 title: "@kbn/core-capabilities-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server']
 ---
 import kbnCoreCapabilitiesServerObj from './kbn_core_capabilities_server.devdocs.json';
diff --git a/api_docs/kbn_core_capabilities_server_mocks.mdx b/api_docs/kbn_core_capabilities_server_mocks.mdx
index 1b568f5f13fb30..09da55bed853c4 100644
--- a/api_docs/kbn_core_capabilities_server_mocks.mdx
+++ b/api_docs/kbn_core_capabilities_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server-mocks
 title: "@kbn/core-capabilities-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-capabilities-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server-mocks']
 ---
 import kbnCoreCapabilitiesServerMocksObj from './kbn_core_capabilities_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser.mdx b/api_docs/kbn_core_chrome_browser.mdx
index f472ed6332be74..03e27d229a0615 100644
--- a/api_docs/kbn_core_chrome_browser.mdx
+++ b/api_docs/kbn_core_chrome_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser
 title: "@kbn/core-chrome-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser']
 ---
 import kbnCoreChromeBrowserObj from './kbn_core_chrome_browser.devdocs.json';
diff --git a/api_docs/kbn_core_chrome_browser_mocks.mdx b/api_docs/kbn_core_chrome_browser_mocks.mdx
index 210d293b7643fe..b981fc083f2500 100644
--- a/api_docs/kbn_core_chrome_browser_mocks.mdx
+++ b/api_docs/kbn_core_chrome_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser-mocks
 title: "@kbn/core-chrome-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-chrome-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser-mocks']
 ---
 import kbnCoreChromeBrowserMocksObj from './kbn_core_chrome_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_config_server_internal.mdx b/api_docs/kbn_core_config_server_internal.mdx
index f9497e608049b5..7c8ecb21590f82 100644
--- a/api_docs/kbn_core_config_server_internal.mdx
+++ b/api_docs/kbn_core_config_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-config-server-internal
 title: "@kbn/core-config-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-config-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-config-server-internal']
 ---
 import kbnCoreConfigServerInternalObj from './kbn_core_config_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser.mdx b/api_docs/kbn_core_custom_branding_browser.mdx
index c41905d6975c73..9e8126faa7eb60 100644
--- a/api_docs/kbn_core_custom_branding_browser.mdx
+++ b/api_docs/kbn_core_custom_branding_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser
 title: "@kbn/core-custom-branding-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser']
 ---
 import kbnCoreCustomBrandingBrowserObj from './kbn_core_custom_branding_browser.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_internal.mdx b/api_docs/kbn_core_custom_branding_browser_internal.mdx
index 4f962aece54028..b52a28ca1c58b9 100644
--- a/api_docs/kbn_core_custom_branding_browser_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-internal
 title: "@kbn/core-custom-branding-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-internal']
 ---
 import kbnCoreCustomBrandingBrowserInternalObj from './kbn_core_custom_branding_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_browser_mocks.mdx b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
index 28552060b6c6b2..9e881465cb9a09 100644
--- a/api_docs/kbn_core_custom_branding_browser_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-mocks
 title: "@kbn/core-custom-branding-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-mocks']
 ---
 import kbnCoreCustomBrandingBrowserMocksObj from './kbn_core_custom_branding_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_common.mdx b/api_docs/kbn_core_custom_branding_common.mdx
index 7add27a8fe2ce4..0d26238cb5473d 100644
--- a/api_docs/kbn_core_custom_branding_common.mdx
+++ b/api_docs/kbn_core_custom_branding_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-common
 title: "@kbn/core-custom-branding-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-common plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-common']
 ---
 import kbnCoreCustomBrandingCommonObj from './kbn_core_custom_branding_common.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server.mdx b/api_docs/kbn_core_custom_branding_server.mdx
index 56d3987a24959e..0dc300439629a2 100644
--- a/api_docs/kbn_core_custom_branding_server.mdx
+++ b/api_docs/kbn_core_custom_branding_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server
 title: "@kbn/core-custom-branding-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server']
 ---
 import kbnCoreCustomBrandingServerObj from './kbn_core_custom_branding_server.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_internal.mdx b/api_docs/kbn_core_custom_branding_server_internal.mdx
index e2d93648e1814a..adf1c10887c671 100644
--- a/api_docs/kbn_core_custom_branding_server_internal.mdx
+++ b/api_docs/kbn_core_custom_branding_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-internal
 title: "@kbn/core-custom-branding-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-internal']
 ---
 import kbnCoreCustomBrandingServerInternalObj from './kbn_core_custom_branding_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_custom_branding_server_mocks.mdx b/api_docs/kbn_core_custom_branding_server_mocks.mdx
index 1819a2f2e49e6d..22dcd664f082e7 100644
--- a/api_docs/kbn_core_custom_branding_server_mocks.mdx
+++ b/api_docs/kbn_core_custom_branding_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-mocks
 title: "@kbn/core-custom-branding-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-custom-branding-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-mocks']
 ---
 import kbnCoreCustomBrandingServerMocksObj from './kbn_core_custom_branding_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser.mdx b/api_docs/kbn_core_deprecations_browser.mdx
index 1d72cb261fe8fc..d0ca52e0c4db16 100644
--- a/api_docs/kbn_core_deprecations_browser.mdx
+++ b/api_docs/kbn_core_deprecations_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser
 title: "@kbn/core-deprecations-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser']
 ---
 import kbnCoreDeprecationsBrowserObj from './kbn_core_deprecations_browser.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_internal.mdx b/api_docs/kbn_core_deprecations_browser_internal.mdx
index 4fa0c0e572d0fd..0342c3cee55894 100644
--- a/api_docs/kbn_core_deprecations_browser_internal.mdx
+++ b/api_docs/kbn_core_deprecations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-internal
 title: "@kbn/core-deprecations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-internal']
 ---
 import kbnCoreDeprecationsBrowserInternalObj from './kbn_core_deprecations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_browser_mocks.mdx b/api_docs/kbn_core_deprecations_browser_mocks.mdx
index 2af5f8ccb7d28e..03acb31d0719d4 100644
--- a/api_docs/kbn_core_deprecations_browser_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-mocks
 title: "@kbn/core-deprecations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-mocks']
 ---
 import kbnCoreDeprecationsBrowserMocksObj from './kbn_core_deprecations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_common.mdx b/api_docs/kbn_core_deprecations_common.mdx
index 553f8f1f00da6d..eced494bc827f5 100644
--- a/api_docs/kbn_core_deprecations_common.mdx
+++ b/api_docs/kbn_core_deprecations_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-common
 title: "@kbn/core-deprecations-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-common plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-common']
 ---
 import kbnCoreDeprecationsCommonObj from './kbn_core_deprecations_common.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server.mdx b/api_docs/kbn_core_deprecations_server.mdx
index a32f121c72c7ca..c7c79d7eddaf90 100644
--- a/api_docs/kbn_core_deprecations_server.mdx
+++ b/api_docs/kbn_core_deprecations_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server
 title: "@kbn/core-deprecations-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server']
 ---
 import kbnCoreDeprecationsServerObj from './kbn_core_deprecations_server.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_internal.mdx b/api_docs/kbn_core_deprecations_server_internal.mdx
index 9d052148bbe1ee..535bc28fd89261 100644
--- a/api_docs/kbn_core_deprecations_server_internal.mdx
+++ b/api_docs/kbn_core_deprecations_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-internal
 title: "@kbn/core-deprecations-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-internal']
 ---
 import kbnCoreDeprecationsServerInternalObj from './kbn_core_deprecations_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_deprecations_server_mocks.mdx b/api_docs/kbn_core_deprecations_server_mocks.mdx
index 19cc520cdd97f5..9c154ed89a3348 100644
--- a/api_docs/kbn_core_deprecations_server_mocks.mdx
+++ b/api_docs/kbn_core_deprecations_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-mocks
 title: "@kbn/core-deprecations-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-deprecations-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-mocks']
 ---
 import kbnCoreDeprecationsServerMocksObj from './kbn_core_deprecations_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser.mdx b/api_docs/kbn_core_doc_links_browser.mdx
index cfe7fc58d8f260..64ed8ea4a392f1 100644
--- a/api_docs/kbn_core_doc_links_browser.mdx
+++ b/api_docs/kbn_core_doc_links_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser
 title: "@kbn/core-doc-links-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser']
 ---
 import kbnCoreDocLinksBrowserObj from './kbn_core_doc_links_browser.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_browser_mocks.mdx b/api_docs/kbn_core_doc_links_browser_mocks.mdx
index d3e5f36af222d7..f0980fd0c0d60b 100644
--- a/api_docs/kbn_core_doc_links_browser_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser-mocks
 title: "@kbn/core-doc-links-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser-mocks']
 ---
 import kbnCoreDocLinksBrowserMocksObj from './kbn_core_doc_links_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server.mdx b/api_docs/kbn_core_doc_links_server.mdx
index 32f3a48ee97613..834a2b4c0cb0bc 100644
--- a/api_docs/kbn_core_doc_links_server.mdx
+++ b/api_docs/kbn_core_doc_links_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server
 title: "@kbn/core-doc-links-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server']
 ---
 import kbnCoreDocLinksServerObj from './kbn_core_doc_links_server.devdocs.json';
diff --git a/api_docs/kbn_core_doc_links_server_mocks.mdx b/api_docs/kbn_core_doc_links_server_mocks.mdx
index 0feff8677eb7ff..d6ea3c3dbcedca 100644
--- a/api_docs/kbn_core_doc_links_server_mocks.mdx
+++ b/api_docs/kbn_core_doc_links_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server-mocks
 title: "@kbn/core-doc-links-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-doc-links-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server-mocks']
 ---
 import kbnCoreDocLinksServerMocksObj from './kbn_core_doc_links_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
index 9744c7e7fe8d9b..ff0e09cb04f184 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-internal
 title: "@kbn/core-elasticsearch-client-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-internal']
 ---
 import kbnCoreElasticsearchClientServerInternalObj from './kbn_core_elasticsearch_client_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
index d3fff24d4de391..7697ff7fcb5d72 100644
--- a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-mocks
 title: "@kbn/core-elasticsearch-client-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-client-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-mocks']
 ---
 import kbnCoreElasticsearchClientServerMocksObj from './kbn_core_elasticsearch_client_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server.mdx b/api_docs/kbn_core_elasticsearch_server.mdx
index 33e7486d780d99..5cc3b38046f306 100644
--- a/api_docs/kbn_core_elasticsearch_server.mdx
+++ b/api_docs/kbn_core_elasticsearch_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server
 title: "@kbn/core-elasticsearch-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server']
 ---
 import kbnCoreElasticsearchServerObj from './kbn_core_elasticsearch_server.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_internal.mdx b/api_docs/kbn_core_elasticsearch_server_internal.mdx
index cde7facd14d47a..3def6c9accfe94 100644
--- a/api_docs/kbn_core_elasticsearch_server_internal.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-internal
 title: "@kbn/core-elasticsearch-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-internal']
 ---
 import kbnCoreElasticsearchServerInternalObj from './kbn_core_elasticsearch_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_elasticsearch_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
index d3a5365988248b..02e845ca5b1b76 100644
--- a/api_docs/kbn_core_elasticsearch_server_mocks.mdx
+++ b/api_docs/kbn_core_elasticsearch_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-mocks
 title: "@kbn/core-elasticsearch-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-elasticsearch-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-mocks']
 ---
 import kbnCoreElasticsearchServerMocksObj from './kbn_core_elasticsearch_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_internal.mdx b/api_docs/kbn_core_environment_server_internal.mdx
index 409cdcd49870c6..bcd2f6fe785906 100644
--- a/api_docs/kbn_core_environment_server_internal.mdx
+++ b/api_docs/kbn_core_environment_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-internal
 title: "@kbn/core-environment-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-internal']
 ---
 import kbnCoreEnvironmentServerInternalObj from './kbn_core_environment_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_environment_server_mocks.mdx b/api_docs/kbn_core_environment_server_mocks.mdx
index b89670e17ae5f6..13930259b84b02 100644
--- a/api_docs/kbn_core_environment_server_mocks.mdx
+++ b/api_docs/kbn_core_environment_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-mocks
 title: "@kbn/core-environment-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-environment-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-mocks']
 ---
 import kbnCoreEnvironmentServerMocksObj from './kbn_core_environment_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser.mdx b/api_docs/kbn_core_execution_context_browser.mdx
index 37296a79ebb59c..b9782ac654b117 100644
--- a/api_docs/kbn_core_execution_context_browser.mdx
+++ b/api_docs/kbn_core_execution_context_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser
 title: "@kbn/core-execution-context-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser']
 ---
 import kbnCoreExecutionContextBrowserObj from './kbn_core_execution_context_browser.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_internal.mdx b/api_docs/kbn_core_execution_context_browser_internal.mdx
index d409c9739834c6..819f665a21d0c6 100644
--- a/api_docs/kbn_core_execution_context_browser_internal.mdx
+++ b/api_docs/kbn_core_execution_context_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-internal
 title: "@kbn/core-execution-context-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-internal']
 ---
 import kbnCoreExecutionContextBrowserInternalObj from './kbn_core_execution_context_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_browser_mocks.mdx b/api_docs/kbn_core_execution_context_browser_mocks.mdx
index 922fedcafe11e8..db447a0679a4d8 100644
--- a/api_docs/kbn_core_execution_context_browser_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-mocks
 title: "@kbn/core-execution-context-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-mocks']
 ---
 import kbnCoreExecutionContextBrowserMocksObj from './kbn_core_execution_context_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_common.mdx b/api_docs/kbn_core_execution_context_common.mdx
index 1f5aabaa166190..1b0e91521177fd 100644
--- a/api_docs/kbn_core_execution_context_common.mdx
+++ b/api_docs/kbn_core_execution_context_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-common
 title: "@kbn/core-execution-context-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-common plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-common']
 ---
 import kbnCoreExecutionContextCommonObj from './kbn_core_execution_context_common.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server.mdx b/api_docs/kbn_core_execution_context_server.mdx
index c8d9ee7269bc50..62ed8b99d97c72 100644
--- a/api_docs/kbn_core_execution_context_server.mdx
+++ b/api_docs/kbn_core_execution_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server
 title: "@kbn/core-execution-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server']
 ---
 import kbnCoreExecutionContextServerObj from './kbn_core_execution_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_internal.mdx b/api_docs/kbn_core_execution_context_server_internal.mdx
index d585b6312d6d95..9802b652335584 100644
--- a/api_docs/kbn_core_execution_context_server_internal.mdx
+++ b/api_docs/kbn_core_execution_context_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-internal
 title: "@kbn/core-execution-context-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-internal']
 ---
 import kbnCoreExecutionContextServerInternalObj from './kbn_core_execution_context_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_execution_context_server_mocks.mdx b/api_docs/kbn_core_execution_context_server_mocks.mdx
index 88c8a458f00fad..19f5f8c79c8629 100644
--- a/api_docs/kbn_core_execution_context_server_mocks.mdx
+++ b/api_docs/kbn_core_execution_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-mocks
 title: "@kbn/core-execution-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-execution-context-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-mocks']
 ---
 import kbnCoreExecutionContextServerMocksObj from './kbn_core_execution_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser.mdx b/api_docs/kbn_core_fatal_errors_browser.mdx
index 3054d95b86f6ab..b54a3b4081f5f0 100644
--- a/api_docs/kbn_core_fatal_errors_browser.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser
 title: "@kbn/core-fatal-errors-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser']
 ---
 import kbnCoreFatalErrorsBrowserObj from './kbn_core_fatal_errors_browser.devdocs.json';
diff --git a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
index 886c87b57eee97..805d4d19251f86 100644
--- a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
+++ b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser-mocks
 title: "@kbn/core-fatal-errors-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-fatal-errors-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser-mocks']
 ---
 import kbnCoreFatalErrorsBrowserMocksObj from './kbn_core_fatal_errors_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser.mdx b/api_docs/kbn_core_http_browser.mdx
index 87b58d6de05c86..81f5d1b60e8400 100644
--- a/api_docs/kbn_core_http_browser.mdx
+++ b/api_docs/kbn_core_http_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser
 title: "@kbn/core-http-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser']
 ---
 import kbnCoreHttpBrowserObj from './kbn_core_http_browser.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_internal.mdx b/api_docs/kbn_core_http_browser_internal.mdx
index 0ef208f015bd39..30281d6ae449e1 100644
--- a/api_docs/kbn_core_http_browser_internal.mdx
+++ b/api_docs/kbn_core_http_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-internal
 title: "@kbn/core-http-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-internal']
 ---
 import kbnCoreHttpBrowserInternalObj from './kbn_core_http_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_browser_mocks.mdx b/api_docs/kbn_core_http_browser_mocks.mdx
index bf50cf43912216..dce9f917dd8c8d 100644
--- a/api_docs/kbn_core_http_browser_mocks.mdx
+++ b/api_docs/kbn_core_http_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-mocks
 title: "@kbn/core-http-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-mocks']
 ---
 import kbnCoreHttpBrowserMocksObj from './kbn_core_http_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_common.mdx b/api_docs/kbn_core_http_common.mdx
index a277903e323c06..007d98bf4219e0 100644
--- a/api_docs/kbn_core_http_common.mdx
+++ b/api_docs/kbn_core_http_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-common
 title: "@kbn/core-http-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-common plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-common']
 ---
 import kbnCoreHttpCommonObj from './kbn_core_http_common.devdocs.json';
diff --git a/api_docs/kbn_core_http_context_server_mocks.mdx b/api_docs/kbn_core_http_context_server_mocks.mdx
index ee17e87ef09ca7..ecfbdab084847b 100644
--- a/api_docs/kbn_core_http_context_server_mocks.mdx
+++ b/api_docs/kbn_core_http_context_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-context-server-mocks
 title: "@kbn/core-http-context-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-context-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-context-server-mocks']
 ---
 import kbnCoreHttpContextServerMocksObj from './kbn_core_http_context_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_request_handler_context_server.mdx b/api_docs/kbn_core_http_request_handler_context_server.mdx
index 94ca69a24b30f1..aa400917eb71a4 100644
--- a/api_docs/kbn_core_http_request_handler_context_server.mdx
+++ b/api_docs/kbn_core_http_request_handler_context_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-request-handler-context-server
 title: "@kbn/core-http-request-handler-context-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-request-handler-context-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-request-handler-context-server']
 ---
 import kbnCoreHttpRequestHandlerContextServerObj from './kbn_core_http_request_handler_context_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server.mdx b/api_docs/kbn_core_http_resources_server.mdx
index 954223310027d6..6776e6987716b5 100644
--- a/api_docs/kbn_core_http_resources_server.mdx
+++ b/api_docs/kbn_core_http_resources_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server
 title: "@kbn/core-http-resources-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server']
 ---
 import kbnCoreHttpResourcesServerObj from './kbn_core_http_resources_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_internal.mdx b/api_docs/kbn_core_http_resources_server_internal.mdx
index 518aad2c5b6096..7e3574a7a78950 100644
--- a/api_docs/kbn_core_http_resources_server_internal.mdx
+++ b/api_docs/kbn_core_http_resources_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-internal
 title: "@kbn/core-http-resources-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-internal']
 ---
 import kbnCoreHttpResourcesServerInternalObj from './kbn_core_http_resources_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_resources_server_mocks.mdx b/api_docs/kbn_core_http_resources_server_mocks.mdx
index dc3cd6de83c1e5..766915cbb30873 100644
--- a/api_docs/kbn_core_http_resources_server_mocks.mdx
+++ b/api_docs/kbn_core_http_resources_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-mocks
 title: "@kbn/core-http-resources-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-resources-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-mocks']
 ---
 import kbnCoreHttpResourcesServerMocksObj from './kbn_core_http_resources_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_internal.mdx b/api_docs/kbn_core_http_router_server_internal.mdx
index b3f7f41ffe8334..019a83b152e20f 100644
--- a/api_docs/kbn_core_http_router_server_internal.mdx
+++ b/api_docs/kbn_core_http_router_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-internal
 title: "@kbn/core-http-router-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-internal']
 ---
 import kbnCoreHttpRouterServerInternalObj from './kbn_core_http_router_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_router_server_mocks.mdx b/api_docs/kbn_core_http_router_server_mocks.mdx
index 8c6969e813f2c3..c8ef99d88dfce0 100644
--- a/api_docs/kbn_core_http_router_server_mocks.mdx
+++ b/api_docs/kbn_core_http_router_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-mocks
 title: "@kbn/core-http-router-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-router-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-mocks']
 ---
 import kbnCoreHttpRouterServerMocksObj from './kbn_core_http_router_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_http_server.mdx b/api_docs/kbn_core_http_server.mdx
index d2526b5cb1059f..f8368d9b5d76ca 100644
--- a/api_docs/kbn_core_http_server.mdx
+++ b/api_docs/kbn_core_http_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server
 title: "@kbn/core-http-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server']
 ---
 import kbnCoreHttpServerObj from './kbn_core_http_server.devdocs.json';
diff --git a/api_docs/kbn_core_http_server_internal.mdx b/api_docs/kbn_core_http_server_internal.mdx
index e62536c2d2a4d4..516f74ee059cc4 100644
--- a/api_docs/kbn_core_http_server_internal.mdx
+++ b/api_docs/kbn_core_http_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-internal
 title: "@kbn/core-http-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-internal']
 ---
 import kbnCoreHttpServerInternalObj from './kbn_core_http_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_http_server_mocks.mdx b/api_docs/kbn_core_http_server_mocks.mdx
index 63b6a2407f6fc5..d5535294fc4b99 100644
--- a/api_docs/kbn_core_http_server_mocks.mdx
+++ b/api_docs/kbn_core_http_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-mocks
 title: "@kbn/core-http-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-http-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-mocks']
 ---
 import kbnCoreHttpServerMocksObj from './kbn_core_http_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser.mdx b/api_docs/kbn_core_i18n_browser.mdx
index 4c6d63a4828c53..65f67046738a90 100644
--- a/api_docs/kbn_core_i18n_browser.mdx
+++ b/api_docs/kbn_core_i18n_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser
 title: "@kbn/core-i18n-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser']
 ---
 import kbnCoreI18nBrowserObj from './kbn_core_i18n_browser.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_browser_mocks.mdx b/api_docs/kbn_core_i18n_browser_mocks.mdx
index cf1254721cb5db..261dfc9f5c2048 100644
--- a/api_docs/kbn_core_i18n_browser_mocks.mdx
+++ b/api_docs/kbn_core_i18n_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser-mocks
 title: "@kbn/core-i18n-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser-mocks']
 ---
 import kbnCoreI18nBrowserMocksObj from './kbn_core_i18n_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server.mdx b/api_docs/kbn_core_i18n_server.mdx
index 625ceb08bcf097..6644269274ede2 100644
--- a/api_docs/kbn_core_i18n_server.mdx
+++ b/api_docs/kbn_core_i18n_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server
 title: "@kbn/core-i18n-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server']
 ---
 import kbnCoreI18nServerObj from './kbn_core_i18n_server.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_internal.mdx b/api_docs/kbn_core_i18n_server_internal.mdx
index 93bdcb9321d86b..071bfeb50e69cc 100644
--- a/api_docs/kbn_core_i18n_server_internal.mdx
+++ b/api_docs/kbn_core_i18n_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-internal
 title: "@kbn/core-i18n-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-internal']
 ---
 import kbnCoreI18nServerInternalObj from './kbn_core_i18n_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_i18n_server_mocks.mdx b/api_docs/kbn_core_i18n_server_mocks.mdx
index 10598881110bf7..cdf16100240370 100644
--- a/api_docs/kbn_core_i18n_server_mocks.mdx
+++ b/api_docs/kbn_core_i18n_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-mocks
 title: "@kbn/core-i18n-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-i18n-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-mocks']
 ---
 import kbnCoreI18nServerMocksObj from './kbn_core_i18n_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
index 2f88cec57f5266..0da436dd13722b 100644
--- a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
+++ b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-injected-metadata-browser-mocks
 title: "@kbn/core-injected-metadata-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-injected-metadata-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-injected-metadata-browser-mocks']
 ---
 import kbnCoreInjectedMetadataBrowserMocksObj from './kbn_core_injected_metadata_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_internal.mdx b/api_docs/kbn_core_integrations_browser_internal.mdx
index 2cba92c218bd4b..06fc4b6f72f792 100644
--- a/api_docs/kbn_core_integrations_browser_internal.mdx
+++ b/api_docs/kbn_core_integrations_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-internal
 title: "@kbn/core-integrations-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-internal']
 ---
 import kbnCoreIntegrationsBrowserInternalObj from './kbn_core_integrations_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_integrations_browser_mocks.mdx b/api_docs/kbn_core_integrations_browser_mocks.mdx
index c6f406e8807931..199da06e16dc7a 100644
--- a/api_docs/kbn_core_integrations_browser_mocks.mdx
+++ b/api_docs/kbn_core_integrations_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-mocks
 title: "@kbn/core-integrations-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-integrations-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-mocks']
 ---
 import kbnCoreIntegrationsBrowserMocksObj from './kbn_core_integrations_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser.mdx b/api_docs/kbn_core_lifecycle_browser.mdx
index 69e573268cbca5..9b6c9a35bc2472 100644
--- a/api_docs/kbn_core_lifecycle_browser.mdx
+++ b/api_docs/kbn_core_lifecycle_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser
 title: "@kbn/core-lifecycle-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser']
 ---
 import kbnCoreLifecycleBrowserObj from './kbn_core_lifecycle_browser.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_browser_mocks.mdx b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
index 274783a40d0814..01a96d04157e7b 100644
--- a/api_docs/kbn_core_lifecycle_browser_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser-mocks
 title: "@kbn/core-lifecycle-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser-mocks']
 ---
 import kbnCoreLifecycleBrowserMocksObj from './kbn_core_lifecycle_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server.mdx b/api_docs/kbn_core_lifecycle_server.mdx
index cfdc040d4e0c14..210800431c1807 100644
--- a/api_docs/kbn_core_lifecycle_server.mdx
+++ b/api_docs/kbn_core_lifecycle_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server
 title: "@kbn/core-lifecycle-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server']
 ---
 import kbnCoreLifecycleServerObj from './kbn_core_lifecycle_server.devdocs.json';
diff --git a/api_docs/kbn_core_lifecycle_server_mocks.mdx b/api_docs/kbn_core_lifecycle_server_mocks.mdx
index cc6400c24d1a29..060fc3df12514d 100644
--- a/api_docs/kbn_core_lifecycle_server_mocks.mdx
+++ b/api_docs/kbn_core_lifecycle_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server-mocks
 title: "@kbn/core-lifecycle-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-lifecycle-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server-mocks']
 ---
 import kbnCoreLifecycleServerMocksObj from './kbn_core_lifecycle_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_browser_mocks.mdx b/api_docs/kbn_core_logging_browser_mocks.mdx
index df6588cb48cff9..f681c2f225cd34 100644
--- a/api_docs/kbn_core_logging_browser_mocks.mdx
+++ b/api_docs/kbn_core_logging_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-browser-mocks
 title: "@kbn/core-logging-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-browser-mocks']
 ---
 import kbnCoreLoggingBrowserMocksObj from './kbn_core_logging_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_logging_common_internal.mdx b/api_docs/kbn_core_logging_common_internal.mdx
index 62a28a0da1b274..fb31a2c42a0f56 100644
--- a/api_docs/kbn_core_logging_common_internal.mdx
+++ b/api_docs/kbn_core_logging_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-common-internal
 title: "@kbn/core-logging-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-common-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-common-internal']
 ---
 import kbnCoreLoggingCommonInternalObj from './kbn_core_logging_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server.mdx b/api_docs/kbn_core_logging_server.mdx
index 664842a6d95e14..a37300afb1b3af 100644
--- a/api_docs/kbn_core_logging_server.mdx
+++ b/api_docs/kbn_core_logging_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server
 title: "@kbn/core-logging-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server']
 ---
 import kbnCoreLoggingServerObj from './kbn_core_logging_server.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server_internal.mdx b/api_docs/kbn_core_logging_server_internal.mdx
index 93f4f02353be29..a86ead740e8495 100644
--- a/api_docs/kbn_core_logging_server_internal.mdx
+++ b/api_docs/kbn_core_logging_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-internal
 title: "@kbn/core-logging-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-internal']
 ---
 import kbnCoreLoggingServerInternalObj from './kbn_core_logging_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_logging_server_mocks.mdx b/api_docs/kbn_core_logging_server_mocks.mdx
index 84e9c85e97666c..33c5afe3a4887d 100644
--- a/api_docs/kbn_core_logging_server_mocks.mdx
+++ b/api_docs/kbn_core_logging_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-mocks
 title: "@kbn/core-logging-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-logging-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-mocks']
 ---
 import kbnCoreLoggingServerMocksObj from './kbn_core_logging_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_internal.mdx b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
index 203ebe611de338..f5b792b3025c1d 100644
--- a/api_docs/kbn_core_metrics_collectors_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-internal
 title: "@kbn/core-metrics-collectors-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-internal']
 ---
 import kbnCoreMetricsCollectorsServerInternalObj from './kbn_core_metrics_collectors_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
index 49b197ea367572..f8f18a24c933b8 100644
--- a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-mocks
 title: "@kbn/core-metrics-collectors-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-collectors-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-mocks']
 ---
 import kbnCoreMetricsCollectorsServerMocksObj from './kbn_core_metrics_collectors_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server.mdx b/api_docs/kbn_core_metrics_server.mdx
index 4d882da48b4037..464e2d46494a74 100644
--- a/api_docs/kbn_core_metrics_server.mdx
+++ b/api_docs/kbn_core_metrics_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server
 title: "@kbn/core-metrics-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server']
 ---
 import kbnCoreMetricsServerObj from './kbn_core_metrics_server.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_internal.mdx b/api_docs/kbn_core_metrics_server_internal.mdx
index e2cb895ca1e8b1..094f75f31c31c9 100644
--- a/api_docs/kbn_core_metrics_server_internal.mdx
+++ b/api_docs/kbn_core_metrics_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-internal
 title: "@kbn/core-metrics-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-internal']
 ---
 import kbnCoreMetricsServerInternalObj from './kbn_core_metrics_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_metrics_server_mocks.mdx b/api_docs/kbn_core_metrics_server_mocks.mdx
index 49b847bc56d471..de7e7f97c8dc41 100644
--- a/api_docs/kbn_core_metrics_server_mocks.mdx
+++ b/api_docs/kbn_core_metrics_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-mocks
 title: "@kbn/core-metrics-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-metrics-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-mocks']
 ---
 import kbnCoreMetricsServerMocksObj from './kbn_core_metrics_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_mount_utils_browser.mdx b/api_docs/kbn_core_mount_utils_browser.mdx
index 7454e4b96f39ba..bf619a78e1e0ce 100644
--- a/api_docs/kbn_core_mount_utils_browser.mdx
+++ b/api_docs/kbn_core_mount_utils_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-mount-utils-browser
 title: "@kbn/core-mount-utils-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-mount-utils-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-mount-utils-browser']
 ---
 import kbnCoreMountUtilsBrowserObj from './kbn_core_mount_utils_browser.devdocs.json';
diff --git a/api_docs/kbn_core_node_server.mdx b/api_docs/kbn_core_node_server.mdx
index 8589ce61a40cab..2db60dd101638e 100644
--- a/api_docs/kbn_core_node_server.mdx
+++ b/api_docs/kbn_core_node_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server
 title: "@kbn/core-node-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server']
 ---
 import kbnCoreNodeServerObj from './kbn_core_node_server.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_internal.mdx b/api_docs/kbn_core_node_server_internal.mdx
index f3fbd7c7b52477..d018c18c3c8912 100644
--- a/api_docs/kbn_core_node_server_internal.mdx
+++ b/api_docs/kbn_core_node_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-internal
 title: "@kbn/core-node-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-internal']
 ---
 import kbnCoreNodeServerInternalObj from './kbn_core_node_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_node_server_mocks.mdx b/api_docs/kbn_core_node_server_mocks.mdx
index 642b8b95caa799..34505b85debed8 100644
--- a/api_docs/kbn_core_node_server_mocks.mdx
+++ b/api_docs/kbn_core_node_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-mocks
 title: "@kbn/core-node-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-node-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-mocks']
 ---
 import kbnCoreNodeServerMocksObj from './kbn_core_node_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser.mdx b/api_docs/kbn_core_notifications_browser.mdx
index 18afafa3e4e493..2319eb24e3236c 100644
--- a/api_docs/kbn_core_notifications_browser.mdx
+++ b/api_docs/kbn_core_notifications_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser
 title: "@kbn/core-notifications-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser']
 ---
 import kbnCoreNotificationsBrowserObj from './kbn_core_notifications_browser.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_internal.mdx b/api_docs/kbn_core_notifications_browser_internal.mdx
index e762f3cc183371..792f9e511e531d 100644
--- a/api_docs/kbn_core_notifications_browser_internal.mdx
+++ b/api_docs/kbn_core_notifications_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-internal
 title: "@kbn/core-notifications-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-internal']
 ---
 import kbnCoreNotificationsBrowserInternalObj from './kbn_core_notifications_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_notifications_browser_mocks.mdx b/api_docs/kbn_core_notifications_browser_mocks.mdx
index 8d744247102dc4..9055549a9a9857 100644
--- a/api_docs/kbn_core_notifications_browser_mocks.mdx
+++ b/api_docs/kbn_core_notifications_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-mocks
 title: "@kbn/core-notifications-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-notifications-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-mocks']
 ---
 import kbnCoreNotificationsBrowserMocksObj from './kbn_core_notifications_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser.mdx b/api_docs/kbn_core_overlays_browser.mdx
index 5fb5df0a165f4b..bef91754d4892f 100644
--- a/api_docs/kbn_core_overlays_browser.mdx
+++ b/api_docs/kbn_core_overlays_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser
 title: "@kbn/core-overlays-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser']
 ---
 import kbnCoreOverlaysBrowserObj from './kbn_core_overlays_browser.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_internal.mdx b/api_docs/kbn_core_overlays_browser_internal.mdx
index 9d736da13c6a2f..bb6a05dfae46db 100644
--- a/api_docs/kbn_core_overlays_browser_internal.mdx
+++ b/api_docs/kbn_core_overlays_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-internal
 title: "@kbn/core-overlays-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-internal']
 ---
 import kbnCoreOverlaysBrowserInternalObj from './kbn_core_overlays_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_overlays_browser_mocks.mdx b/api_docs/kbn_core_overlays_browser_mocks.mdx
index 84186f5aa5e8c5..3f33090639c18b 100644
--- a/api_docs/kbn_core_overlays_browser_mocks.mdx
+++ b/api_docs/kbn_core_overlays_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-mocks
 title: "@kbn/core-overlays-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-overlays-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-mocks']
 ---
 import kbnCoreOverlaysBrowserMocksObj from './kbn_core_overlays_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser.mdx b/api_docs/kbn_core_plugins_browser.mdx
index 09a935a357a96b..228c897892a67e 100644
--- a/api_docs/kbn_core_plugins_browser.mdx
+++ b/api_docs/kbn_core_plugins_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser
 title: "@kbn/core-plugins-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser']
 ---
 import kbnCorePluginsBrowserObj from './kbn_core_plugins_browser.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_browser_mocks.mdx b/api_docs/kbn_core_plugins_browser_mocks.mdx
index 44e109ab96e0d6..abed367940ddd8 100644
--- a/api_docs/kbn_core_plugins_browser_mocks.mdx
+++ b/api_docs/kbn_core_plugins_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser-mocks
 title: "@kbn/core-plugins-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser-mocks']
 ---
 import kbnCorePluginsBrowserMocksObj from './kbn_core_plugins_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server.mdx b/api_docs/kbn_core_plugins_server.mdx
index fe77adc758a76a..9e9e808ed9789a 100644
--- a/api_docs/kbn_core_plugins_server.mdx
+++ b/api_docs/kbn_core_plugins_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server
 title: "@kbn/core-plugins-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server']
 ---
 import kbnCorePluginsServerObj from './kbn_core_plugins_server.devdocs.json';
diff --git a/api_docs/kbn_core_plugins_server_mocks.mdx b/api_docs/kbn_core_plugins_server_mocks.mdx
index c64f8ce4218b70..4fa5e21be6729d 100644
--- a/api_docs/kbn_core_plugins_server_mocks.mdx
+++ b/api_docs/kbn_core_plugins_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server-mocks
 title: "@kbn/core-plugins-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-plugins-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server-mocks']
 ---
 import kbnCorePluginsServerMocksObj from './kbn_core_plugins_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server.mdx b/api_docs/kbn_core_preboot_server.mdx
index a476f68c9a39b5..6db32880dd1caf 100644
--- a/api_docs/kbn_core_preboot_server.mdx
+++ b/api_docs/kbn_core_preboot_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server
 title: "@kbn/core-preboot-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server']
 ---
 import kbnCorePrebootServerObj from './kbn_core_preboot_server.devdocs.json';
diff --git a/api_docs/kbn_core_preboot_server_mocks.mdx b/api_docs/kbn_core_preboot_server_mocks.mdx
index 00147b623fbee4..fc964a4fb5460a 100644
--- a/api_docs/kbn_core_preboot_server_mocks.mdx
+++ b/api_docs/kbn_core_preboot_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server-mocks
 title: "@kbn/core-preboot-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-preboot-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server-mocks']
 ---
 import kbnCorePrebootServerMocksObj from './kbn_core_preboot_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_browser_mocks.mdx b/api_docs/kbn_core_rendering_browser_mocks.mdx
index d462be6b5780ae..9930dae2f0b04f 100644
--- a/api_docs/kbn_core_rendering_browser_mocks.mdx
+++ b/api_docs/kbn_core_rendering_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-browser-mocks
 title: "@kbn/core-rendering-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-browser-mocks']
 ---
 import kbnCoreRenderingBrowserMocksObj from './kbn_core_rendering_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_internal.mdx b/api_docs/kbn_core_rendering_server_internal.mdx
index a35914791ff713..86134874c46c96 100644
--- a/api_docs/kbn_core_rendering_server_internal.mdx
+++ b/api_docs/kbn_core_rendering_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-internal
 title: "@kbn/core-rendering-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-internal']
 ---
 import kbnCoreRenderingServerInternalObj from './kbn_core_rendering_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_rendering_server_mocks.mdx b/api_docs/kbn_core_rendering_server_mocks.mdx
index c35af9a1a24f11..d5a444f71090ff 100644
--- a/api_docs/kbn_core_rendering_server_mocks.mdx
+++ b/api_docs/kbn_core_rendering_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-mocks
 title: "@kbn/core-rendering-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-rendering-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-mocks']
 ---
 import kbnCoreRenderingServerMocksObj from './kbn_core_rendering_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_root_server_internal.mdx b/api_docs/kbn_core_root_server_internal.mdx
index 9d0e6a16bdac08..105aed347dfa9c 100644
--- a/api_docs/kbn_core_root_server_internal.mdx
+++ b/api_docs/kbn_core_root_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-root-server-internal
 title: "@kbn/core-root-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-root-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-root-server-internal']
 ---
 import kbnCoreRootServerInternalObj from './kbn_core_root_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_browser.mdx b/api_docs/kbn_core_saved_objects_api_browser.mdx
index 0b08cf4d4b8d1f..5a16d5efe77011 100644
--- a/api_docs/kbn_core_saved_objects_api_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_api_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-browser
 title: "@kbn/core-saved-objects-api-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-browser']
 ---
 import kbnCoreSavedObjectsApiBrowserObj from './kbn_core_saved_objects_api_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server.mdx b/api_docs/kbn_core_saved_objects_api_server.mdx
index a6f7b8a32b308f..6641a815ba2501 100644
--- a/api_docs/kbn_core_saved_objects_api_server.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server
 title: "@kbn/core-saved-objects-api-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server']
 ---
 import kbnCoreSavedObjectsApiServerObj from './kbn_core_saved_objects_api_server.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server_internal.mdx b/api_docs/kbn_core_saved_objects_api_server_internal.mdx
index 152bf3a7fcf09a..1abd1ea4b0ded2 100644
--- a/api_docs/kbn_core_saved_objects_api_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server-internal
 title: "@kbn/core-saved-objects-api-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server-internal']
 ---
 import kbnCoreSavedObjectsApiServerInternalObj from './kbn_core_saved_objects_api_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
index 5157ab0d0e8a4d..ad3ee348eb01a1 100644
--- a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server-mocks
 title: "@kbn/core-saved-objects-api-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-api-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server-mocks']
 ---
 import kbnCoreSavedObjectsApiServerMocksObj from './kbn_core_saved_objects_api_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_internal.mdx b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
index f2d436180b9869..f1926383ca672d 100644
--- a/api_docs/kbn_core_saved_objects_base_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-internal
 title: "@kbn/core-saved-objects-base-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-internal']
 ---
 import kbnCoreSavedObjectsBaseServerInternalObj from './kbn_core_saved_objects_base_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
index a21e9f0c82eb67..1d1b233d2cee24 100644
--- a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-mocks
 title: "@kbn/core-saved-objects-base-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-base-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-mocks']
 ---
 import kbnCoreSavedObjectsBaseServerMocksObj from './kbn_core_saved_objects_base_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser.mdx b/api_docs/kbn_core_saved_objects_browser.mdx
index 8de23a03d05b88..b1ec0efe5ab13f 100644
--- a/api_docs/kbn_core_saved_objects_browser.mdx
+++ b/api_docs/kbn_core_saved_objects_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser
 title: "@kbn/core-saved-objects-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser']
 ---
 import kbnCoreSavedObjectsBrowserObj from './kbn_core_saved_objects_browser.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_internal.mdx b/api_docs/kbn_core_saved_objects_browser_internal.mdx
index 93077b2ab4e1e8..33fbc5f8f82d63 100644
--- a/api_docs/kbn_core_saved_objects_browser_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-internal
 title: "@kbn/core-saved-objects-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-internal']
 ---
 import kbnCoreSavedObjectsBrowserInternalObj from './kbn_core_saved_objects_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_browser_mocks.mdx b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
index 6802de7eda5cd9..96619cb4cbaa55 100644
--- a/api_docs/kbn_core_saved_objects_browser_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-mocks
 title: "@kbn/core-saved-objects-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-mocks']
 ---
 import kbnCoreSavedObjectsBrowserMocksObj from './kbn_core_saved_objects_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_common.devdocs.json b/api_docs/kbn_core_saved_objects_common.devdocs.json
index c003cedc52ad2b..748f954221ef6f 100644
--- a/api_docs/kbn_core_saved_objects_common.devdocs.json
+++ b/api_docs/kbn_core_saved_objects_common.devdocs.json
@@ -2276,6 +2276,18 @@
             "plugin": "cases",
             "path": "x-pack/plugins/cases/server/common/types.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts"
+          },
           {
             "plugin": "synthetics",
             "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts"
@@ -2348,6 +2360,50 @@
             "plugin": "alerting",
             "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
           {
             "plugin": "fleet",
             "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts"
@@ -4229,6 +4285,14 @@
             "plugin": "lens",
             "path": "x-pack/plugins/lens/public/app_plugin/share_action.ts"
           },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
+          {
+            "plugin": "cases",
+            "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts"
+          },
           {
             "plugin": "@kbn/core-saved-objects-api-server-internal",
             "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts"
diff --git a/api_docs/kbn_core_saved_objects_common.mdx b/api_docs/kbn_core_saved_objects_common.mdx
index ffccec3a507d71..768ef4d59b2572 100644
--- a/api_docs/kbn_core_saved_objects_common.mdx
+++ b/api_docs/kbn_core_saved_objects_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-common
 title: "@kbn/core-saved-objects-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-common plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-common']
 ---
 import kbnCoreSavedObjectsCommonObj from './kbn_core_saved_objects_common.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
index cc62d033aa6e8b..c1ca4b00a40065 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-internal
 title: "@kbn/core-saved-objects-import-export-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-internal']
 ---
 import kbnCoreSavedObjectsImportExportServerInternalObj from './kbn_core_saved_objects_import_export_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
index 5cab7b35648b85..9f2862d610d86e 100644
--- a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-mocks
 title: "@kbn/core-saved-objects-import-export-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-import-export-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-mocks']
 ---
 import kbnCoreSavedObjectsImportExportServerMocksObj from './kbn_core_saved_objects_import_export_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
index b1821791a0b20a..c54bcdb0fda622 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-internal
 title: "@kbn/core-saved-objects-migration-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-internal']
 ---
 import kbnCoreSavedObjectsMigrationServerInternalObj from './kbn_core_saved_objects_migration_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
index f5272120b54786..a7f195711ddf33 100644
--- a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-mocks
 title: "@kbn/core-saved-objects-migration-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-migration-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-mocks']
 ---
 import kbnCoreSavedObjectsMigrationServerMocksObj from './kbn_core_saved_objects_migration_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server.devdocs.json b/api_docs/kbn_core_saved_objects_server.devdocs.json
index bda94ef25320a9..b4dac3d8ec4ea8 100644
--- a/api_docs/kbn_core_saved_objects_server.devdocs.json
+++ b/api_docs/kbn_core_saved_objects_server.devdocs.json
@@ -1751,6 +1751,32 @@
             "children": [],
             "returnComment": []
           },
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.ISavedObjectTypeRegistry.getVisibleToHttpApisTypes",
+            "type": "Function",
+            "tags": [],
+            "label": "getVisibleToHttpApisTypes",
+            "description": [
+              "\nReturns all visible {@link SavedObjectsType | types} exposed to the global SO HTTP APIs\n\nA visibleToHttpApis type is a type that doesn't explicitly define `hidden=true` nor `hiddenFromHttpApis=true` during registration."
+            ],
+            "signature": [
+              "() => ",
+              {
+                "pluginId": "@kbn/core-saved-objects-server",
+                "scope": "common",
+                "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+                "section": "def-common.SavedObjectsType",
+                "text": "SavedObjectsType"
+              },
+              "<any>[]"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/type_registry.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [],
+            "returnComment": []
+          },
           {
             "parentPluginId": "@kbn/core-saved-objects-server",
             "id": "def-common.ISavedObjectTypeRegistry.getAllTypes",
@@ -1973,6 +1999,40 @@
             ],
             "returnComment": []
           },
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.ISavedObjectTypeRegistry.isHiddenFromHttpApis",
+            "type": "Function",
+            "tags": [],
+            "label": "isHiddenFromHttpApis",
+            "description": [
+              "\nReturns the `hiddenFromHttpApis` property for a given type, or `false` if\nthe type is not registered"
+            ],
+            "signature": [
+              "(type: string) => boolean"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/type_registry.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/core-saved-objects-server",
+                "id": "def-common.ISavedObjectTypeRegistry.isHiddenFromHttpApis.$1",
+                "type": "string",
+                "tags": [],
+                "label": "type",
+                "description": [],
+                "signature": [
+                  "string"
+                ],
+                "path": "packages/core/saved-objects/core-saved-objects-server/src/type_registry.ts",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
           {
             "parentPluginId": "@kbn/core-saved-objects-server",
             "id": "def-common.ISavedObjectTypeRegistry.getIndex",
@@ -5427,6 +5487,22 @@
             "deprecated": false,
             "trackAdoption": false
           },
+          {
+            "parentPluginId": "@kbn/core-saved-objects-server",
+            "id": "def-common.SavedObjectsType.hiddenFromHttpApis",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "hiddenFromHttpApis",
+            "description": [
+              "\nIs the type hidden from the http APIs. If `hiddenFromHttpApis:true`, repositories will have access to the type but the type is not exposed via the HTTP APIs.\nIt is recommended to hide types registered with 'hidden=false' from the httpApis for backward compatibility in the HTTP layer.\n"
+            ],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_type.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
           {
             "parentPluginId": "@kbn/core-saved-objects-server",
             "id": "def-common.SavedObjectsType.namespaceType",
diff --git a/api_docs/kbn_core_saved_objects_server.mdx b/api_docs/kbn_core_saved_objects_server.mdx
index 498d44f20b7b1c..53b2d7dcc69150 100644
--- a/api_docs/kbn_core_saved_objects_server.mdx
+++ b/api_docs/kbn_core_saved_objects_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server
 title: "@kbn/core-saved-objects-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server']
 ---
 import kbnCoreSavedObjectsServerObj from './kbn_core_saved_objects_server.devdocs.json';
@@ -21,7 +21,7 @@ Contact Kibana Core for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 325 | 0 | 95 | 1 |
+| 329 | 0 | 96 | 1 |
 
 ## Common
 
diff --git a/api_docs/kbn_core_saved_objects_server_internal.mdx b/api_docs/kbn_core_saved_objects_server_internal.mdx
index 65f6a11727c7d9..e97e6cd8cd6c2d 100644
--- a/api_docs/kbn_core_saved_objects_server_internal.mdx
+++ b/api_docs/kbn_core_saved_objects_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-internal
 title: "@kbn/core-saved-objects-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-internal']
 ---
 import kbnCoreSavedObjectsServerInternalObj from './kbn_core_saved_objects_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_server_mocks.mdx b/api_docs/kbn_core_saved_objects_server_mocks.mdx
index 443f548de4864d..1657ac443b71d7 100644
--- a/api_docs/kbn_core_saved_objects_server_mocks.mdx
+++ b/api_docs/kbn_core_saved_objects_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-mocks
 title: "@kbn/core-saved-objects-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-mocks']
 ---
 import kbnCoreSavedObjectsServerMocksObj from './kbn_core_saved_objects_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_saved_objects_utils_server.mdx b/api_docs/kbn_core_saved_objects_utils_server.mdx
index e08eda23d4c2a8..063d8c1cecbdf7 100644
--- a/api_docs/kbn_core_saved_objects_utils_server.mdx
+++ b/api_docs/kbn_core_saved_objects_utils_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-utils-server
 title: "@kbn/core-saved-objects-utils-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-saved-objects-utils-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-utils-server']
 ---
 import kbnCoreSavedObjectsUtilsServerObj from './kbn_core_saved_objects_utils_server.devdocs.json';
diff --git a/api_docs/kbn_core_status_common.mdx b/api_docs/kbn_core_status_common.mdx
index e5652924ff4dbe..1fc00a20989124 100644
--- a/api_docs/kbn_core_status_common.mdx
+++ b/api_docs/kbn_core_status_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common
 title: "@kbn/core-status-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common']
 ---
 import kbnCoreStatusCommonObj from './kbn_core_status_common.devdocs.json';
diff --git a/api_docs/kbn_core_status_common_internal.mdx b/api_docs/kbn_core_status_common_internal.mdx
index b6e53b6f864f76..c7f2f42f724ec6 100644
--- a/api_docs/kbn_core_status_common_internal.mdx
+++ b/api_docs/kbn_core_status_common_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common-internal
 title: "@kbn/core-status-common-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-common-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common-internal']
 ---
 import kbnCoreStatusCommonInternalObj from './kbn_core_status_common_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server.mdx b/api_docs/kbn_core_status_server.mdx
index 3ffd9064a22da5..aa8ff77011a2e5 100644
--- a/api_docs/kbn_core_status_server.mdx
+++ b/api_docs/kbn_core_status_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server
 title: "@kbn/core-status-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server']
 ---
 import kbnCoreStatusServerObj from './kbn_core_status_server.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_internal.mdx b/api_docs/kbn_core_status_server_internal.mdx
index 2987aadb73ffaa..6d8279fdebe49a 100644
--- a/api_docs/kbn_core_status_server_internal.mdx
+++ b/api_docs/kbn_core_status_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-internal
 title: "@kbn/core-status-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-internal']
 ---
 import kbnCoreStatusServerInternalObj from './kbn_core_status_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_status_server_mocks.mdx b/api_docs/kbn_core_status_server_mocks.mdx
index 376a8506571434..2f2c50e13ce653 100644
--- a/api_docs/kbn_core_status_server_mocks.mdx
+++ b/api_docs/kbn_core_status_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-mocks
 title: "@kbn/core-status-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-status-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-mocks']
 ---
 import kbnCoreStatusServerMocksObj from './kbn_core_status_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
index 4796e7fc71691a..afea67842ab80c 100644
--- a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
+++ b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-deprecations-getters
 title: "@kbn/core-test-helpers-deprecations-getters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-deprecations-getters plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-deprecations-getters']
 ---
 import kbnCoreTestHelpersDeprecationsGettersObj from './kbn_core_test_helpers_deprecations_getters.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
index 8d108bf8ebea8a..c728a8ce7fea34 100644
--- a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
+++ b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-http-setup-browser
 title: "@kbn/core-test-helpers-http-setup-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-http-setup-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-http-setup-browser']
 ---
 import kbnCoreTestHelpersHttpSetupBrowserObj from './kbn_core_test_helpers_http_setup_browser.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_kbn_server.mdx b/api_docs/kbn_core_test_helpers_kbn_server.mdx
index 9d1522dc7f37f7..f4cf62e8bf3d39 100644
--- a/api_docs/kbn_core_test_helpers_kbn_server.mdx
+++ b/api_docs/kbn_core_test_helpers_kbn_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-kbn-server
 title: "@kbn/core-test-helpers-kbn-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-kbn-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-kbn-server']
 ---
 import kbnCoreTestHelpersKbnServerObj from './kbn_core_test_helpers_kbn_server.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
index 4b677a212118c0..4d858126647fab 100644
--- a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
+++ b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-so-type-serializer
 title: "@kbn/core-test-helpers-so-type-serializer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-so-type-serializer plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-so-type-serializer']
 ---
 import kbnCoreTestHelpersSoTypeSerializerObj from './kbn_core_test_helpers_so_type_serializer.devdocs.json';
diff --git a/api_docs/kbn_core_test_helpers_test_utils.devdocs.json b/api_docs/kbn_core_test_helpers_test_utils.devdocs.json
index 19a3e987a1c08c..062b442c0c8d17 100644
--- a/api_docs/kbn_core_test_helpers_test_utils.devdocs.json
+++ b/api_docs/kbn_core_test_helpers_test_utils.devdocs.json
@@ -60,6 +60,84 @@
         "returnComment": [],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/core-test-helpers-test-utils",
+        "id": "def-common.createHiddenTypeVariants",
+        "type": "Function",
+        "tags": [],
+        "label": "createHiddenTypeVariants",
+        "description": [],
+        "signature": [
+          "(createOptions: { name: string; hide?: boolean | undefined; hideFromHttpApis?: boolean | undefined; }) => ",
+          {
+            "pluginId": "@kbn/core-saved-objects-server",
+            "scope": "common",
+            "docId": "kibKbnCoreSavedObjectsServerPluginApi",
+            "section": "def-common.SavedObjectsType",
+            "text": "SavedObjectsType"
+          },
+          "<any>"
+        ],
+        "path": "packages/core/test-helpers/core-test-helpers-test-utils/src/create_hidden_type_variants.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/core-test-helpers-test-utils",
+            "id": "def-common.createHiddenTypeVariants.$1",
+            "type": "Object",
+            "tags": [],
+            "label": "createOptions",
+            "description": [],
+            "path": "packages/core/test-helpers/core-test-helpers-test-utils/src/create_hidden_type_variants.ts",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "@kbn/core-test-helpers-test-utils",
+                "id": "def-common.createHiddenTypeVariants.$1.name",
+                "type": "string",
+                "tags": [],
+                "label": "name",
+                "description": [],
+                "path": "packages/core/test-helpers/core-test-helpers-test-utils/src/create_hidden_type_variants.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "@kbn/core-test-helpers-test-utils",
+                "id": "def-common.createHiddenTypeVariants.$1.hide",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "hide",
+                "description": [],
+                "signature": [
+                  "boolean | undefined"
+                ],
+                "path": "packages/core/test-helpers/core-test-helpers-test-utils/src/create_hidden_type_variants.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              },
+              {
+                "parentPluginId": "@kbn/core-test-helpers-test-utils",
+                "id": "def-common.createHiddenTypeVariants.$1.hideFromHttpApis",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "hideFromHttpApis",
+                "description": [],
+                "signature": [
+                  "boolean | undefined"
+                ],
+                "path": "packages/core/test-helpers/core-test-helpers-test-utils/src/create_hidden_type_variants.ts",
+                "deprecated": false,
+                "trackAdoption": false
+              }
+            ]
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/core-test-helpers-test-utils",
         "id": "def-common.setupServer",
diff --git a/api_docs/kbn_core_test_helpers_test_utils.mdx b/api_docs/kbn_core_test_helpers_test_utils.mdx
index 984f1a813ecf05..65fa5075b909ab 100644
--- a/api_docs/kbn_core_test_helpers_test_utils.mdx
+++ b/api_docs/kbn_core_test_helpers_test_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-test-utils
 title: "@kbn/core-test-helpers-test-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-test-helpers-test-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-test-utils']
 ---
 import kbnCoreTestHelpersTestUtilsObj from './kbn_core_test_helpers_test_utils.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Owner missing] for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 4 | 0 | 4 | 0 |
+| 9 | 0 | 9 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_core_theme_browser.mdx b/api_docs/kbn_core_theme_browser.mdx
index 5fde0f497a4f6b..fd90e7d6443ad0 100644
--- a/api_docs/kbn_core_theme_browser.mdx
+++ b/api_docs/kbn_core_theme_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser
 title: "@kbn/core-theme-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser']
 ---
 import kbnCoreThemeBrowserObj from './kbn_core_theme_browser.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser_internal.mdx b/api_docs/kbn_core_theme_browser_internal.mdx
index 2917abdc32db59..d97e70cd225d1c 100644
--- a/api_docs/kbn_core_theme_browser_internal.mdx
+++ b/api_docs/kbn_core_theme_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser-internal
 title: "@kbn/core-theme-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser-internal']
 ---
 import kbnCoreThemeBrowserInternalObj from './kbn_core_theme_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_theme_browser_mocks.mdx b/api_docs/kbn_core_theme_browser_mocks.mdx
index a117efe0aa9ad2..dd5793ef7c4af0 100644
--- a/api_docs/kbn_core_theme_browser_mocks.mdx
+++ b/api_docs/kbn_core_theme_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser-mocks
 title: "@kbn/core-theme-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-theme-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser-mocks']
 ---
 import kbnCoreThemeBrowserMocksObj from './kbn_core_theme_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser.mdx b/api_docs/kbn_core_ui_settings_browser.mdx
index 7a064c001fdddb..93d4939ec91f4e 100644
--- a/api_docs/kbn_core_ui_settings_browser.mdx
+++ b/api_docs/kbn_core_ui_settings_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser
 title: "@kbn/core-ui-settings-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser']
 ---
 import kbnCoreUiSettingsBrowserObj from './kbn_core_ui_settings_browser.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_internal.mdx b/api_docs/kbn_core_ui_settings_browser_internal.mdx
index 9f60fb3ca56557..2e858c6a0873d5 100644
--- a/api_docs/kbn_core_ui_settings_browser_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-internal
 title: "@kbn/core-ui-settings-browser-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-internal']
 ---
 import kbnCoreUiSettingsBrowserInternalObj from './kbn_core_ui_settings_browser_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_browser_mocks.mdx b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
index 025fe2b2ccd857..842158f180cc9d 100644
--- a/api_docs/kbn_core_ui_settings_browser_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_browser_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-mocks
 title: "@kbn/core-ui-settings-browser-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-browser-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-mocks']
 ---
 import kbnCoreUiSettingsBrowserMocksObj from './kbn_core_ui_settings_browser_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_common.mdx b/api_docs/kbn_core_ui_settings_common.mdx
index 12f827a8d3e22a..e5b20fe13d50b2 100644
--- a/api_docs/kbn_core_ui_settings_common.mdx
+++ b/api_docs/kbn_core_ui_settings_common.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-common
 title: "@kbn/core-ui-settings-common"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-common plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-common']
 ---
 import kbnCoreUiSettingsCommonObj from './kbn_core_ui_settings_common.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server.mdx b/api_docs/kbn_core_ui_settings_server.mdx
index 6ac60a431b0274..05ac4447ffd396 100644
--- a/api_docs/kbn_core_ui_settings_server.mdx
+++ b/api_docs/kbn_core_ui_settings_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server
 title: "@kbn/core-ui-settings-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server']
 ---
 import kbnCoreUiSettingsServerObj from './kbn_core_ui_settings_server.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_internal.mdx b/api_docs/kbn_core_ui_settings_server_internal.mdx
index db6593bca5669d..bab23e0a2500d3 100644
--- a/api_docs/kbn_core_ui_settings_server_internal.mdx
+++ b/api_docs/kbn_core_ui_settings_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-internal
 title: "@kbn/core-ui-settings-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-internal']
 ---
 import kbnCoreUiSettingsServerInternalObj from './kbn_core_ui_settings_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_ui_settings_server_mocks.mdx b/api_docs/kbn_core_ui_settings_server_mocks.mdx
index 9af9f2624fdd34..7e26b80997763b 100644
--- a/api_docs/kbn_core_ui_settings_server_mocks.mdx
+++ b/api_docs/kbn_core_ui_settings_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-mocks
 title: "@kbn/core-ui-settings-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-ui-settings-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-mocks']
 ---
 import kbnCoreUiSettingsServerMocksObj from './kbn_core_ui_settings_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server.mdx b/api_docs/kbn_core_usage_data_server.mdx
index 76075508b2a44d..69cbad0a2203e8 100644
--- a/api_docs/kbn_core_usage_data_server.mdx
+++ b/api_docs/kbn_core_usage_data_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server
 title: "@kbn/core-usage-data-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server']
 ---
 import kbnCoreUsageDataServerObj from './kbn_core_usage_data_server.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_internal.mdx b/api_docs/kbn_core_usage_data_server_internal.mdx
index 9f06f3559ee293..8738ce3716ab74 100644
--- a/api_docs/kbn_core_usage_data_server_internal.mdx
+++ b/api_docs/kbn_core_usage_data_server_internal.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-internal
 title: "@kbn/core-usage-data-server-internal"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-internal plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-internal']
 ---
 import kbnCoreUsageDataServerInternalObj from './kbn_core_usage_data_server_internal.devdocs.json';
diff --git a/api_docs/kbn_core_usage_data_server_mocks.mdx b/api_docs/kbn_core_usage_data_server_mocks.mdx
index 54536fb0a1d4f1..fb415f6540e289 100644
--- a/api_docs/kbn_core_usage_data_server_mocks.mdx
+++ b/api_docs/kbn_core_usage_data_server_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-mocks
 title: "@kbn/core-usage-data-server-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/core-usage-data-server-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-mocks']
 ---
 import kbnCoreUsageDataServerMocksObj from './kbn_core_usage_data_server_mocks.devdocs.json';
diff --git a/api_docs/kbn_crypto.mdx b/api_docs/kbn_crypto.mdx
index 496c0c4f87d854..ca954ce0af387f 100644
--- a/api_docs/kbn_crypto.mdx
+++ b/api_docs/kbn_crypto.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto
 title: "@kbn/crypto"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto']
 ---
 import kbnCryptoObj from './kbn_crypto.devdocs.json';
diff --git a/api_docs/kbn_crypto_browser.mdx b/api_docs/kbn_crypto_browser.mdx
index d107ebc63b5fb3..a88fe8da6ab969 100644
--- a/api_docs/kbn_crypto_browser.mdx
+++ b/api_docs/kbn_crypto_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto-browser
 title: "@kbn/crypto-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/crypto-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto-browser']
 ---
 import kbnCryptoBrowserObj from './kbn_crypto_browser.devdocs.json';
diff --git a/api_docs/kbn_cypress_config.mdx b/api_docs/kbn_cypress_config.mdx
index 9ef92d10cc3e02..92b77f212f1f63 100644
--- a/api_docs/kbn_cypress_config.mdx
+++ b/api_docs/kbn_cypress_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cypress-config
 title: "@kbn/cypress-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/cypress-config plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cypress-config']
 ---
 import kbnCypressConfigObj from './kbn_cypress_config.devdocs.json';
diff --git a/api_docs/kbn_datemath.mdx b/api_docs/kbn_datemath.mdx
index 39e105ac7457bd..0a775810aa3701 100644
--- a/api_docs/kbn_datemath.mdx
+++ b/api_docs/kbn_datemath.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-datemath
 title: "@kbn/datemath"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/datemath plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/datemath']
 ---
 import kbnDatemathObj from './kbn_datemath.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_errors.mdx b/api_docs/kbn_dev_cli_errors.mdx
index b4d658801f863f..03346fd31c1f6a 100644
--- a/api_docs/kbn_dev_cli_errors.mdx
+++ b/api_docs/kbn_dev_cli_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-errors
 title: "@kbn/dev-cli-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-errors plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-errors']
 ---
 import kbnDevCliErrorsObj from './kbn_dev_cli_errors.devdocs.json';
diff --git a/api_docs/kbn_dev_cli_runner.mdx b/api_docs/kbn_dev_cli_runner.mdx
index 9a20fc6293d541..9b8b589af34d8b 100644
--- a/api_docs/kbn_dev_cli_runner.mdx
+++ b/api_docs/kbn_dev_cli_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-runner
 title: "@kbn/dev-cli-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-cli-runner plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-runner']
 ---
 import kbnDevCliRunnerObj from './kbn_dev_cli_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_proc_runner.mdx b/api_docs/kbn_dev_proc_runner.mdx
index 36b94669e7b4df..b1d312a5768a5a 100644
--- a/api_docs/kbn_dev_proc_runner.mdx
+++ b/api_docs/kbn_dev_proc_runner.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-proc-runner
 title: "@kbn/dev-proc-runner"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-proc-runner plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-proc-runner']
 ---
 import kbnDevProcRunnerObj from './kbn_dev_proc_runner.devdocs.json';
diff --git a/api_docs/kbn_dev_utils.mdx b/api_docs/kbn_dev_utils.mdx
index 1701745ef59cfd..22ad4c8e3b367c 100644
--- a/api_docs/kbn_dev_utils.mdx
+++ b/api_docs/kbn_dev_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-utils
 title: "@kbn/dev-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/dev-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-utils']
 ---
 import kbnDevUtilsObj from './kbn_dev_utils.devdocs.json';
diff --git a/api_docs/kbn_doc_links.mdx b/api_docs/kbn_doc_links.mdx
index e842cad2f799a8..80fb1ae2f83b8d 100644
--- a/api_docs/kbn_doc_links.mdx
+++ b/api_docs/kbn_doc_links.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-doc-links
 title: "@kbn/doc-links"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/doc-links plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/doc-links']
 ---
 import kbnDocLinksObj from './kbn_doc_links.devdocs.json';
diff --git a/api_docs/kbn_docs_utils.mdx b/api_docs/kbn_docs_utils.mdx
index 10110ac3f8cac9..58c7a91d1e432e 100644
--- a/api_docs/kbn_docs_utils.mdx
+++ b/api_docs/kbn_docs_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-docs-utils
 title: "@kbn/docs-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/docs-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/docs-utils']
 ---
 import kbnDocsUtilsObj from './kbn_docs_utils.devdocs.json';
diff --git a/api_docs/kbn_ebt_tools.mdx b/api_docs/kbn_ebt_tools.mdx
index 31c1ab1c0d5d00..a165433669f84e 100644
--- a/api_docs/kbn_ebt_tools.mdx
+++ b/api_docs/kbn_ebt_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ebt-tools
 title: "@kbn/ebt-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ebt-tools plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ebt-tools']
 ---
 import kbnEbtToolsObj from './kbn_ebt_tools.devdocs.json';
diff --git a/api_docs/kbn_ecs.mdx b/api_docs/kbn_ecs.mdx
index 124c46468f7ee2..08bc679364971e 100644
--- a/api_docs/kbn_ecs.mdx
+++ b/api_docs/kbn_ecs.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ecs
 title: "@kbn/ecs"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ecs plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ecs']
 ---
 import kbnEcsObj from './kbn_ecs.devdocs.json';
diff --git a/api_docs/kbn_es.mdx b/api_docs/kbn_es.mdx
index d641daaad2c71f..715bfaf2a8d842 100644
--- a/api_docs/kbn_es.mdx
+++ b/api_docs/kbn_es.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es
 title: "@kbn/es"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es']
 ---
 import kbnEsObj from './kbn_es.devdocs.json';
diff --git a/api_docs/kbn_es_archiver.mdx b/api_docs/kbn_es_archiver.mdx
index 23d0777f86cfbd..77840497e205a1 100644
--- a/api_docs/kbn_es_archiver.mdx
+++ b/api_docs/kbn_es_archiver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-archiver
 title: "@kbn/es-archiver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-archiver plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-archiver']
 ---
 import kbnEsArchiverObj from './kbn_es_archiver.devdocs.json';
diff --git a/api_docs/kbn_es_errors.mdx b/api_docs/kbn_es_errors.mdx
index c6fd6f8989ba10..5e8e2ff6f15dca 100644
--- a/api_docs/kbn_es_errors.mdx
+++ b/api_docs/kbn_es_errors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-errors
 title: "@kbn/es-errors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-errors plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-errors']
 ---
 import kbnEsErrorsObj from './kbn_es_errors.devdocs.json';
diff --git a/api_docs/kbn_es_query.mdx b/api_docs/kbn_es_query.mdx
index fd96d569985ee0..9d9f179978bc3b 100644
--- a/api_docs/kbn_es_query.mdx
+++ b/api_docs/kbn_es_query.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-query
 title: "@kbn/es-query"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-query plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-query']
 ---
 import kbnEsQueryObj from './kbn_es_query.devdocs.json';
diff --git a/api_docs/kbn_es_types.mdx b/api_docs/kbn_es_types.mdx
index 7927337a931745..ec25924354dd6a 100644
--- a/api_docs/kbn_es_types.mdx
+++ b/api_docs/kbn_es_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-types
 title: "@kbn/es-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/es-types plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-types']
 ---
 import kbnEsTypesObj from './kbn_es_types.devdocs.json';
diff --git a/api_docs/kbn_eslint_plugin_imports.mdx b/api_docs/kbn_eslint_plugin_imports.mdx
index 1deab7ed261f5c..4b1d7030c1d7ec 100644
--- a/api_docs/kbn_eslint_plugin_imports.mdx
+++ b/api_docs/kbn_eslint_plugin_imports.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-eslint-plugin-imports
 title: "@kbn/eslint-plugin-imports"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/eslint-plugin-imports plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/eslint-plugin-imports']
 ---
 import kbnEslintPluginImportsObj from './kbn_eslint_plugin_imports.devdocs.json';
diff --git a/api_docs/kbn_field_types.mdx b/api_docs/kbn_field_types.mdx
index 7b31fab5cdbb26..a9e8aa9f8ca4c0 100644
--- a/api_docs/kbn_field_types.mdx
+++ b/api_docs/kbn_field_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-field-types
 title: "@kbn/field-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/field-types plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/field-types']
 ---
 import kbnFieldTypesObj from './kbn_field_types.devdocs.json';
diff --git a/api_docs/kbn_find_used_node_modules.mdx b/api_docs/kbn_find_used_node_modules.mdx
index 51be1282f94a49..a4845ffedca9ed 100644
--- a/api_docs/kbn_find_used_node_modules.mdx
+++ b/api_docs/kbn_find_used_node_modules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-find-used-node-modules
 title: "@kbn/find-used-node-modules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/find-used-node-modules plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/find-used-node-modules']
 ---
 import kbnFindUsedNodeModulesObj from './kbn_find_used_node_modules.devdocs.json';
diff --git a/api_docs/kbn_ftr_common_functional_services.mdx b/api_docs/kbn_ftr_common_functional_services.mdx
index 7254847469eea6..b77c117435bcb0 100644
--- a/api_docs/kbn_ftr_common_functional_services.mdx
+++ b/api_docs/kbn_ftr_common_functional_services.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ftr-common-functional-services
 title: "@kbn/ftr-common-functional-services"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ftr-common-functional-services plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ftr-common-functional-services']
 ---
 import kbnFtrCommonFunctionalServicesObj from './kbn_ftr_common_functional_services.devdocs.json';
diff --git a/api_docs/kbn_generate.mdx b/api_docs/kbn_generate.mdx
index db0c85be22a924..ea21d29eb45486 100644
--- a/api_docs/kbn_generate.mdx
+++ b/api_docs/kbn_generate.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate
 title: "@kbn/generate"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/generate plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate']
 ---
 import kbnGenerateObj from './kbn_generate.devdocs.json';
diff --git a/api_docs/kbn_get_repo_files.mdx b/api_docs/kbn_get_repo_files.mdx
index 571a2b46d4265e..991d96a252e8d8 100644
--- a/api_docs/kbn_get_repo_files.mdx
+++ b/api_docs/kbn_get_repo_files.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-get-repo-files
 title: "@kbn/get-repo-files"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/get-repo-files plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/get-repo-files']
 ---
 import kbnGetRepoFilesObj from './kbn_get_repo_files.devdocs.json';
diff --git a/api_docs/kbn_guided_onboarding.mdx b/api_docs/kbn_guided_onboarding.mdx
index 38490c1d489fb5..fda449bd2b776c 100644
--- a/api_docs/kbn_guided_onboarding.mdx
+++ b/api_docs/kbn_guided_onboarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-guided-onboarding
 title: "@kbn/guided-onboarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/guided-onboarding plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/guided-onboarding']
 ---
 import kbnGuidedOnboardingObj from './kbn_guided_onboarding.devdocs.json';
diff --git a/api_docs/kbn_handlebars.mdx b/api_docs/kbn_handlebars.mdx
index a05df194e13d6e..90bd183da87327 100644
--- a/api_docs/kbn_handlebars.mdx
+++ b/api_docs/kbn_handlebars.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-handlebars
 title: "@kbn/handlebars"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/handlebars plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/handlebars']
 ---
 import kbnHandlebarsObj from './kbn_handlebars.devdocs.json';
diff --git a/api_docs/kbn_hapi_mocks.mdx b/api_docs/kbn_hapi_mocks.mdx
index a8c67ce4dea25c..05f826ccec91d5 100644
--- a/api_docs/kbn_hapi_mocks.mdx
+++ b/api_docs/kbn_hapi_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-hapi-mocks
 title: "@kbn/hapi-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/hapi-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/hapi-mocks']
 ---
 import kbnHapiMocksObj from './kbn_hapi_mocks.devdocs.json';
diff --git a/api_docs/kbn_health_gateway_server.mdx b/api_docs/kbn_health_gateway_server.mdx
index 0c9e6106d5c298..6fbc6cd5411944 100644
--- a/api_docs/kbn_health_gateway_server.mdx
+++ b/api_docs/kbn_health_gateway_server.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-health-gateway-server
 title: "@kbn/health-gateway-server"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/health-gateway-server plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/health-gateway-server']
 ---
 import kbnHealthGatewayServerObj from './kbn_health_gateway_server.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_card.mdx b/api_docs/kbn_home_sample_data_card.mdx
index 3d0ce27a18630d..6e00d68e0ae2a1 100644
--- a/api_docs/kbn_home_sample_data_card.mdx
+++ b/api_docs/kbn_home_sample_data_card.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-card
 title: "@kbn/home-sample-data-card"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-card plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-card']
 ---
 import kbnHomeSampleDataCardObj from './kbn_home_sample_data_card.devdocs.json';
diff --git a/api_docs/kbn_home_sample_data_tab.mdx b/api_docs/kbn_home_sample_data_tab.mdx
index f0589392ae3ed8..0b39341ced45e8 100644
--- a/api_docs/kbn_home_sample_data_tab.mdx
+++ b/api_docs/kbn_home_sample_data_tab.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-tab
 title: "@kbn/home-sample-data-tab"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/home-sample-data-tab plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-tab']
 ---
 import kbnHomeSampleDataTabObj from './kbn_home_sample_data_tab.devdocs.json';
diff --git a/api_docs/kbn_i18n.mdx b/api_docs/kbn_i18n.mdx
index 1a62fe290d58f4..24ed7910547948 100644
--- a/api_docs/kbn_i18n.mdx
+++ b/api_docs/kbn_i18n.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n
 title: "@kbn/i18n"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n']
 ---
 import kbnI18nObj from './kbn_i18n.devdocs.json';
diff --git a/api_docs/kbn_i18n_react.mdx b/api_docs/kbn_i18n_react.mdx
index 7c60554aaa4c97..d2f66504a3c90a 100644
--- a/api_docs/kbn_i18n_react.mdx
+++ b/api_docs/kbn_i18n_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n-react
 title: "@kbn/i18n-react"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/i18n-react plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n-react']
 ---
 import kbnI18nReactObj from './kbn_i18n_react.devdocs.json';
diff --git a/api_docs/kbn_import_resolver.mdx b/api_docs/kbn_import_resolver.mdx
index 1ec60d6cf613e0..e02fa3bc6764f6 100644
--- a/api_docs/kbn_import_resolver.mdx
+++ b/api_docs/kbn_import_resolver.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-import-resolver
 title: "@kbn/import-resolver"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/import-resolver plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/import-resolver']
 ---
 import kbnImportResolverObj from './kbn_import_resolver.devdocs.json';
diff --git a/api_docs/kbn_interpreter.mdx b/api_docs/kbn_interpreter.mdx
index b1ce63fe6e33a6..4d77a5e3469630 100644
--- a/api_docs/kbn_interpreter.mdx
+++ b/api_docs/kbn_interpreter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-interpreter
 title: "@kbn/interpreter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/interpreter plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/interpreter']
 ---
 import kbnInterpreterObj from './kbn_interpreter.devdocs.json';
diff --git a/api_docs/kbn_io_ts_utils.mdx b/api_docs/kbn_io_ts_utils.mdx
index 92d85b85d6c588..992ba877b7987a 100644
--- a/api_docs/kbn_io_ts_utils.mdx
+++ b/api_docs/kbn_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-io-ts-utils
 title: "@kbn/io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/io-ts-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/io-ts-utils']
 ---
 import kbnIoTsUtilsObj from './kbn_io_ts_utils.devdocs.json';
diff --git a/api_docs/kbn_jest_serializers.mdx b/api_docs/kbn_jest_serializers.mdx
index cf02593010ffa4..0ee55ace691d33 100644
--- a/api_docs/kbn_jest_serializers.mdx
+++ b/api_docs/kbn_jest_serializers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-jest-serializers
 title: "@kbn/jest-serializers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/jest-serializers plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/jest-serializers']
 ---
 import kbnJestSerializersObj from './kbn_jest_serializers.devdocs.json';
diff --git a/api_docs/kbn_journeys.mdx b/api_docs/kbn_journeys.mdx
index 6e75fe6e271910..943925cee2d63f 100644
--- a/api_docs/kbn_journeys.mdx
+++ b/api_docs/kbn_journeys.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-journeys
 title: "@kbn/journeys"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/journeys plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/journeys']
 ---
 import kbnJourneysObj from './kbn_journeys.devdocs.json';
diff --git a/api_docs/kbn_json_ast.mdx b/api_docs/kbn_json_ast.mdx
index cd8e2019d316fd..57a83483c206ee 100644
--- a/api_docs/kbn_json_ast.mdx
+++ b/api_docs/kbn_json_ast.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-json-ast
 title: "@kbn/json-ast"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/json-ast plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/json-ast']
 ---
 import kbnJsonAstObj from './kbn_json_ast.devdocs.json';
diff --git a/api_docs/kbn_kibana_manifest_schema.mdx b/api_docs/kbn_kibana_manifest_schema.mdx
index 0e9c0ceeacf0b7..9107a16c20abbe 100644
--- a/api_docs/kbn_kibana_manifest_schema.mdx
+++ b/api_docs/kbn_kibana_manifest_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-kibana-manifest-schema
 title: "@kbn/kibana-manifest-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/kibana-manifest-schema plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/kibana-manifest-schema']
 ---
 import kbnKibanaManifestSchemaObj from './kbn_kibana_manifest_schema.devdocs.json';
diff --git a/api_docs/kbn_language_documentation_popover.mdx b/api_docs/kbn_language_documentation_popover.mdx
index 3a07b50a034d8e..719c40e99f3578 100644
--- a/api_docs/kbn_language_documentation_popover.mdx
+++ b/api_docs/kbn_language_documentation_popover.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-language-documentation-popover
 title: "@kbn/language-documentation-popover"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/language-documentation-popover plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/language-documentation-popover']
 ---
 import kbnLanguageDocumentationPopoverObj from './kbn_language_documentation_popover.devdocs.json';
diff --git a/api_docs/kbn_logging.mdx b/api_docs/kbn_logging.mdx
index 979b3532a0cbdc..3a562a3d16c91a 100644
--- a/api_docs/kbn_logging.mdx
+++ b/api_docs/kbn_logging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging
 title: "@kbn/logging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging']
 ---
 import kbnLoggingObj from './kbn_logging.devdocs.json';
diff --git a/api_docs/kbn_logging_mocks.mdx b/api_docs/kbn_logging_mocks.mdx
index 79f513ec72e950..297920b1f118f6 100644
--- a/api_docs/kbn_logging_mocks.mdx
+++ b/api_docs/kbn_logging_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging-mocks
 title: "@kbn/logging-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/logging-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging-mocks']
 ---
 import kbnLoggingMocksObj from './kbn_logging_mocks.devdocs.json';
diff --git a/api_docs/kbn_managed_vscode_config.mdx b/api_docs/kbn_managed_vscode_config.mdx
index 5f33dafa825885..f7d88e64a1272d 100644
--- a/api_docs/kbn_managed_vscode_config.mdx
+++ b/api_docs/kbn_managed_vscode_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-managed-vscode-config
 title: "@kbn/managed-vscode-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/managed-vscode-config plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/managed-vscode-config']
 ---
 import kbnManagedVscodeConfigObj from './kbn_managed_vscode_config.devdocs.json';
diff --git a/api_docs/kbn_mapbox_gl.mdx b/api_docs/kbn_mapbox_gl.mdx
index 1a2cab74c82b35..79fd443a6c8064 100644
--- a/api_docs/kbn_mapbox_gl.mdx
+++ b/api_docs/kbn_mapbox_gl.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-mapbox-gl
 title: "@kbn/mapbox-gl"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/mapbox-gl plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/mapbox-gl']
 ---
 import kbnMapboxGlObj from './kbn_mapbox_gl.devdocs.json';
diff --git a/api_docs/kbn_ml_agg_utils.mdx b/api_docs/kbn_ml_agg_utils.mdx
index 5e400664bc9baa..c237b3a552fb44 100644
--- a/api_docs/kbn_ml_agg_utils.mdx
+++ b/api_docs/kbn_ml_agg_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-agg-utils
 title: "@kbn/ml-agg-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-agg-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-agg-utils']
 ---
 import kbnMlAggUtilsObj from './kbn_ml_agg_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_date_picker.mdx b/api_docs/kbn_ml_date_picker.mdx
index ca520e74ffd3f0..8ecf5eb6323e20 100644
--- a/api_docs/kbn_ml_date_picker.mdx
+++ b/api_docs/kbn_ml_date_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-date-picker
 title: "@kbn/ml-date-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-date-picker plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-date-picker']
 ---
 import kbnMlDatePickerObj from './kbn_ml_date_picker.devdocs.json';
diff --git a/api_docs/kbn_ml_is_defined.mdx b/api_docs/kbn_ml_is_defined.mdx
index 0eb5d578d1e941..771070a756f5f5 100644
--- a/api_docs/kbn_ml_is_defined.mdx
+++ b/api_docs/kbn_ml_is_defined.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-defined
 title: "@kbn/ml-is-defined"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-defined plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-defined']
 ---
 import kbnMlIsDefinedObj from './kbn_ml_is_defined.devdocs.json';
diff --git a/api_docs/kbn_ml_is_populated_object.mdx b/api_docs/kbn_ml_is_populated_object.mdx
index 9e6074d54406a0..a765ee3ffb8c00 100644
--- a/api_docs/kbn_ml_is_populated_object.mdx
+++ b/api_docs/kbn_ml_is_populated_object.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-populated-object
 title: "@kbn/ml-is-populated-object"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-is-populated-object plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-populated-object']
 ---
 import kbnMlIsPopulatedObjectObj from './kbn_ml_is_populated_object.devdocs.json';
diff --git a/api_docs/kbn_ml_local_storage.mdx b/api_docs/kbn_ml_local_storage.mdx
index 4689081d128e6d..36093fb8238487 100644
--- a/api_docs/kbn_ml_local_storage.mdx
+++ b/api_docs/kbn_ml_local_storage.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-local-storage
 title: "@kbn/ml-local-storage"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-local-storage plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-local-storage']
 ---
 import kbnMlLocalStorageObj from './kbn_ml_local_storage.devdocs.json';
diff --git a/api_docs/kbn_ml_nested_property.mdx b/api_docs/kbn_ml_nested_property.mdx
index eda64de3f028ed..2c8f7bded28e77 100644
--- a/api_docs/kbn_ml_nested_property.mdx
+++ b/api_docs/kbn_ml_nested_property.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-nested-property
 title: "@kbn/ml-nested-property"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-nested-property plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-nested-property']
 ---
 import kbnMlNestedPropertyObj from './kbn_ml_nested_property.devdocs.json';
diff --git a/api_docs/kbn_ml_query_utils.mdx b/api_docs/kbn_ml_query_utils.mdx
index c0b13e9c7227db..b090bfe6ee680b 100644
--- a/api_docs/kbn_ml_query_utils.mdx
+++ b/api_docs/kbn_ml_query_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-query-utils
 title: "@kbn/ml-query-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-query-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-query-utils']
 ---
 import kbnMlQueryUtilsObj from './kbn_ml_query_utils.devdocs.json';
diff --git a/api_docs/kbn_ml_string_hash.mdx b/api_docs/kbn_ml_string_hash.mdx
index e04d96f9a1876d..75301de28a6291 100644
--- a/api_docs/kbn_ml_string_hash.mdx
+++ b/api_docs/kbn_ml_string_hash.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-string-hash
 title: "@kbn/ml-string-hash"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-string-hash plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-string-hash']
 ---
 import kbnMlStringHashObj from './kbn_ml_string_hash.devdocs.json';
diff --git a/api_docs/kbn_ml_url_state.mdx b/api_docs/kbn_ml_url_state.mdx
index 18ab9ffa8e8118..2e9ffed1a40cb0 100644
--- a/api_docs/kbn_ml_url_state.mdx
+++ b/api_docs/kbn_ml_url_state.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-url-state
 title: "@kbn/ml-url-state"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ml-url-state plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-url-state']
 ---
 import kbnMlUrlStateObj from './kbn_ml_url_state.devdocs.json';
diff --git a/api_docs/kbn_monaco.mdx b/api_docs/kbn_monaco.mdx
index 7320d0544bdb7f..81f0803e5c886d 100644
--- a/api_docs/kbn_monaco.mdx
+++ b/api_docs/kbn_monaco.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-monaco
 title: "@kbn/monaco"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/monaco plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/monaco']
 ---
 import kbnMonacoObj from './kbn_monaco.devdocs.json';
diff --git a/api_docs/kbn_optimizer.mdx b/api_docs/kbn_optimizer.mdx
index f3297ae4678c77..fae9269cdd0d31 100644
--- a/api_docs/kbn_optimizer.mdx
+++ b/api_docs/kbn_optimizer.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer
 title: "@kbn/optimizer"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer']
 ---
 import kbnOptimizerObj from './kbn_optimizer.devdocs.json';
diff --git a/api_docs/kbn_optimizer_webpack_helpers.mdx b/api_docs/kbn_optimizer_webpack_helpers.mdx
index 9d47cab3d0a48a..0d661b2bd5302c 100644
--- a/api_docs/kbn_optimizer_webpack_helpers.mdx
+++ b/api_docs/kbn_optimizer_webpack_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer-webpack-helpers
 title: "@kbn/optimizer-webpack-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/optimizer-webpack-helpers plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer-webpack-helpers']
 ---
 import kbnOptimizerWebpackHelpersObj from './kbn_optimizer_webpack_helpers.devdocs.json';
diff --git a/api_docs/kbn_osquery_io_ts_types.mdx b/api_docs/kbn_osquery_io_ts_types.mdx
index 5546f8af658340..ca09b63a28fdda 100644
--- a/api_docs/kbn_osquery_io_ts_types.mdx
+++ b/api_docs/kbn_osquery_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-osquery-io-ts-types
 title: "@kbn/osquery-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/osquery-io-ts-types plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/osquery-io-ts-types']
 ---
 import kbnOsqueryIoTsTypesObj from './kbn_osquery_io_ts_types.devdocs.json';
diff --git a/api_docs/kbn_performance_testing_dataset_extractor.mdx b/api_docs/kbn_performance_testing_dataset_extractor.mdx
index fcbc28f5c082e6..41bd576dc38de1 100644
--- a/api_docs/kbn_performance_testing_dataset_extractor.mdx
+++ b/api_docs/kbn_performance_testing_dataset_extractor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-performance-testing-dataset-extractor
 title: "@kbn/performance-testing-dataset-extractor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/performance-testing-dataset-extractor plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/performance-testing-dataset-extractor']
 ---
 import kbnPerformanceTestingDatasetExtractorObj from './kbn_performance_testing_dataset_extractor.devdocs.json';
diff --git a/api_docs/kbn_plugin_generator.mdx b/api_docs/kbn_plugin_generator.mdx
index dbb2a8bb000931..06b05e085c043e 100644
--- a/api_docs/kbn_plugin_generator.mdx
+++ b/api_docs/kbn_plugin_generator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-generator
 title: "@kbn/plugin-generator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-generator plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-generator']
 ---
 import kbnPluginGeneratorObj from './kbn_plugin_generator.devdocs.json';
diff --git a/api_docs/kbn_plugin_helpers.mdx b/api_docs/kbn_plugin_helpers.mdx
index f84da983ddfc45..6df3b3513312b2 100644
--- a/api_docs/kbn_plugin_helpers.mdx
+++ b/api_docs/kbn_plugin_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-helpers
 title: "@kbn/plugin-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/plugin-helpers plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-helpers']
 ---
 import kbnPluginHelpersObj from './kbn_plugin_helpers.devdocs.json';
diff --git a/api_docs/kbn_react_field.mdx b/api_docs/kbn_react_field.mdx
index bb775ec7f6518f..aa726ae629b751 100644
--- a/api_docs/kbn_react_field.mdx
+++ b/api_docs/kbn_react_field.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-field
 title: "@kbn/react-field"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/react-field plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-field']
 ---
 import kbnReactFieldObj from './kbn_react_field.devdocs.json';
diff --git a/api_docs/kbn_repo_file_maps.mdx b/api_docs/kbn_repo_file_maps.mdx
index 67c9ae2a153af2..ee54a3ef70177a 100644
--- a/api_docs/kbn_repo_file_maps.mdx
+++ b/api_docs/kbn_repo_file_maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-file-maps
 title: "@kbn/repo-file-maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-file-maps plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-file-maps']
 ---
 import kbnRepoFileMapsObj from './kbn_repo_file_maps.devdocs.json';
diff --git a/api_docs/kbn_repo_linter.mdx b/api_docs/kbn_repo_linter.mdx
index 47cd7750790c25..0f7a2a7e57d9ba 100644
--- a/api_docs/kbn_repo_linter.mdx
+++ b/api_docs/kbn_repo_linter.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-linter
 title: "@kbn/repo-linter"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-linter plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-linter']
 ---
 import kbnRepoLinterObj from './kbn_repo_linter.devdocs.json';
diff --git a/api_docs/kbn_repo_path.mdx b/api_docs/kbn_repo_path.mdx
index 1b95e4143d6a5d..6def69c3ce2ad1 100644
--- a/api_docs/kbn_repo_path.mdx
+++ b/api_docs/kbn_repo_path.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-path
 title: "@kbn/repo-path"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-path plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-path']
 ---
 import kbnRepoPathObj from './kbn_repo_path.devdocs.json';
diff --git a/api_docs/kbn_repo_source_classifier.mdx b/api_docs/kbn_repo_source_classifier.mdx
index be3e88db7f5523..ac153a55c64298 100644
--- a/api_docs/kbn_repo_source_classifier.mdx
+++ b/api_docs/kbn_repo_source_classifier.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-source-classifier
 title: "@kbn/repo-source-classifier"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/repo-source-classifier plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-source-classifier']
 ---
 import kbnRepoSourceClassifierObj from './kbn_repo_source_classifier.devdocs.json';
diff --git a/api_docs/kbn_rison.mdx b/api_docs/kbn_rison.mdx
index d6bcd91d7110fb..3a768818b2a4a4 100644
--- a/api_docs/kbn_rison.mdx
+++ b/api_docs/kbn_rison.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rison
 title: "@kbn/rison"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rison plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rison']
 ---
 import kbnRisonObj from './kbn_rison.devdocs.json';
diff --git a/api_docs/kbn_rule_data_utils.devdocs.json b/api_docs/kbn_rule_data_utils.devdocs.json
index 2882bd4b1b87be..fdab2a321e5f2f 100644
--- a/api_docs/kbn_rule_data_utils.devdocs.json
+++ b/api_docs/kbn_rule_data_utils.devdocs.json
@@ -188,7 +188,7 @@
         "signature": [
           "\"kibana.alert.action_group\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -233,7 +233,7 @@
         "signature": [
           "\"kibana.alert.duration.us\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -248,7 +248,7 @@
         "signature": [
           "\"kibana.alert.end\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -293,7 +293,22 @@
         "signature": [
           "\"kibana.alert.flapping\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/rule-data-utils",
+        "id": "def-common.ALERT_ID",
+        "type": "string",
+        "tags": [],
+        "label": "ALERT_ID",
+        "description": [],
+        "signature": [
+          "\"kibana.alert.id\""
+        ],
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -323,7 +338,7 @@
         "signature": [
           "\"kibana.alert\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -338,7 +353,7 @@
         "signature": [
           "\"kibana.alert.reason\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -383,7 +398,7 @@
         "signature": [
           "\"kibana.alert.rule.category\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -398,7 +413,7 @@
         "signature": [
           "\"kibana.alert.rule.consumer\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -488,7 +503,7 @@
         "signature": [
           "\"kibana.alert.rule.execution.uuid\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -548,7 +563,7 @@
         "signature": [
           "\"kibana.alert.rule.name\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -563,7 +578,7 @@
         "signature": [
           "\"kibana.alert.rule\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -608,7 +623,7 @@
         "signature": [
           "\"kibana.alert.rule.parameters\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -623,7 +638,7 @@
         "signature": [
           "\"kibana.alert.rule.producer\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -683,7 +698,7 @@
         "signature": [
           "\"kibana.alert.rule.tags\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -728,7 +743,7 @@
         "signature": [
           "\"kibana.alert.rule.rule_type_id\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -773,7 +788,7 @@
         "signature": [
           "\"kibana.alert.rule.uuid\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -848,7 +863,7 @@
         "signature": [
           "\"kibana.alert.start\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -863,7 +878,7 @@
         "signature": [
           "\"kibana.alert.status\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -1163,7 +1178,7 @@
         "signature": [
           "\"kibana.alert.time_range\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -1178,7 +1193,7 @@
         "signature": [
           "\"kibana.alert.uuid\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -1208,7 +1223,7 @@
         "signature": [
           "\"kibana.alert.workflow_status\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -1273,6 +1288,21 @@
         "trackAdoption": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "@kbn/rule-data-utils",
+        "id": "def-common.DefaultAlertFieldName",
+        "type": "Type",
+        "tags": [],
+        "label": "DefaultAlertFieldName",
+        "description": [],
+        "signature": [
+          "\"kibana\" | \"kibana.alert.rule.rule_type_id\" | \"kibana.alert.rule.consumer\" | \"kibana.alert.rule.execution.uuid\" | \"kibana.alert\" | \"kibana.alert.rule\" | \"kibana.alert.rule.parameters\" | \"kibana.alert.rule.producer\" | \"kibana.space_ids\" | \"kibana.alert.uuid\" | \"kibana.alert.start\" | \"kibana.alert.time_range\" | \"kibana.alert.end\" | \"kibana.alert.duration.us\" | \"kibana.alert.status\" | \"kibana.alert.flapping\" | \"kibana.version\" | \"kibana.alert.workflow_status\" | \"kibana.alert.action_group\" | \"kibana.alert.reason\" | \"kibana.alert.rule.category\" | \"kibana.alert.rule.uuid\" | \"kibana.alert.rule.name\" | \"kibana.alert.rule.tags\" | \"kibana.alert.id\""
+        ],
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "@kbn/rule-data-utils",
         "id": "def-common.ECS_VERSION",
@@ -1343,7 +1373,7 @@
         "signature": [
           "\"kibana\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -1373,7 +1403,7 @@
         "signature": [
           "\"kibana.space_ids\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
@@ -1416,7 +1446,7 @@
         "label": "TechnicalRuleDataFieldName",
         "description": [],
         "signature": [
-          "\"tags\" | \"kibana\" | \"@timestamp\" | \"event.action\" | \"kibana.alert.rule.execution.uuid\" | \"kibana.alert.rule.rule_type_id\" | \"kibana.alert.rule.consumer\" | \"kibana.alert\" | \"kibana.alert.rule\" | \"kibana.alert.rule.parameters\" | \"kibana.alert.rule.producer\" | \"kibana.space_ids\" | \"kibana.alert.uuid\" | \"kibana.alert.instance.id\" | \"kibana.alert.start\" | \"kibana.alert.time_range\" | \"kibana.alert.end\" | \"kibana.alert.duration.us\" | \"kibana.alert.severity\" | \"kibana.alert.status\" | \"kibana.alert.flapping\" | \"kibana.version\" | \"ecs.version\" | \"kibana.alert.risk_score\" | \"kibana.alert.workflow_status\" | \"kibana.alert.workflow_user\" | \"kibana.alert.workflow_reason\" | \"kibana.alert.system_status\" | \"kibana.alert.action_group\" | \"kibana.alert.reason\" | \"kibana.alert.case_ids\" | \"kibana.alert.rule.author\" | \"kibana.alert.rule.category\" | \"kibana.alert.rule.uuid\" | \"kibana.alert.rule.created_at\" | \"kibana.alert.rule.created_by\" | \"kibana.alert.rule.description\" | \"kibana.alert.rule.enabled\" | \"kibana.alert.rule.from\" | \"kibana.alert.rule.interval\" | \"kibana.alert.rule.license\" | \"kibana.alert.rule.name\" | \"kibana.alert.rule.note\" | \"kibana.alert.rule.references\" | \"kibana.alert.rule.rule_id\" | \"kibana.alert.rule.rule_name_override\" | \"kibana.alert.rule.tags\" | \"kibana.alert.rule.to\" | \"kibana.alert.rule.type\" | \"kibana.alert.rule.updated_at\" | \"kibana.alert.rule.updated_by\" | \"kibana.alert.rule.version\" | \"kibana.alert.suppression.terms\" | \"kibana.alert.suppression.terms.field\" | \"kibana.alert.suppression.terms.value\" | \"kibana.alert.suppression.start\" | \"kibana.alert.suppression.end\" | \"kibana.alert.suppression.docs_count\" | \"event.kind\" | \"event.module\" | \"kibana.alert.evaluation.threshold\" | \"kibana.alert.evaluation.value\" | \"kibana.alert.building_block_type\" | \"kibana.alert.rule.exceptions_list\" | \"kibana.alert.rule.namespace\" | \"kibana.alert.rule.threat.framework\" | \"kibana.alert.rule.threat.tactic.id\" | \"kibana.alert.rule.threat.tactic.name\" | \"kibana.alert.rule.threat.tactic.reference\" | \"kibana.alert.rule.threat.technique.id\" | \"kibana.alert.rule.threat.technique.name\" | \"kibana.alert.rule.threat.technique.reference\" | \"kibana.alert.rule.threat.technique.subtechnique.id\" | \"kibana.alert.rule.threat.technique.subtechnique.name\" | \"kibana.alert.rule.threat.technique.subtechnique.reference\""
+          "\"tags\" | \"kibana\" | \"@timestamp\" | \"event.action\" | \"kibana.alert.rule.rule_type_id\" | \"kibana.alert.rule.consumer\" | \"kibana.alert.rule.execution.uuid\" | \"kibana.alert\" | \"kibana.alert.rule\" | \"kibana.alert.rule.parameters\" | \"kibana.alert.rule.producer\" | \"kibana.space_ids\" | \"kibana.alert.uuid\" | \"kibana.alert.instance.id\" | \"kibana.alert.start\" | \"kibana.alert.time_range\" | \"kibana.alert.end\" | \"kibana.alert.duration.us\" | \"kibana.alert.severity\" | \"kibana.alert.status\" | \"kibana.alert.flapping\" | \"kibana.version\" | \"ecs.version\" | \"kibana.alert.risk_score\" | \"kibana.alert.workflow_status\" | \"kibana.alert.workflow_user\" | \"kibana.alert.workflow_reason\" | \"kibana.alert.system_status\" | \"kibana.alert.action_group\" | \"kibana.alert.reason\" | \"kibana.alert.case_ids\" | \"kibana.alert.rule.author\" | \"kibana.alert.rule.category\" | \"kibana.alert.rule.uuid\" | \"kibana.alert.rule.created_at\" | \"kibana.alert.rule.created_by\" | \"kibana.alert.rule.description\" | \"kibana.alert.rule.enabled\" | \"kibana.alert.rule.from\" | \"kibana.alert.rule.interval\" | \"kibana.alert.rule.license\" | \"kibana.alert.rule.name\" | \"kibana.alert.rule.note\" | \"kibana.alert.rule.references\" | \"kibana.alert.rule.rule_id\" | \"kibana.alert.rule.rule_name_override\" | \"kibana.alert.rule.tags\" | \"kibana.alert.rule.to\" | \"kibana.alert.rule.type\" | \"kibana.alert.rule.updated_at\" | \"kibana.alert.rule.updated_by\" | \"kibana.alert.rule.version\" | \"kibana.alert.suppression.terms\" | \"kibana.alert.suppression.terms.field\" | \"kibana.alert.suppression.terms.value\" | \"kibana.alert.suppression.start\" | \"kibana.alert.suppression.end\" | \"kibana.alert.suppression.docs_count\" | \"event.kind\" | \"event.module\" | \"kibana.alert.evaluation.threshold\" | \"kibana.alert.evaluation.value\" | \"kibana.alert.building_block_type\" | \"kibana.alert.rule.exceptions_list\" | \"kibana.alert.rule.namespace\" | \"kibana.alert.rule.threat.framework\" | \"kibana.alert.rule.threat.tactic.id\" | \"kibana.alert.rule.threat.tactic.name\" | \"kibana.alert.rule.threat.tactic.reference\" | \"kibana.alert.rule.threat.technique.id\" | \"kibana.alert.rule.threat.technique.name\" | \"kibana.alert.rule.threat.technique.reference\" | \"kibana.alert.rule.threat.technique.subtechnique.id\" | \"kibana.alert.rule.threat.technique.subtechnique.name\" | \"kibana.alert.rule.threat.technique.subtechnique.reference\""
         ],
         "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
         "deprecated": false,
@@ -1493,7 +1523,7 @@
         "signature": [
           "\"kibana.version\""
         ],
-        "path": "packages/kbn-rule-data-utils/src/technical_field_names.ts",
+        "path": "packages/kbn-rule-data-utils/src/default_alerts_as_data.ts",
         "deprecated": false,
         "trackAdoption": false,
         "initialIsOpen": false
diff --git a/api_docs/kbn_rule_data_utils.mdx b/api_docs/kbn_rule_data_utils.mdx
index 54c70b242db52a..c1457a8a99e90e 100644
--- a/api_docs/kbn_rule_data_utils.mdx
+++ b/api_docs/kbn_rule_data_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rule-data-utils
 title: "@kbn/rule-data-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/rule-data-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rule-data-utils']
 ---
 import kbnRuleDataUtilsObj from './kbn_rule_data_utils.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Owner missing] for questions regarding this plugin.
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 97 | 0 | 94 | 0 |
+| 99 | 0 | 96 | 0 |
 
 ## Common
 
diff --git a/api_docs/kbn_securitysolution_autocomplete.mdx b/api_docs/kbn_securitysolution_autocomplete.mdx
index 59a965a6c4099e..941ba15d506ba9 100644
--- a/api_docs/kbn_securitysolution_autocomplete.mdx
+++ b/api_docs/kbn_securitysolution_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-autocomplete
 title: "@kbn/securitysolution-autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-autocomplete plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-autocomplete']
 ---
 import kbnSecuritysolutionAutocompleteObj from './kbn_securitysolution_autocomplete.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_ecs.devdocs.json b/api_docs/kbn_securitysolution_ecs.devdocs.json
new file mode 100644
index 00000000000000..d6503dc7fa76f9
--- /dev/null
+++ b/api_docs/kbn_securitysolution_ecs.devdocs.json
@@ -0,0 +1,4948 @@
+{
+  "id": "@kbn/securitysolution-ecs",
+  "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "common": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.AgentEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "AgentEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/agent/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.AgentEcs.type",
+            "type": "Array",
+            "tags": [],
+            "label": "type",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/agent/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.AgentEcs.id",
+            "type": "Array",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/agent/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.AuditdEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "AuditdEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/auditd/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.AuditdEcs.result",
+            "type": "Array",
+            "tags": [],
+            "label": "result",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/auditd/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.AuditdEcs.session",
+            "type": "Array",
+            "tags": [],
+            "label": "session",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/auditd/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.AuditdEcs.data",
+            "type": "Object",
+            "tags": [],
+            "label": "data",
+            "description": [],
+            "signature": [
+              "AuditdDataEcs",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/auditd/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.AuditdEcs.summary",
+            "type": "Object",
+            "tags": [],
+            "label": "summary",
+            "description": [],
+            "signature": [
+              "SummaryEcs",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/auditd/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.AuditdEcs.sequence",
+            "type": "Array",
+            "tags": [],
+            "label": "sequence",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/auditd/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.CloudEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "CloudEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/cloud/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.CloudEcs.instance",
+            "type": "Object",
+            "tags": [],
+            "label": "instance",
+            "description": [],
+            "signature": [
+              "CloudInstanceEcs",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/cloud/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.CloudEcs.machine",
+            "type": "Object",
+            "tags": [],
+            "label": "machine",
+            "description": [],
+            "signature": [
+              "CloudMachineEcs",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/cloud/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.CloudEcs.provider",
+            "type": "Array",
+            "tags": [],
+            "label": "provider",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/cloud/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.CloudEcs.region",
+            "type": "Array",
+            "tags": [],
+            "label": "region",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/cloud/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.CodeSignature",
+        "type": "Interface",
+        "tags": [],
+        "label": "CodeSignature",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.CodeSignature.subject_name",
+            "type": "Array",
+            "tags": [],
+            "label": "subject_name",
+            "description": [],
+            "signature": [
+              "string[]"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.CodeSignature.trusted",
+            "type": "Array",
+            "tags": [],
+            "label": "trusted",
+            "description": [],
+            "signature": [
+              "string[]"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.DestinationEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "DestinationEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/destination/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DestinationEcs.bytes",
+            "type": "Array",
+            "tags": [],
+            "label": "bytes",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/destination/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DestinationEcs.ip",
+            "type": "Array",
+            "tags": [],
+            "label": "ip",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/destination/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DestinationEcs.port",
+            "type": "Array",
+            "tags": [],
+            "label": "port",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/destination/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DestinationEcs.domain",
+            "type": "Array",
+            "tags": [],
+            "label": "domain",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/destination/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DestinationEcs.geo",
+            "type": "Object",
+            "tags": [],
+            "label": "geo",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.GeoEcs",
+                "text": "GeoEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/destination/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DestinationEcs.packets",
+            "type": "Array",
+            "tags": [],
+            "label": "packets",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/destination/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.DllEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "DllEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/dll/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DllEcs.path",
+            "type": "string",
+            "tags": [],
+            "label": "path",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/dll/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DllEcs.code_signature",
+            "type": "Object",
+            "tags": [],
+            "label": "code_signature",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.CodeSignature",
+                "text": "CodeSignature"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/dll/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DllEcs.pe",
+            "type": "Object",
+            "tags": [],
+            "label": "pe",
+            "description": [],
+            "signature": [
+              "ProcessPe",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/dll/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.DnsEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "DnsEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/dns/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DnsEcs.question",
+            "type": "Object",
+            "tags": [],
+            "label": "question",
+            "description": [],
+            "signature": [
+              "DnsQuestionEcs",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/dns/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DnsEcs.resolved_ip",
+            "type": "Array",
+            "tags": [],
+            "label": "resolved_ip",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/dns/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.DnsEcs.response_code",
+            "type": "Array",
+            "tags": [],
+            "label": "response_code",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/dns/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.EcsSecurityExtension",
+        "type": "Interface",
+        "tags": [],
+        "label": "EcsSecurityExtension",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.agent",
+            "type": "Object",
+            "tags": [],
+            "label": "agent",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.AgentEcs",
+                "text": "AgentEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.destination",
+            "type": "Object",
+            "tags": [],
+            "label": "destination",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.DestinationEcs",
+                "text": "DestinationEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.dns",
+            "type": "Object",
+            "tags": [],
+            "label": "dns",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.DnsEcs",
+                "text": "DnsEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.event",
+            "type": "Object",
+            "tags": [],
+            "label": "event",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.EventEcs",
+                "text": "EventEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.file",
+            "type": "Object",
+            "tags": [],
+            "label": "file",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.FileEcs",
+                "text": "FileEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.host",
+            "type": "Object",
+            "tags": [],
+            "label": "host",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.HostEcs",
+                "text": "HostEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.http",
+            "type": "Object",
+            "tags": [],
+            "label": "http",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.HttpEcs",
+                "text": "HttpEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.message",
+            "type": "Array",
+            "tags": [],
+            "label": "message",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.network",
+            "type": "Object",
+            "tags": [],
+            "label": "network",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.NetworkEcs",
+                "text": "NetworkEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.process",
+            "type": "Object",
+            "tags": [],
+            "label": "process",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.ProcessEcs",
+                "text": "ProcessEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.registry",
+            "type": "Object",
+            "tags": [],
+            "label": "registry",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.RegistryEcs",
+                "text": "RegistryEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.rule",
+            "type": "Object",
+            "tags": [],
+            "label": "rule",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.RuleEcs",
+                "text": "RuleEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.source",
+            "type": "Object",
+            "tags": [],
+            "label": "source",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.SourceEcs",
+                "text": "SourceEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.threat",
+            "type": "Object",
+            "tags": [],
+            "label": "threat",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.ThreatEcs",
+                "text": "ThreatEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.tls",
+            "type": "Object",
+            "tags": [],
+            "label": "tls",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.TlsEcs",
+                "text": "TlsEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.url",
+            "type": "Object",
+            "tags": [],
+            "label": "url",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.UrlEcs",
+                "text": "UrlEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.user",
+            "type": "Object",
+            "tags": [],
+            "label": "user",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.UserEcs",
+                "text": "UserEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension._id",
+            "type": "string",
+            "tags": [],
+            "label": "_id",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension._index",
+            "type": "string",
+            "tags": [],
+            "label": "_index",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.auditd",
+            "type": "Object",
+            "tags": [],
+            "label": "auditd",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.AuditdEcs",
+                "text": "AuditdEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.endgame",
+            "type": "Object",
+            "tags": [],
+            "label": "endgame",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.EndgameEcs",
+                "text": "EndgameEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.geo",
+            "type": "Object",
+            "tags": [],
+            "label": "geo",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.GeoEcs",
+                "text": "GeoEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.kibana",
+            "type": "Object",
+            "tags": [],
+            "label": "kibana",
+            "description": [],
+            "signature": [
+              "{ alert: ",
+              "SignalEcsAAD",
+              "; } | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.kibana.alert.rule.parameters",
+            "type": "Object",
+            "tags": [],
+            "label": "'kibana.alert.rule.parameters'",
+            "description": [],
+            "signature": [
+              "{ index: string[]; data_view_id?: string | undefined; } | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.kibana.alert.workflow_status",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "'kibana.alert.workflow_status'",
+            "description": [],
+            "signature": [
+              "\"open\" | \"in-progress\" | \"closed\" | \"acknowledged\" | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.Memory_protection",
+            "type": "Object",
+            "tags": [],
+            "label": "Memory_protection",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.MemoryProtection",
+                "text": "MemoryProtection"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.Ransomware",
+            "type": "Object",
+            "tags": [],
+            "label": "Ransomware",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.Ransomware",
+                "text": "Ransomware"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.Target",
+            "type": "Object",
+            "tags": [],
+            "label": "Target",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.Target",
+                "text": "Target"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.dll",
+            "type": "Object",
+            "tags": [],
+            "label": "dll",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.DllEcs",
+                "text": "DllEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.eql",
+            "type": "Object",
+            "tags": [],
+            "label": "eql",
+            "description": [],
+            "signature": [
+              "{ parentId: string; sequenceNumber: string; } | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.signal",
+            "type": "Object",
+            "tags": [],
+            "label": "signal",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.SignalEcs",
+                "text": "SignalEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.suricata",
+            "type": "Object",
+            "tags": [],
+            "label": "suricata",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.SuricataEcs",
+                "text": "SuricataEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.system",
+            "type": "Object",
+            "tags": [],
+            "label": "system",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.SystemEcs",
+                "text": "SystemEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.timestamp",
+            "type": "string",
+            "tags": [],
+            "label": "timestamp",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.winlog",
+            "type": "Object",
+            "tags": [],
+            "label": "winlog",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.WinlogEcs",
+                "text": "WinlogEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EcsSecurityExtension.zeek",
+            "type": "Object",
+            "tags": [],
+            "label": "zeek",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.ZeekEcs",
+                "text": "ZeekEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.EndgameEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "EndgameEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.exit_code",
+            "type": "Array",
+            "tags": [],
+            "label": "exit_code",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.file_name",
+            "type": "Array",
+            "tags": [],
+            "label": "file_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.file_path",
+            "type": "Array",
+            "tags": [],
+            "label": "file_path",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.logon_type",
+            "type": "Array",
+            "tags": [],
+            "label": "logon_type",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.parent_process_name",
+            "type": "Array",
+            "tags": [],
+            "label": "parent_process_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.pid",
+            "type": "Array",
+            "tags": [],
+            "label": "pid",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.process_name",
+            "type": "Array",
+            "tags": [],
+            "label": "process_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.subject_domain_name",
+            "type": "Array",
+            "tags": [],
+            "label": "subject_domain_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.subject_logon_id",
+            "type": "Array",
+            "tags": [],
+            "label": "subject_logon_id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.subject_user_name",
+            "type": "Array",
+            "tags": [],
+            "label": "subject_user_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.target_domain_name",
+            "type": "Array",
+            "tags": [],
+            "label": "target_domain_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.target_logon_id",
+            "type": "Array",
+            "tags": [],
+            "label": "target_logon_id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EndgameEcs.target_user_name",
+            "type": "Array",
+            "tags": [],
+            "label": "target_user_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/endgame/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.EventEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "EventEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.action",
+            "type": "Array",
+            "tags": [],
+            "label": "action",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.category",
+            "type": "Array",
+            "tags": [],
+            "label": "category",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.code",
+            "type": "Array",
+            "tags": [],
+            "label": "code",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.created",
+            "type": "Array",
+            "tags": [],
+            "label": "created",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.dataset",
+            "type": "Array",
+            "tags": [],
+            "label": "dataset",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.duration",
+            "type": "Array",
+            "tags": [],
+            "label": "duration",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.end",
+            "type": "Array",
+            "tags": [],
+            "label": "end",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.hash",
+            "type": "Array",
+            "tags": [],
+            "label": "hash",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.id",
+            "type": "Array",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.kind",
+            "type": "Array",
+            "tags": [],
+            "label": "kind",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.module",
+            "type": "Array",
+            "tags": [],
+            "label": "module",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.original",
+            "type": "Array",
+            "tags": [],
+            "label": "original",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.outcome",
+            "type": "Array",
+            "tags": [],
+            "label": "outcome",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.risk_score",
+            "type": "Array",
+            "tags": [],
+            "label": "risk_score",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.risk_score_norm",
+            "type": "Array",
+            "tags": [],
+            "label": "risk_score_norm",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.severity",
+            "type": "Array",
+            "tags": [],
+            "label": "severity",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.start",
+            "type": "Array",
+            "tags": [],
+            "label": "start",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.timezone",
+            "type": "Array",
+            "tags": [],
+            "label": "timezone",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.EventEcs.type",
+            "type": "Array",
+            "tags": [],
+            "label": "type",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.FileEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "FileEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.name",
+            "type": "Array",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.path",
+            "type": "Array",
+            "tags": [],
+            "label": "path",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.target_path",
+            "type": "Array",
+            "tags": [],
+            "label": "target_path",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.extension",
+            "type": "Array",
+            "tags": [],
+            "label": "extension",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.Ext",
+            "type": "Object",
+            "tags": [],
+            "label": "Ext",
+            "description": [],
+            "signature": [
+              "Ext",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.type",
+            "type": "Array",
+            "tags": [],
+            "label": "type",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.device",
+            "type": "Array",
+            "tags": [],
+            "label": "device",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.inode",
+            "type": "Array",
+            "tags": [],
+            "label": "inode",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.uid",
+            "type": "Array",
+            "tags": [],
+            "label": "uid",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.owner",
+            "type": "Array",
+            "tags": [],
+            "label": "owner",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.gid",
+            "type": "Array",
+            "tags": [],
+            "label": "gid",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.group",
+            "type": "Array",
+            "tags": [],
+            "label": "group",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.mode",
+            "type": "Array",
+            "tags": [],
+            "label": "mode",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.size",
+            "type": "Array",
+            "tags": [],
+            "label": "size",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.mtime",
+            "type": "Array",
+            "tags": [],
+            "label": "mtime",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.ctime",
+            "type": "Array",
+            "tags": [],
+            "label": "ctime",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.FileEcs.hash",
+            "type": "Object",
+            "tags": [],
+            "label": "hash",
+            "description": [],
+            "signature": [
+              "Hash",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/file/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.GeoEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "GeoEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/geo/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.GeoEcs.city_name",
+            "type": "Array",
+            "tags": [],
+            "label": "city_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/geo/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.GeoEcs.continent_name",
+            "type": "Array",
+            "tags": [],
+            "label": "continent_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/geo/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.GeoEcs.country_iso_code",
+            "type": "Array",
+            "tags": [],
+            "label": "country_iso_code",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/geo/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.GeoEcs.country_name",
+            "type": "Array",
+            "tags": [],
+            "label": "country_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/geo/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.GeoEcs.location",
+            "type": "Object",
+            "tags": [],
+            "label": "location",
+            "description": [],
+            "signature": [
+              "Location",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/geo/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.GeoEcs.region_iso_code",
+            "type": "Array",
+            "tags": [],
+            "label": "region_iso_code",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/geo/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.GeoEcs.region_name",
+            "type": "Array",
+            "tags": [],
+            "label": "region_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/geo/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.HostEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "HostEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.HostEcs.architecture",
+            "type": "Array",
+            "tags": [],
+            "label": "architecture",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.HostEcs.id",
+            "type": "Array",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.HostEcs.ip",
+            "type": "Array",
+            "tags": [],
+            "label": "ip",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.HostEcs.mac",
+            "type": "Array",
+            "tags": [],
+            "label": "mac",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.HostEcs.name",
+            "type": "Array",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.HostEcs.os",
+            "type": "Object",
+            "tags": [],
+            "label": "os",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.OsEcs",
+                "text": "OsEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.HostEcs.type",
+            "type": "Array",
+            "tags": [],
+            "label": "type",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.HttpEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "HttpEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/http/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.HttpEcs.version",
+            "type": "Array",
+            "tags": [],
+            "label": "version",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/http/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.HttpEcs.request",
+            "type": "Object",
+            "tags": [],
+            "label": "request",
+            "description": [],
+            "signature": [
+              "HttpRequestData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/http/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.HttpEcs.response",
+            "type": "Object",
+            "tags": [],
+            "label": "response",
+            "description": [],
+            "signature": [
+              "HttpResponseData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/http/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.MemoryProtection",
+        "type": "Interface",
+        "tags": [],
+        "label": "MemoryProtection",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/memory_protection/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.MemoryProtection.cross_session",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "cross_session",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/memory_protection/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.MemoryProtection.feature",
+            "type": "string",
+            "tags": [],
+            "label": "feature",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/memory_protection/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.MemoryProtection.parent_to_child",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "parent_to_child",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/memory_protection/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.MemoryProtection.self_injection",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "self_injection",
+            "description": [],
+            "signature": [
+              "boolean | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/memory_protection/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.MemoryProtection.unique_key_v1",
+            "type": "string",
+            "tags": [],
+            "label": "unique_key_v1",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/memory_protection/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.NetworkEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "NetworkEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/network/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.NetworkEcs.bytes",
+            "type": "Array",
+            "tags": [],
+            "label": "bytes",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/network/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.NetworkEcs.community_id",
+            "type": "Array",
+            "tags": [],
+            "label": "community_id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/network/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.NetworkEcs.direction",
+            "type": "Array",
+            "tags": [],
+            "label": "direction",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/network/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.NetworkEcs.packets",
+            "type": "Array",
+            "tags": [],
+            "label": "packets",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/network/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.NetworkEcs.protocol",
+            "type": "Array",
+            "tags": [],
+            "label": "protocol",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/network/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.NetworkEcs.transport",
+            "type": "Array",
+            "tags": [],
+            "label": "transport",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/network/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.OsEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "OsEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.OsEcs.platform",
+            "type": "Array",
+            "tags": [],
+            "label": "platform",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.OsEcs.name",
+            "type": "Array",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.OsEcs.full",
+            "type": "Array",
+            "tags": [],
+            "label": "full",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.OsEcs.family",
+            "type": "Array",
+            "tags": [],
+            "label": "family",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.OsEcs.version",
+            "type": "Array",
+            "tags": [],
+            "label": "version",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.OsEcs.kernel",
+            "type": "Array",
+            "tags": [],
+            "label": "kernel",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/host/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.ProcessEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "ProcessEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.Ext",
+            "type": "Object",
+            "tags": [],
+            "label": "Ext",
+            "description": [],
+            "signature": [
+              "Ext",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.command_line",
+            "type": "Array",
+            "tags": [],
+            "label": "command_line",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.entity_id",
+            "type": "Array",
+            "tags": [],
+            "label": "entity_id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.entry_leader",
+            "type": "Object",
+            "tags": [],
+            "label": "entry_leader",
+            "description": [],
+            "signature": [
+              "ProcessSessionData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.session_leader",
+            "type": "Object",
+            "tags": [],
+            "label": "session_leader",
+            "description": [],
+            "signature": [
+              "ProcessSessionData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.group_leader",
+            "type": "Object",
+            "tags": [],
+            "label": "group_leader",
+            "description": [],
+            "signature": [
+              "ProcessSessionData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.exit_code",
+            "type": "Array",
+            "tags": [],
+            "label": "exit_code",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.hash",
+            "type": "Object",
+            "tags": [],
+            "label": "hash",
+            "description": [],
+            "signature": [
+              "ProcessHashData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.parent",
+            "type": "Object",
+            "tags": [],
+            "label": "parent",
+            "description": [],
+            "signature": [
+              "ProcessParentData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.code_signature",
+            "type": "Object",
+            "tags": [],
+            "label": "code_signature",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.CodeSignature",
+                "text": "CodeSignature"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.pid",
+            "type": "Array",
+            "tags": [],
+            "label": "pid",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.name",
+            "type": "Array",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.ppid",
+            "type": "Array",
+            "tags": [],
+            "label": "ppid",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.args",
+            "type": "Array",
+            "tags": [],
+            "label": "args",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.executable",
+            "type": "Array",
+            "tags": [],
+            "label": "executable",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.title",
+            "type": "Array",
+            "tags": [],
+            "label": "title",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.thread",
+            "type": "Object",
+            "tags": [],
+            "label": "thread",
+            "description": [],
+            "signature": [
+              "Thread",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ProcessEcs.working_directory",
+            "type": "Array",
+            "tags": [],
+            "label": "working_directory",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/process/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.Ransomware",
+        "type": "Interface",
+        "tags": [],
+        "label": "Ransomware",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/ransomware/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.Ransomware.feature",
+            "type": "Array",
+            "tags": [],
+            "label": "feature",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/ransomware/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.Ransomware.score",
+            "type": "Array",
+            "tags": [],
+            "label": "score",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/ransomware/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.Ransomware.version",
+            "type": "Array",
+            "tags": [],
+            "label": "version",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/ransomware/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.Ransomware.child_pids",
+            "type": "Array",
+            "tags": [],
+            "label": "child_pids",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/ransomware/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.Ransomware.files",
+            "type": "Object",
+            "tags": [],
+            "label": "files",
+            "description": [],
+            "signature": [
+              "RansomwareFiles",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/ransomware/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.RegistryEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "RegistryEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/registry/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RegistryEcs.hive",
+            "type": "Array",
+            "tags": [],
+            "label": "hive",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/registry/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RegistryEcs.key",
+            "type": "Array",
+            "tags": [],
+            "label": "key",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/registry/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RegistryEcs.path",
+            "type": "Array",
+            "tags": [],
+            "label": "path",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/registry/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RegistryEcs.value",
+            "type": "Array",
+            "tags": [],
+            "label": "value",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/registry/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RegistryEcs.data",
+            "type": "Object",
+            "tags": [],
+            "label": "data",
+            "description": [],
+            "signature": [
+              "RegistryEcsData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/registry/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.RuleEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "RuleEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.id",
+            "type": "Array",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.rule_id",
+            "type": "Array",
+            "tags": [],
+            "label": "rule_id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.name",
+            "type": "Array",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.false_positives",
+            "type": "Array",
+            "tags": [],
+            "label": "false_positives",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.saved_id",
+            "type": "Array",
+            "tags": [],
+            "label": "saved_id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.timeline_id",
+            "type": "Array",
+            "tags": [],
+            "label": "timeline_id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.timeline_title",
+            "type": "Array",
+            "tags": [],
+            "label": "timeline_title",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.max_signals",
+            "type": "Array",
+            "tags": [],
+            "label": "max_signals",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.risk_score",
+            "type": "Array",
+            "tags": [],
+            "label": "risk_score",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.output_index",
+            "type": "Array",
+            "tags": [],
+            "label": "output_index",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.description",
+            "type": "Array",
+            "tags": [],
+            "label": "description",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.exceptions_list",
+            "type": "Array",
+            "tags": [],
+            "label": "exceptions_list",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.from",
+            "type": "Array",
+            "tags": [],
+            "label": "from",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.immutable",
+            "type": "Array",
+            "tags": [],
+            "label": "immutable",
+            "description": [],
+            "signature": [
+              "boolean[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.index",
+            "type": "Array",
+            "tags": [],
+            "label": "index",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.data_view_id",
+            "type": "string",
+            "tags": [],
+            "label": "data_view_id",
+            "description": [],
+            "signature": [
+              "string | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.interval",
+            "type": "Array",
+            "tags": [],
+            "label": "interval",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.language",
+            "type": "Array",
+            "tags": [],
+            "label": "language",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.query",
+            "type": "Array",
+            "tags": [],
+            "label": "query",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.references",
+            "type": "Array",
+            "tags": [],
+            "label": "references",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.severity",
+            "type": "Array",
+            "tags": [],
+            "label": "severity",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.tags",
+            "type": "Array",
+            "tags": [],
+            "label": "tags",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.threat",
+            "type": "Unknown",
+            "tags": [],
+            "label": "threat",
+            "description": [],
+            "signature": [
+              "unknown"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.threshold",
+            "type": "Unknown",
+            "tags": [],
+            "label": "threshold",
+            "description": [],
+            "signature": [
+              "unknown"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.type",
+            "type": "Array",
+            "tags": [],
+            "label": "type",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.size",
+            "type": "Array",
+            "tags": [],
+            "label": "size",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.to",
+            "type": "Array",
+            "tags": [],
+            "label": "to",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.enabled",
+            "type": "Array",
+            "tags": [],
+            "label": "enabled",
+            "description": [],
+            "signature": [
+              "boolean[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.filters",
+            "type": "Unknown",
+            "tags": [],
+            "label": "filters",
+            "description": [],
+            "signature": [
+              "unknown"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.created_at",
+            "type": "Array",
+            "tags": [],
+            "label": "created_at",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.updated_at",
+            "type": "Array",
+            "tags": [],
+            "label": "updated_at",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.created_by",
+            "type": "Array",
+            "tags": [],
+            "label": "created_by",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.updated_by",
+            "type": "Array",
+            "tags": [],
+            "label": "updated_by",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.version",
+            "type": "Array",
+            "tags": [],
+            "label": "version",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.note",
+            "type": "Array",
+            "tags": [],
+            "label": "note",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.RuleEcs.building_block_type",
+            "type": "Array",
+            "tags": [],
+            "label": "building_block_type",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/rule/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.SignalEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "SignalEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/signal/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SignalEcs.rule",
+            "type": "Object",
+            "tags": [],
+            "label": "rule",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.RuleEcs",
+                "text": "RuleEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/signal/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SignalEcs.original_time",
+            "type": "Array",
+            "tags": [],
+            "label": "original_time",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/signal/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SignalEcs.status",
+            "type": "Array",
+            "tags": [],
+            "label": "status",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/signal/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SignalEcs.group",
+            "type": "Object",
+            "tags": [],
+            "label": "group",
+            "description": [],
+            "signature": [
+              "{ id?: string[] | undefined; } | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/signal/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SignalEcs.threshold_result",
+            "type": "Unknown",
+            "tags": [],
+            "label": "threshold_result",
+            "description": [],
+            "signature": [
+              "unknown"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/signal/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.SourceEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "SourceEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/source/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SourceEcs.bytes",
+            "type": "Array",
+            "tags": [],
+            "label": "bytes",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/source/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SourceEcs.ip",
+            "type": "Array",
+            "tags": [],
+            "label": "ip",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/source/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SourceEcs.port",
+            "type": "Array",
+            "tags": [],
+            "label": "port",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/source/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SourceEcs.domain",
+            "type": "Array",
+            "tags": [],
+            "label": "domain",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/source/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SourceEcs.geo",
+            "type": "Object",
+            "tags": [],
+            "label": "geo",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.GeoEcs",
+                "text": "GeoEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/source/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SourceEcs.packets",
+            "type": "Array",
+            "tags": [],
+            "label": "packets",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/source/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.SuricataEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "SuricataEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/suricata/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SuricataEcs.eve",
+            "type": "Object",
+            "tags": [],
+            "label": "eve",
+            "description": [],
+            "signature": [
+              "SuricataEveData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/suricata/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.SystemEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "SystemEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/system/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SystemEcs.audit",
+            "type": "Object",
+            "tags": [],
+            "label": "audit",
+            "description": [],
+            "signature": [
+              "AuditEcs",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/system/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.SystemEcs.auth",
+            "type": "Object",
+            "tags": [],
+            "label": "auth",
+            "description": [],
+            "signature": [
+              "AuthEcs",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/system/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.Target",
+        "type": "Interface",
+        "tags": [],
+        "label": "Target",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/target_type/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.Target.process",
+            "type": "Object",
+            "tags": [],
+            "label": "process",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.ProcessEcs",
+                "text": "ProcessEcs"
+              }
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/target_type/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.ThreatEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "ThreatEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/threat/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ThreatEcs.indicator",
+            "type": "Array",
+            "tags": [],
+            "label": "indicator",
+            "description": [],
+            "signature": [
+              "LegacyThreatIndicatorEcs",
+              "[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/threat/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ThreatEcs.enrichments",
+            "type": "Array",
+            "tags": [],
+            "label": "enrichments",
+            "description": [],
+            "signature": [
+              "ThreatEnrichmentEcs",
+              "[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/threat/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.ThreatIndicatorEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "ThreatIndicatorEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/threat/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ThreatIndicatorEcs.url",
+            "type": "Object",
+            "tags": [],
+            "label": "url",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.UrlEcs",
+                "text": "UrlEcs"
+              },
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/threat/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ThreatIndicatorEcs.provider",
+            "type": "Array",
+            "tags": [],
+            "label": "provider",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/threat/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ThreatIndicatorEcs.reference",
+            "type": "Array",
+            "tags": [],
+            "label": "reference",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/threat/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ThreatIndicatorEcs.type",
+            "type": "Array",
+            "tags": [],
+            "label": "type",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/threat/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.TlsEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "TlsEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/tls/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.TlsEcs.client_certificate",
+            "type": "Object",
+            "tags": [],
+            "label": "client_certificate",
+            "description": [],
+            "signature": [
+              "TlsClientCertificateData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/tls/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.TlsEcs.fingerprints",
+            "type": "Object",
+            "tags": [],
+            "label": "fingerprints",
+            "description": [],
+            "signature": [
+              "TlsFingerprintsData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/tls/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.TlsEcs.server_certificate",
+            "type": "Object",
+            "tags": [],
+            "label": "server_certificate",
+            "description": [],
+            "signature": [
+              "TlsServerCertificateData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/tls/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.UrlEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "UrlEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/url/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.UrlEcs.domain",
+            "type": "Array",
+            "tags": [],
+            "label": "domain",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/url/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.UrlEcs.original",
+            "type": "Array",
+            "tags": [],
+            "label": "original",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/url/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.UrlEcs.username",
+            "type": "Array",
+            "tags": [],
+            "label": "username",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/url/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.UrlEcs.password",
+            "type": "Array",
+            "tags": [],
+            "label": "password",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/url/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.UserEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "UserEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/user/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.UserEcs.domain",
+            "type": "Array",
+            "tags": [],
+            "label": "domain",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/user/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.UserEcs.id",
+            "type": "Array",
+            "tags": [],
+            "label": "id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/user/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.UserEcs.name",
+            "type": "Array",
+            "tags": [],
+            "label": "name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/user/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.UserEcs.full_name",
+            "type": "Array",
+            "tags": [],
+            "label": "full_name",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/user/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.UserEcs.email",
+            "type": "Array",
+            "tags": [],
+            "label": "email",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/user/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.UserEcs.hash",
+            "type": "Array",
+            "tags": [],
+            "label": "hash",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/user/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.UserEcs.group",
+            "type": "Array",
+            "tags": [],
+            "label": "group",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/user/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.WinlogEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "WinlogEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/winlog/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.WinlogEcs.event_id",
+            "type": "Array",
+            "tags": [],
+            "label": "event_id",
+            "description": [],
+            "signature": [
+              "number[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/winlog/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.ZeekEcs",
+        "type": "Interface",
+        "tags": [],
+        "label": "ZeekEcs",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/zeek/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ZeekEcs.session_id",
+            "type": "Array",
+            "tags": [],
+            "label": "session_id",
+            "description": [],
+            "signature": [
+              "string[] | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/zeek/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ZeekEcs.connection",
+            "type": "Object",
+            "tags": [],
+            "label": "connection",
+            "description": [],
+            "signature": [
+              "ZeekConnectionData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/zeek/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ZeekEcs.notice",
+            "type": "Object",
+            "tags": [],
+            "label": "notice",
+            "description": [],
+            "signature": [
+              "ZeekNoticeData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/zeek/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ZeekEcs.dns",
+            "type": "Object",
+            "tags": [],
+            "label": "dns",
+            "description": [],
+            "signature": [
+              "ZeekDnsData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/zeek/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ZeekEcs.http",
+            "type": "Object",
+            "tags": [],
+            "label": "http",
+            "description": [],
+            "signature": [
+              "ZeekHttpData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/zeek/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ZeekEcs.files",
+            "type": "Object",
+            "tags": [],
+            "label": "files",
+            "description": [],
+            "signature": [
+              "ZeekFileData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/zeek/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.ZeekEcs.ssl",
+            "type": "Object",
+            "tags": [],
+            "label": "ssl",
+            "description": [],
+            "signature": [
+              "ZeekSslData",
+              " | undefined"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/zeek/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ],
+    "enums": [
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.EventCategory",
+        "type": "Enum",
+        "tags": [],
+        "label": "EventCategory",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.EventCode",
+        "type": "Enum",
+        "tags": [],
+        "label": "EventCode",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/event/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "initialIsOpen": false
+      }
+    ],
+    "misc": [],
+    "objects": [
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.cloudFieldsMap",
+        "type": "Object",
+        "tags": [],
+        "label": "cloudFieldsMap",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.cloudFieldsMap.cloud.account.id",
+            "type": "string",
+            "tags": [],
+            "label": "'cloud.account.id'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.cloudFieldsMap.cloud.availability_zone",
+            "type": "string",
+            "tags": [],
+            "label": "'cloud.availability_zone'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.cloudFieldsMap.cloud.instance.id",
+            "type": "string",
+            "tags": [],
+            "label": "'cloud.instance.id'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.cloudFieldsMap.cloud.instance.name",
+            "type": "string",
+            "tags": [],
+            "label": "'cloud.instance.name'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.cloudFieldsMap.cloud.machine.type",
+            "type": "string",
+            "tags": [],
+            "label": "'cloud.machine.type'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.cloudFieldsMap.cloud.provider",
+            "type": "string",
+            "tags": [],
+            "label": "'cloud.provider'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.cloudFieldsMap.cloud.region",
+            "type": "string",
+            "tags": [],
+            "label": "'cloud.region'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.hostFieldsMap",
+        "type": "Object",
+        "tags": [],
+        "label": "hostFieldsMap",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.hostFieldsMap.host.architecture",
+            "type": "string",
+            "tags": [],
+            "label": "'host.architecture'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.hostFieldsMap.host.id",
+            "type": "string",
+            "tags": [],
+            "label": "'host.id'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.hostFieldsMap.host.ip",
+            "type": "string",
+            "tags": [],
+            "label": "'host.ip'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.hostFieldsMap.host.mac",
+            "type": "string",
+            "tags": [],
+            "label": "'host.mac'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.hostFieldsMap.host.name",
+            "type": "string",
+            "tags": [],
+            "label": "'host.name'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.hostFieldsMap.Unnamed",
+            "type": "Any",
+            "tags": [],
+            "label": "Unnamed",
+            "description": [],
+            "signature": [
+              "any"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.osFieldsMap",
+        "type": "Object",
+        "tags": [],
+        "label": "osFieldsMap",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.osFieldsMap.os.platform",
+            "type": "string",
+            "tags": [],
+            "label": "'os.platform'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.osFieldsMap.os.name",
+            "type": "string",
+            "tags": [],
+            "label": "'os.name'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.osFieldsMap.os.full",
+            "type": "string",
+            "tags": [],
+            "label": "'os.full'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.osFieldsMap.os.family",
+            "type": "string",
+            "tags": [],
+            "label": "'os.family'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.osFieldsMap.os.version",
+            "type": "string",
+            "tags": [],
+            "label": "'os.version'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.osFieldsMap.os.kernel",
+            "type": "string",
+            "tags": [],
+            "label": "'os.kernel'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.processFieldsMap",
+        "type": "Object",
+        "tags": [],
+        "label": "processFieldsMap",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.hash.md5",
+            "type": "string",
+            "tags": [],
+            "label": "'process.hash.md5'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.hash.sha1",
+            "type": "string",
+            "tags": [],
+            "label": "'process.hash.sha1'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.hash.sha256",
+            "type": "string",
+            "tags": [],
+            "label": "'process.hash.sha256'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.pid",
+            "type": "string",
+            "tags": [],
+            "label": "'process.pid'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.name",
+            "type": "string",
+            "tags": [],
+            "label": "'process.name'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.ppid",
+            "type": "string",
+            "tags": [],
+            "label": "'process.ppid'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.args",
+            "type": "string",
+            "tags": [],
+            "label": "'process.args'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.entity_id",
+            "type": "string",
+            "tags": [],
+            "label": "'process.entity_id'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.executable",
+            "type": "string",
+            "tags": [],
+            "label": "'process.executable'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.title",
+            "type": "string",
+            "tags": [],
+            "label": "'process.title'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.thread",
+            "type": "string",
+            "tags": [],
+            "label": "'process.thread'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.processFieldsMap.process.working_directory",
+            "type": "string",
+            "tags": [],
+            "label": "'process.working_directory'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.sourceFieldsMap",
+        "type": "Object",
+        "tags": [],
+        "label": "sourceFieldsMap",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.sourceFieldsMap.source.bytes",
+            "type": "string",
+            "tags": [],
+            "label": "'source.bytes'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.sourceFieldsMap.source.ip",
+            "type": "string",
+            "tags": [],
+            "label": "'source.ip'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.sourceFieldsMap.source.packets",
+            "type": "string",
+            "tags": [],
+            "label": "'source.packets'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.sourceFieldsMap.source.port",
+            "type": "string",
+            "tags": [],
+            "label": "'source.port'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.sourceFieldsMap.source.domain",
+            "type": "string",
+            "tags": [],
+            "label": "'source.domain'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.sourceFieldsMap.source.geo.continent_name",
+            "type": "string",
+            "tags": [],
+            "label": "'source.geo.continent_name'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.sourceFieldsMap.source.geo.country_name",
+            "type": "string",
+            "tags": [],
+            "label": "'source.geo.country_name'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.sourceFieldsMap.source.geo.country_iso_code",
+            "type": "string",
+            "tags": [],
+            "label": "'source.geo.country_iso_code'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.sourceFieldsMap.source.geo.city_name",
+            "type": "string",
+            "tags": [],
+            "label": "'source.geo.city_name'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.sourceFieldsMap.source.geo.region_iso_code",
+            "type": "string",
+            "tags": [],
+            "label": "'source.geo.region_iso_code'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.sourceFieldsMap.source.geo.region_name",
+            "type": "string",
+            "tags": [],
+            "label": "'source.geo.region_name'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "@kbn/securitysolution-ecs",
+        "id": "def-common.userFieldsMap",
+        "type": "Object",
+        "tags": [],
+        "label": "userFieldsMap",
+        "description": [],
+        "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+        "deprecated": false,
+        "trackAdoption": false,
+        "children": [
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.userFieldsMap.user.domain",
+            "type": "string",
+            "tags": [],
+            "label": "'user.domain'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.userFieldsMap.user.id",
+            "type": "string",
+            "tags": [],
+            "label": "'user.id'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.userFieldsMap.user.name",
+            "type": "string",
+            "tags": [],
+            "label": "'user.name'",
+            "description": [],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.userFieldsMap.user.full_name",
+            "type": "string",
+            "tags": [],
+            "label": "'user.full_name'",
+            "description": [
+              "// NOTE: This field is not tested and available from ECS. Please remove this tag once it is"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.userFieldsMap.user.email",
+            "type": "string",
+            "tags": [],
+            "label": "'user.email'",
+            "description": [
+              "// NOTE: This field is not tested and available from ECS. Please remove this tag once it is"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.userFieldsMap.user.hash",
+            "type": "string",
+            "tags": [],
+            "label": "'user.hash'",
+            "description": [
+              "// NOTE: This field is not tested and available from ECS. Please remove this tag once it is"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          },
+          {
+            "parentPluginId": "@kbn/securitysolution-ecs",
+            "id": "def-common.userFieldsMap.user.group",
+            "type": "string",
+            "tags": [],
+            "label": "'user.group'",
+            "description": [
+              "// NOTE: This field is not tested and available from ECS. Please remove this tag once it is"
+            ],
+            "path": "packages/kbn-securitysolution-ecs/src/ecs_fields/index.ts",
+            "deprecated": false,
+            "trackAdoption": false
+          }
+        ],
+        "initialIsOpen": false
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/api_docs/kbn_securitysolution_ecs.mdx b/api_docs/kbn_securitysolution_ecs.mdx
new file mode 100644
index 00000000000000..ec137d55a30e29
--- /dev/null
+++ b/api_docs/kbn_securitysolution_ecs.mdx
@@ -0,0 +1,36 @@
+---
+####
+#### This document is auto-generated and is meant to be viewed inside our experimental, new docs system.
+#### Reach out in #docs-engineering for more info.
+####
+id: kibKbnSecuritysolutionEcsPluginApi
+slug: /kibana-dev-docs/api/kbn-securitysolution-ecs
+title: "@kbn/securitysolution-ecs"
+image: https://source.unsplash.com/400x175/?github
+description: API docs for the @kbn/securitysolution-ecs plugin
+date: 2023-01-24
+tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-ecs']
+---
+import kbnSecuritysolutionEcsObj from './kbn_securitysolution_ecs.devdocs.json';
+
+
+
+Contact [Owner missing] for questions regarding this plugin.
+
+**Code health stats**
+
+| Public API count  | Any count | Items lacking comments | Missing exports |
+|-------------------|-----------|------------------------|-----------------|
+| 341 | 1 | 337 | 32 |
+
+## Common
+
+### Objects
+<DocDefinitionList data={kbnSecuritysolutionEcsObj.common.objects}/>
+
+### Interfaces
+<DocDefinitionList data={kbnSecuritysolutionEcsObj.common.interfaces}/>
+
+### Enums
+<DocDefinitionList data={kbnSecuritysolutionEcsObj.common.enums}/>
+
diff --git a/api_docs/kbn_securitysolution_es_utils.mdx b/api_docs/kbn_securitysolution_es_utils.mdx
index 28b54b60bbaa58..99687e53e5f599 100644
--- a/api_docs/kbn_securitysolution_es_utils.mdx
+++ b/api_docs/kbn_securitysolution_es_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-es-utils
 title: "@kbn/securitysolution-es-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-es-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-es-utils']
 ---
 import kbnSecuritysolutionEsUtilsObj from './kbn_securitysolution_es_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_exception_list_components.devdocs.json b/api_docs/kbn_securitysolution_exception_list_components.devdocs.json
index 6e10def35b04f5..3c97016f1c1c43 100644
--- a/api_docs/kbn_securitysolution_exception_list_components.devdocs.json
+++ b/api_docs/kbn_securitysolution_exception_list_components.devdocs.json
@@ -834,7 +834,7 @@
             "label": "formattedDateComponent",
             "description": [],
             "signature": [
-              "\"symbol\" | \"object\" | React.ComponentType<any> | \"body\" | \"path\" | \"circle\" | \"filter\" | \"data\" | \"line\" | \"area\" | \"time\" | \"label\" | \"legend\" | \"article\" | \"image\" | \"link\" | \"menu\" | \"stop\" | \"base\" | \"text\" | \"title\" | \"s\" | \"small\" | \"source\" | \"output\" | \"svg\" | \"meta\" | \"script\" | \"summary\" | \"desc\" | \"q\" | \"pattern\" | \"mask\" | \"input\" | \"slot\" | \"style\" | \"head\" | \"section\" | \"animate\" | \"progress\" | \"view\" | \"big\" | \"sub\" | \"sup\" | \"var\" | \"map\" | \"html\" | \"a\" | \"img\" | \"audio\" | \"br\" | \"form\" | \"main\" | \"abbr\" | \"address\" | \"aside\" | \"b\" | \"bdi\" | \"bdo\" | \"blockquote\" | \"button\" | \"canvas\" | \"caption\" | \"cite\" | \"code\" | \"col\" | \"colgroup\" | \"datalist\" | \"dd\" | \"del\" | \"details\" | \"dfn\" | \"dialog\" | \"div\" | \"dl\" | \"dt\" | \"em\" | \"embed\" | \"fieldset\" | \"figcaption\" | \"figure\" | \"footer\" | \"h1\" | \"h2\" | \"h3\" | \"h4\" | \"h5\" | \"h6\" | \"header\" | \"hgroup\" | \"hr\" | \"i\" | \"iframe\" | \"ins\" | \"kbd\" | \"keygen\" | \"li\" | \"mark\" | \"menuitem\" | \"meter\" | \"nav\" | \"noindex\" | \"noscript\" | \"ol\" | \"optgroup\" | \"option\" | \"p\" | \"param\" | \"picture\" | \"pre\" | \"rp\" | \"rt\" | \"ruby\" | \"samp\" | \"select\" | \"span\" | \"strong\" | \"table\" | \"template\" | \"tbody\" | \"td\" | \"textarea\" | \"tfoot\" | \"th\" | \"thead\" | \"tr\" | \"track\" | \"u\" | \"ul\" | \"video\" | \"wbr\" | \"webview\" | \"animateMotion\" | \"animateTransform\" | \"clipPath\" | \"defs\" | \"ellipse\" | \"feBlend\" | \"feColorMatrix\" | \"feComponentTransfer\" | \"feComposite\" | \"feConvolveMatrix\" | \"feDiffuseLighting\" | \"feDisplacementMap\" | \"feDistantLight\" | \"feDropShadow\" | \"feFlood\" | \"feFuncA\" | \"feFuncB\" | \"feFuncG\" | \"feFuncR\" | \"feGaussianBlur\" | \"feImage\" | \"feMerge\" | \"feMergeNode\" | \"feMorphology\" | \"feOffset\" | \"fePointLight\" | \"feSpecularLighting\" | \"feSpotLight\" | \"feTile\" | \"feTurbulence\" | \"foreignObject\" | \"g\" | \"linearGradient\" | \"marker\" | \"metadata\" | \"mpath\" | \"polygon\" | \"polyline\" | \"radialGradient\" | \"rect\" | \"switch\" | \"textPath\" | \"tspan\" | \"use\""
+              "\"symbol\" | \"object\" | React.ComponentType<any> | \"body\" | \"path\" | \"circle\" | \"filter\" | \"data\" | \"line\" | \"area\" | \"time\" | \"label\" | \"legend\" | \"article\" | \"image\" | \"link\" | \"menu\" | \"stop\" | \"base\" | \"text\" | \"title\" | \"s\" | \"small\" | \"source\" | \"output\" | \"svg\" | \"map\" | \"meta\" | \"script\" | \"summary\" | \"desc\" | \"q\" | \"pattern\" | \"mask\" | \"input\" | \"slot\" | \"style\" | \"head\" | \"section\" | \"animate\" | \"progress\" | \"view\" | \"big\" | \"sub\" | \"sup\" | \"var\" | \"html\" | \"a\" | \"img\" | \"audio\" | \"br\" | \"form\" | \"main\" | \"abbr\" | \"address\" | \"aside\" | \"b\" | \"bdi\" | \"bdo\" | \"blockquote\" | \"button\" | \"canvas\" | \"caption\" | \"cite\" | \"code\" | \"col\" | \"colgroup\" | \"datalist\" | \"dd\" | \"del\" | \"details\" | \"dfn\" | \"dialog\" | \"div\" | \"dl\" | \"dt\" | \"em\" | \"embed\" | \"fieldset\" | \"figcaption\" | \"figure\" | \"footer\" | \"h1\" | \"h2\" | \"h3\" | \"h4\" | \"h5\" | \"h6\" | \"header\" | \"hgroup\" | \"hr\" | \"i\" | \"iframe\" | \"ins\" | \"kbd\" | \"keygen\" | \"li\" | \"mark\" | \"menuitem\" | \"meter\" | \"nav\" | \"noindex\" | \"noscript\" | \"ol\" | \"optgroup\" | \"option\" | \"p\" | \"param\" | \"picture\" | \"pre\" | \"rp\" | \"rt\" | \"ruby\" | \"samp\" | \"select\" | \"span\" | \"strong\" | \"table\" | \"template\" | \"tbody\" | \"td\" | \"textarea\" | \"tfoot\" | \"th\" | \"thead\" | \"tr\" | \"track\" | \"u\" | \"ul\" | \"video\" | \"wbr\" | \"webview\" | \"animateMotion\" | \"animateTransform\" | \"clipPath\" | \"defs\" | \"ellipse\" | \"feBlend\" | \"feColorMatrix\" | \"feComponentTransfer\" | \"feComposite\" | \"feConvolveMatrix\" | \"feDiffuseLighting\" | \"feDisplacementMap\" | \"feDistantLight\" | \"feDropShadow\" | \"feFlood\" | \"feFuncA\" | \"feFuncB\" | \"feFuncG\" | \"feFuncR\" | \"feGaussianBlur\" | \"feImage\" | \"feMerge\" | \"feMergeNode\" | \"feMorphology\" | \"feOffset\" | \"fePointLight\" | \"feSpecularLighting\" | \"feSpotLight\" | \"feTile\" | \"feTurbulence\" | \"foreignObject\" | \"g\" | \"linearGradient\" | \"marker\" | \"metadata\" | \"mpath\" | \"polygon\" | \"polyline\" | \"radialGradient\" | \"rect\" | \"switch\" | \"textPath\" | \"tspan\" | \"use\""
             ],
             "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/index.tsx",
             "deprecated": false,
@@ -848,7 +848,7 @@
             "label": "securityLinkAnchorComponent",
             "description": [],
             "signature": [
-              "\"symbol\" | \"object\" | React.ComponentType<any> | \"body\" | \"path\" | \"circle\" | \"filter\" | \"data\" | \"line\" | \"area\" | \"time\" | \"label\" | \"legend\" | \"article\" | \"image\" | \"link\" | \"menu\" | \"stop\" | \"base\" | \"text\" | \"title\" | \"s\" | \"small\" | \"source\" | \"output\" | \"svg\" | \"meta\" | \"script\" | \"summary\" | \"desc\" | \"q\" | \"pattern\" | \"mask\" | \"input\" | \"slot\" | \"style\" | \"head\" | \"section\" | \"animate\" | \"progress\" | \"view\" | \"big\" | \"sub\" | \"sup\" | \"var\" | \"map\" | \"html\" | \"a\" | \"img\" | \"audio\" | \"br\" | \"form\" | \"main\" | \"abbr\" | \"address\" | \"aside\" | \"b\" | \"bdi\" | \"bdo\" | \"blockquote\" | \"button\" | \"canvas\" | \"caption\" | \"cite\" | \"code\" | \"col\" | \"colgroup\" | \"datalist\" | \"dd\" | \"del\" | \"details\" | \"dfn\" | \"dialog\" | \"div\" | \"dl\" | \"dt\" | \"em\" | \"embed\" | \"fieldset\" | \"figcaption\" | \"figure\" | \"footer\" | \"h1\" | \"h2\" | \"h3\" | \"h4\" | \"h5\" | \"h6\" | \"header\" | \"hgroup\" | \"hr\" | \"i\" | \"iframe\" | \"ins\" | \"kbd\" | \"keygen\" | \"li\" | \"mark\" | \"menuitem\" | \"meter\" | \"nav\" | \"noindex\" | \"noscript\" | \"ol\" | \"optgroup\" | \"option\" | \"p\" | \"param\" | \"picture\" | \"pre\" | \"rp\" | \"rt\" | \"ruby\" | \"samp\" | \"select\" | \"span\" | \"strong\" | \"table\" | \"template\" | \"tbody\" | \"td\" | \"textarea\" | \"tfoot\" | \"th\" | \"thead\" | \"tr\" | \"track\" | \"u\" | \"ul\" | \"video\" | \"wbr\" | \"webview\" | \"animateMotion\" | \"animateTransform\" | \"clipPath\" | \"defs\" | \"ellipse\" | \"feBlend\" | \"feColorMatrix\" | \"feComponentTransfer\" | \"feComposite\" | \"feConvolveMatrix\" | \"feDiffuseLighting\" | \"feDisplacementMap\" | \"feDistantLight\" | \"feDropShadow\" | \"feFlood\" | \"feFuncA\" | \"feFuncB\" | \"feFuncG\" | \"feFuncR\" | \"feGaussianBlur\" | \"feImage\" | \"feMerge\" | \"feMergeNode\" | \"feMorphology\" | \"feOffset\" | \"fePointLight\" | \"feSpecularLighting\" | \"feSpotLight\" | \"feTile\" | \"feTurbulence\" | \"foreignObject\" | \"g\" | \"linearGradient\" | \"marker\" | \"metadata\" | \"mpath\" | \"polygon\" | \"polyline\" | \"radialGradient\" | \"rect\" | \"switch\" | \"textPath\" | \"tspan\" | \"use\""
+              "\"symbol\" | \"object\" | React.ComponentType<any> | \"body\" | \"path\" | \"circle\" | \"filter\" | \"data\" | \"line\" | \"area\" | \"time\" | \"label\" | \"legend\" | \"article\" | \"image\" | \"link\" | \"menu\" | \"stop\" | \"base\" | \"text\" | \"title\" | \"s\" | \"small\" | \"source\" | \"output\" | \"svg\" | \"map\" | \"meta\" | \"script\" | \"summary\" | \"desc\" | \"q\" | \"pattern\" | \"mask\" | \"input\" | \"slot\" | \"style\" | \"head\" | \"section\" | \"animate\" | \"progress\" | \"view\" | \"big\" | \"sub\" | \"sup\" | \"var\" | \"html\" | \"a\" | \"img\" | \"audio\" | \"br\" | \"form\" | \"main\" | \"abbr\" | \"address\" | \"aside\" | \"b\" | \"bdi\" | \"bdo\" | \"blockquote\" | \"button\" | \"canvas\" | \"caption\" | \"cite\" | \"code\" | \"col\" | \"colgroup\" | \"datalist\" | \"dd\" | \"del\" | \"details\" | \"dfn\" | \"dialog\" | \"div\" | \"dl\" | \"dt\" | \"em\" | \"embed\" | \"fieldset\" | \"figcaption\" | \"figure\" | \"footer\" | \"h1\" | \"h2\" | \"h3\" | \"h4\" | \"h5\" | \"h6\" | \"header\" | \"hgroup\" | \"hr\" | \"i\" | \"iframe\" | \"ins\" | \"kbd\" | \"keygen\" | \"li\" | \"mark\" | \"menuitem\" | \"meter\" | \"nav\" | \"noindex\" | \"noscript\" | \"ol\" | \"optgroup\" | \"option\" | \"p\" | \"param\" | \"picture\" | \"pre\" | \"rp\" | \"rt\" | \"ruby\" | \"samp\" | \"select\" | \"span\" | \"strong\" | \"table\" | \"template\" | \"tbody\" | \"td\" | \"textarea\" | \"tfoot\" | \"th\" | \"thead\" | \"tr\" | \"track\" | \"u\" | \"ul\" | \"video\" | \"wbr\" | \"webview\" | \"animateMotion\" | \"animateTransform\" | \"clipPath\" | \"defs\" | \"ellipse\" | \"feBlend\" | \"feColorMatrix\" | \"feComponentTransfer\" | \"feComposite\" | \"feConvolveMatrix\" | \"feDiffuseLighting\" | \"feDisplacementMap\" | \"feDistantLight\" | \"feDropShadow\" | \"feFlood\" | \"feFuncA\" | \"feFuncB\" | \"feFuncG\" | \"feFuncR\" | \"feGaussianBlur\" | \"feImage\" | \"feMerge\" | \"feMergeNode\" | \"feMorphology\" | \"feOffset\" | \"fePointLight\" | \"feSpecularLighting\" | \"feSpotLight\" | \"feTile\" | \"feTurbulence\" | \"foreignObject\" | \"g\" | \"linearGradient\" | \"marker\" | \"metadata\" | \"mpath\" | \"polygon\" | \"polyline\" | \"radialGradient\" | \"rect\" | \"switch\" | \"textPath\" | \"tspan\" | \"use\""
             ],
             "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/index.tsx",
             "deprecated": false,
@@ -987,7 +987,7 @@
             "label": "securityLinkAnchorComponent",
             "description": [],
             "signature": [
-              "\"symbol\" | \"object\" | React.ComponentType<any> | \"body\" | \"path\" | \"circle\" | \"filter\" | \"data\" | \"line\" | \"area\" | \"time\" | \"label\" | \"legend\" | \"article\" | \"image\" | \"link\" | \"menu\" | \"stop\" | \"base\" | \"text\" | \"title\" | \"s\" | \"small\" | \"source\" | \"output\" | \"svg\" | \"meta\" | \"script\" | \"summary\" | \"desc\" | \"q\" | \"pattern\" | \"mask\" | \"input\" | \"slot\" | \"style\" | \"head\" | \"section\" | \"animate\" | \"progress\" | \"view\" | \"big\" | \"sub\" | \"sup\" | \"var\" | \"map\" | \"html\" | \"a\" | \"img\" | \"audio\" | \"br\" | \"form\" | \"main\" | \"abbr\" | \"address\" | \"aside\" | \"b\" | \"bdi\" | \"bdo\" | \"blockquote\" | \"button\" | \"canvas\" | \"caption\" | \"cite\" | \"code\" | \"col\" | \"colgroup\" | \"datalist\" | \"dd\" | \"del\" | \"details\" | \"dfn\" | \"dialog\" | \"div\" | \"dl\" | \"dt\" | \"em\" | \"embed\" | \"fieldset\" | \"figcaption\" | \"figure\" | \"footer\" | \"h1\" | \"h2\" | \"h3\" | \"h4\" | \"h5\" | \"h6\" | \"header\" | \"hgroup\" | \"hr\" | \"i\" | \"iframe\" | \"ins\" | \"kbd\" | \"keygen\" | \"li\" | \"mark\" | \"menuitem\" | \"meter\" | \"nav\" | \"noindex\" | \"noscript\" | \"ol\" | \"optgroup\" | \"option\" | \"p\" | \"param\" | \"picture\" | \"pre\" | \"rp\" | \"rt\" | \"ruby\" | \"samp\" | \"select\" | \"span\" | \"strong\" | \"table\" | \"template\" | \"tbody\" | \"td\" | \"textarea\" | \"tfoot\" | \"th\" | \"thead\" | \"tr\" | \"track\" | \"u\" | \"ul\" | \"video\" | \"wbr\" | \"webview\" | \"animateMotion\" | \"animateTransform\" | \"clipPath\" | \"defs\" | \"ellipse\" | \"feBlend\" | \"feColorMatrix\" | \"feComponentTransfer\" | \"feComposite\" | \"feConvolveMatrix\" | \"feDiffuseLighting\" | \"feDisplacementMap\" | \"feDistantLight\" | \"feDropShadow\" | \"feFlood\" | \"feFuncA\" | \"feFuncB\" | \"feFuncG\" | \"feFuncR\" | \"feGaussianBlur\" | \"feImage\" | \"feMerge\" | \"feMergeNode\" | \"feMorphology\" | \"feOffset\" | \"fePointLight\" | \"feSpecularLighting\" | \"feSpotLight\" | \"feTile\" | \"feTurbulence\" | \"foreignObject\" | \"g\" | \"linearGradient\" | \"marker\" | \"metadata\" | \"mpath\" | \"polygon\" | \"polyline\" | \"radialGradient\" | \"rect\" | \"switch\" | \"textPath\" | \"tspan\" | \"use\""
+              "\"symbol\" | \"object\" | React.ComponentType<any> | \"body\" | \"path\" | \"circle\" | \"filter\" | \"data\" | \"line\" | \"area\" | \"time\" | \"label\" | \"legend\" | \"article\" | \"image\" | \"link\" | \"menu\" | \"stop\" | \"base\" | \"text\" | \"title\" | \"s\" | \"small\" | \"source\" | \"output\" | \"svg\" | \"map\" | \"meta\" | \"script\" | \"summary\" | \"desc\" | \"q\" | \"pattern\" | \"mask\" | \"input\" | \"slot\" | \"style\" | \"head\" | \"section\" | \"animate\" | \"progress\" | \"view\" | \"big\" | \"sub\" | \"sup\" | \"var\" | \"html\" | \"a\" | \"img\" | \"audio\" | \"br\" | \"form\" | \"main\" | \"abbr\" | \"address\" | \"aside\" | \"b\" | \"bdi\" | \"bdo\" | \"blockquote\" | \"button\" | \"canvas\" | \"caption\" | \"cite\" | \"code\" | \"col\" | \"colgroup\" | \"datalist\" | \"dd\" | \"del\" | \"details\" | \"dfn\" | \"dialog\" | \"div\" | \"dl\" | \"dt\" | \"em\" | \"embed\" | \"fieldset\" | \"figcaption\" | \"figure\" | \"footer\" | \"h1\" | \"h2\" | \"h3\" | \"h4\" | \"h5\" | \"h6\" | \"header\" | \"hgroup\" | \"hr\" | \"i\" | \"iframe\" | \"ins\" | \"kbd\" | \"keygen\" | \"li\" | \"mark\" | \"menuitem\" | \"meter\" | \"nav\" | \"noindex\" | \"noscript\" | \"ol\" | \"optgroup\" | \"option\" | \"p\" | \"param\" | \"picture\" | \"pre\" | \"rp\" | \"rt\" | \"ruby\" | \"samp\" | \"select\" | \"span\" | \"strong\" | \"table\" | \"template\" | \"tbody\" | \"td\" | \"textarea\" | \"tfoot\" | \"th\" | \"thead\" | \"tr\" | \"track\" | \"u\" | \"ul\" | \"video\" | \"wbr\" | \"webview\" | \"animateMotion\" | \"animateTransform\" | \"clipPath\" | \"defs\" | \"ellipse\" | \"feBlend\" | \"feColorMatrix\" | \"feComponentTransfer\" | \"feComposite\" | \"feConvolveMatrix\" | \"feDiffuseLighting\" | \"feDisplacementMap\" | \"feDistantLight\" | \"feDropShadow\" | \"feFlood\" | \"feFuncA\" | \"feFuncB\" | \"feFuncG\" | \"feFuncR\" | \"feGaussianBlur\" | \"feImage\" | \"feMerge\" | \"feMergeNode\" | \"feMorphology\" | \"feOffset\" | \"fePointLight\" | \"feSpecularLighting\" | \"feSpotLight\" | \"feTile\" | \"feTurbulence\" | \"foreignObject\" | \"g\" | \"linearGradient\" | \"marker\" | \"metadata\" | \"mpath\" | \"polygon\" | \"polyline\" | \"radialGradient\" | \"rect\" | \"switch\" | \"textPath\" | \"tspan\" | \"use\""
             ],
             "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/exception_item_card.tsx",
             "deprecated": false,
@@ -1001,7 +1001,7 @@
             "label": "formattedDateComponent",
             "description": [],
             "signature": [
-              "\"symbol\" | \"object\" | React.ComponentType<any> | \"body\" | \"path\" | \"circle\" | \"filter\" | \"data\" | \"line\" | \"area\" | \"time\" | \"label\" | \"legend\" | \"article\" | \"image\" | \"link\" | \"menu\" | \"stop\" | \"base\" | \"text\" | \"title\" | \"s\" | \"small\" | \"source\" | \"output\" | \"svg\" | \"meta\" | \"script\" | \"summary\" | \"desc\" | \"q\" | \"pattern\" | \"mask\" | \"input\" | \"slot\" | \"style\" | \"head\" | \"section\" | \"animate\" | \"progress\" | \"view\" | \"big\" | \"sub\" | \"sup\" | \"var\" | \"map\" | \"html\" | \"a\" | \"img\" | \"audio\" | \"br\" | \"form\" | \"main\" | \"abbr\" | \"address\" | \"aside\" | \"b\" | \"bdi\" | \"bdo\" | \"blockquote\" | \"button\" | \"canvas\" | \"caption\" | \"cite\" | \"code\" | \"col\" | \"colgroup\" | \"datalist\" | \"dd\" | \"del\" | \"details\" | \"dfn\" | \"dialog\" | \"div\" | \"dl\" | \"dt\" | \"em\" | \"embed\" | \"fieldset\" | \"figcaption\" | \"figure\" | \"footer\" | \"h1\" | \"h2\" | \"h3\" | \"h4\" | \"h5\" | \"h6\" | \"header\" | \"hgroup\" | \"hr\" | \"i\" | \"iframe\" | \"ins\" | \"kbd\" | \"keygen\" | \"li\" | \"mark\" | \"menuitem\" | \"meter\" | \"nav\" | \"noindex\" | \"noscript\" | \"ol\" | \"optgroup\" | \"option\" | \"p\" | \"param\" | \"picture\" | \"pre\" | \"rp\" | \"rt\" | \"ruby\" | \"samp\" | \"select\" | \"span\" | \"strong\" | \"table\" | \"template\" | \"tbody\" | \"td\" | \"textarea\" | \"tfoot\" | \"th\" | \"thead\" | \"tr\" | \"track\" | \"u\" | \"ul\" | \"video\" | \"wbr\" | \"webview\" | \"animateMotion\" | \"animateTransform\" | \"clipPath\" | \"defs\" | \"ellipse\" | \"feBlend\" | \"feColorMatrix\" | \"feComponentTransfer\" | \"feComposite\" | \"feConvolveMatrix\" | \"feDiffuseLighting\" | \"feDisplacementMap\" | \"feDistantLight\" | \"feDropShadow\" | \"feFlood\" | \"feFuncA\" | \"feFuncB\" | \"feFuncG\" | \"feFuncR\" | \"feGaussianBlur\" | \"feImage\" | \"feMerge\" | \"feMergeNode\" | \"feMorphology\" | \"feOffset\" | \"fePointLight\" | \"feSpecularLighting\" | \"feSpotLight\" | \"feTile\" | \"feTurbulence\" | \"foreignObject\" | \"g\" | \"linearGradient\" | \"marker\" | \"metadata\" | \"mpath\" | \"polygon\" | \"polyline\" | \"radialGradient\" | \"rect\" | \"switch\" | \"textPath\" | \"tspan\" | \"use\""
+              "\"symbol\" | \"object\" | React.ComponentType<any> | \"body\" | \"path\" | \"circle\" | \"filter\" | \"data\" | \"line\" | \"area\" | \"time\" | \"label\" | \"legend\" | \"article\" | \"image\" | \"link\" | \"menu\" | \"stop\" | \"base\" | \"text\" | \"title\" | \"s\" | \"small\" | \"source\" | \"output\" | \"svg\" | \"map\" | \"meta\" | \"script\" | \"summary\" | \"desc\" | \"q\" | \"pattern\" | \"mask\" | \"input\" | \"slot\" | \"style\" | \"head\" | \"section\" | \"animate\" | \"progress\" | \"view\" | \"big\" | \"sub\" | \"sup\" | \"var\" | \"html\" | \"a\" | \"img\" | \"audio\" | \"br\" | \"form\" | \"main\" | \"abbr\" | \"address\" | \"aside\" | \"b\" | \"bdi\" | \"bdo\" | \"blockquote\" | \"button\" | \"canvas\" | \"caption\" | \"cite\" | \"code\" | \"col\" | \"colgroup\" | \"datalist\" | \"dd\" | \"del\" | \"details\" | \"dfn\" | \"dialog\" | \"div\" | \"dl\" | \"dt\" | \"em\" | \"embed\" | \"fieldset\" | \"figcaption\" | \"figure\" | \"footer\" | \"h1\" | \"h2\" | \"h3\" | \"h4\" | \"h5\" | \"h6\" | \"header\" | \"hgroup\" | \"hr\" | \"i\" | \"iframe\" | \"ins\" | \"kbd\" | \"keygen\" | \"li\" | \"mark\" | \"menuitem\" | \"meter\" | \"nav\" | \"noindex\" | \"noscript\" | \"ol\" | \"optgroup\" | \"option\" | \"p\" | \"param\" | \"picture\" | \"pre\" | \"rp\" | \"rt\" | \"ruby\" | \"samp\" | \"select\" | \"span\" | \"strong\" | \"table\" | \"template\" | \"tbody\" | \"td\" | \"textarea\" | \"tfoot\" | \"th\" | \"thead\" | \"tr\" | \"track\" | \"u\" | \"ul\" | \"video\" | \"wbr\" | \"webview\" | \"animateMotion\" | \"animateTransform\" | \"clipPath\" | \"defs\" | \"ellipse\" | \"feBlend\" | \"feColorMatrix\" | \"feComponentTransfer\" | \"feComposite\" | \"feConvolveMatrix\" | \"feDiffuseLighting\" | \"feDisplacementMap\" | \"feDistantLight\" | \"feDropShadow\" | \"feFlood\" | \"feFuncA\" | \"feFuncB\" | \"feFuncG\" | \"feFuncR\" | \"feGaussianBlur\" | \"feImage\" | \"feMerge\" | \"feMergeNode\" | \"feMorphology\" | \"feOffset\" | \"fePointLight\" | \"feSpecularLighting\" | \"feSpotLight\" | \"feTile\" | \"feTurbulence\" | \"foreignObject\" | \"g\" | \"linearGradient\" | \"marker\" | \"metadata\" | \"mpath\" | \"polygon\" | \"polyline\" | \"radialGradient\" | \"rect\" | \"switch\" | \"textPath\" | \"tspan\" | \"use\""
             ],
             "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/exception_item_card.tsx",
             "deprecated": false,
diff --git a/api_docs/kbn_securitysolution_exception_list_components.mdx b/api_docs/kbn_securitysolution_exception_list_components.mdx
index 59fcefcdfa11c2..24f44065a8755f 100644
--- a/api_docs/kbn_securitysolution_exception_list_components.mdx
+++ b/api_docs/kbn_securitysolution_exception_list_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-exception-list-components
 title: "@kbn/securitysolution-exception-list-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-exception-list-components plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-exception-list-components']
 ---
 import kbnSecuritysolutionExceptionListComponentsObj from './kbn_securitysolution_exception_list_components.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_hook_utils.mdx b/api_docs/kbn_securitysolution_hook_utils.mdx
index 7bc28e51513059..149e7ea6ae96fd 100644
--- a/api_docs/kbn_securitysolution_hook_utils.mdx
+++ b/api_docs/kbn_securitysolution_hook_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-hook-utils
 title: "@kbn/securitysolution-hook-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-hook-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-hook-utils']
 ---
 import kbnSecuritysolutionHookUtilsObj from './kbn_securitysolution_hook_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
index 38e354a34d9091..fbcebfc8d33779 100644
--- a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-alerting-types
 title: "@kbn/securitysolution-io-ts-alerting-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-alerting-types plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-alerting-types']
 ---
 import kbnSecuritysolutionIoTsAlertingTypesObj from './kbn_securitysolution_io_ts_alerting_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.mdx b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
index 69ec65afd92771..985be2cd11a447 100644
--- a/api_docs/kbn_securitysolution_io_ts_list_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_list_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-list-types
 title: "@kbn/securitysolution-io-ts-list-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-list-types plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-list-types']
 ---
 import kbnSecuritysolutionIoTsListTypesObj from './kbn_securitysolution_io_ts_list_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_types.mdx b/api_docs/kbn_securitysolution_io_ts_types.mdx
index 1b57af66bd2b4f..bbd9089552ad10 100644
--- a/api_docs/kbn_securitysolution_io_ts_types.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-types
 title: "@kbn/securitysolution-io-ts-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-types plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-types']
 ---
 import kbnSecuritysolutionIoTsTypesObj from './kbn_securitysolution_io_ts_types.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_io_ts_utils.mdx b/api_docs/kbn_securitysolution_io_ts_utils.mdx
index e6262fd1f7da24..77849eae26fb03 100644
--- a/api_docs/kbn_securitysolution_io_ts_utils.mdx
+++ b/api_docs/kbn_securitysolution_io_ts_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-utils
 title: "@kbn/securitysolution-io-ts-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-io-ts-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-utils']
 ---
 import kbnSecuritysolutionIoTsUtilsObj from './kbn_securitysolution_io_ts_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_api.mdx b/api_docs/kbn_securitysolution_list_api.mdx
index b605738ffcc4e7..71ec9815ec5869 100644
--- a/api_docs/kbn_securitysolution_list_api.mdx
+++ b/api_docs/kbn_securitysolution_list_api.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-api
 title: "@kbn/securitysolution-list-api"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-api plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-api']
 ---
 import kbnSecuritysolutionListApiObj from './kbn_securitysolution_list_api.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_constants.mdx b/api_docs/kbn_securitysolution_list_constants.mdx
index 371ac74d472827..c495bb3b37aa58 100644
--- a/api_docs/kbn_securitysolution_list_constants.mdx
+++ b/api_docs/kbn_securitysolution_list_constants.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-constants
 title: "@kbn/securitysolution-list-constants"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-constants plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-constants']
 ---
 import kbnSecuritysolutionListConstantsObj from './kbn_securitysolution_list_constants.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_hooks.mdx b/api_docs/kbn_securitysolution_list_hooks.mdx
index 32147fbf4a55c2..8fbe26d6bc7e6c 100644
--- a/api_docs/kbn_securitysolution_list_hooks.mdx
+++ b/api_docs/kbn_securitysolution_list_hooks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-hooks
 title: "@kbn/securitysolution-list-hooks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-hooks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-hooks']
 ---
 import kbnSecuritysolutionListHooksObj from './kbn_securitysolution_list_hooks.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_list_utils.mdx b/api_docs/kbn_securitysolution_list_utils.mdx
index f2af83a6ab71a9..ec852a2c263ae4 100644
--- a/api_docs/kbn_securitysolution_list_utils.mdx
+++ b/api_docs/kbn_securitysolution_list_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-utils
 title: "@kbn/securitysolution-list-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-list-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-utils']
 ---
 import kbnSecuritysolutionListUtilsObj from './kbn_securitysolution_list_utils.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_rules.mdx b/api_docs/kbn_securitysolution_rules.mdx
index b50cf28def8b0d..faea93f5db66f8 100644
--- a/api_docs/kbn_securitysolution_rules.mdx
+++ b/api_docs/kbn_securitysolution_rules.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-rules
 title: "@kbn/securitysolution-rules"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-rules plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-rules']
 ---
 import kbnSecuritysolutionRulesObj from './kbn_securitysolution_rules.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_t_grid.mdx b/api_docs/kbn_securitysolution_t_grid.mdx
index f78cca87ae209e..f2fe3f812fdea9 100644
--- a/api_docs/kbn_securitysolution_t_grid.mdx
+++ b/api_docs/kbn_securitysolution_t_grid.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-t-grid
 title: "@kbn/securitysolution-t-grid"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-t-grid plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-t-grid']
 ---
 import kbnSecuritysolutionTGridObj from './kbn_securitysolution_t_grid.devdocs.json';
diff --git a/api_docs/kbn_securitysolution_utils.mdx b/api_docs/kbn_securitysolution_utils.mdx
index ab4c98e6d53c2e..1e1c309e9a7611 100644
--- a/api_docs/kbn_securitysolution_utils.mdx
+++ b/api_docs/kbn_securitysolution_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-utils
 title: "@kbn/securitysolution-utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/securitysolution-utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-utils']
 ---
 import kbnSecuritysolutionUtilsObj from './kbn_securitysolution_utils.devdocs.json';
diff --git a/api_docs/kbn_server_http_tools.mdx b/api_docs/kbn_server_http_tools.mdx
index 70f2390cc5d4c9..d3e3a06f1a3308 100644
--- a/api_docs/kbn_server_http_tools.mdx
+++ b/api_docs/kbn_server_http_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-http-tools
 title: "@kbn/server-http-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-http-tools plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-http-tools']
 ---
 import kbnServerHttpToolsObj from './kbn_server_http_tools.devdocs.json';
diff --git a/api_docs/kbn_server_route_repository.mdx b/api_docs/kbn_server_route_repository.mdx
index c72fd19fc9b917..b7226dd53976ed 100644
--- a/api_docs/kbn_server_route_repository.mdx
+++ b/api_docs/kbn_server_route_repository.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-route-repository
 title: "@kbn/server-route-repository"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/server-route-repository plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-route-repository']
 ---
 import kbnServerRouteRepositoryObj from './kbn_server_route_repository.devdocs.json';
diff --git a/api_docs/kbn_shared_svg.mdx b/api_docs/kbn_shared_svg.mdx
index 271e40a1c7c08e..80f96559dbd013 100644
--- a/api_docs/kbn_shared_svg.mdx
+++ b/api_docs/kbn_shared_svg.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-svg
 title: "@kbn/shared-svg"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-svg plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-svg']
 ---
 import kbnSharedSvgObj from './kbn_shared_svg.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_avatar_solution.mdx b/api_docs/kbn_shared_ux_avatar_solution.mdx
index 0bb24cdb1f261b..63335382ce4c90 100644
--- a/api_docs/kbn_shared_ux_avatar_solution.mdx
+++ b/api_docs/kbn_shared_ux_avatar_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-solution
 title: "@kbn/shared-ux-avatar-solution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-avatar-solution plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-solution']
 ---
 import kbnSharedUxAvatarSolutionObj from './kbn_shared_ux_avatar_solution.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx b/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
index baac2ac3b249f2..74e5ac3bcc2733 100644
--- a/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
+++ b/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-user-profile-components
 title: "@kbn/shared-ux-avatar-user-profile-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-avatar-user-profile-components plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-user-profile-components']
 ---
 import kbnSharedUxAvatarUserProfileComponentsObj from './kbn_shared_ux_avatar_user_profile_components.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
index f1575d2ec0d7c0..0b95a337c5b1d3 100644
--- a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
+++ b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen
 title: "@kbn/shared-ux-button-exit-full-screen"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-exit-full-screen plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen']
 ---
 import kbnSharedUxButtonExitFullScreenObj from './kbn_shared_ux_button_exit_full_screen.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
index ab031950e37c56..fed1be27cb37d3 100644
--- a/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
+++ b/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen-mocks
 title: "@kbn/shared-ux-button-exit-full-screen-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-exit-full-screen-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen-mocks']
 ---
 import kbnSharedUxButtonExitFullScreenMocksObj from './kbn_shared_ux_button_exit_full_screen_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_button_toolbar.mdx b/api_docs/kbn_shared_ux_button_toolbar.mdx
index 56a4ef437baa08..5ee9f7aeed7d79 100644
--- a/api_docs/kbn_shared_ux_button_toolbar.mdx
+++ b/api_docs/kbn_shared_ux_button_toolbar.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-toolbar
 title: "@kbn/shared-ux-button-toolbar"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-button-toolbar plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-toolbar']
 ---
 import kbnSharedUxButtonToolbarObj from './kbn_shared_ux_button_toolbar.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_card_no_data.mdx b/api_docs/kbn_shared_ux_card_no_data.mdx
index c9b627ea2778ab..934cc068573097 100644
--- a/api_docs/kbn_shared_ux_card_no_data.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data
 title: "@kbn/shared-ux-card-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data']
 ---
 import kbnSharedUxCardNoDataObj from './kbn_shared_ux_card_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
index 9ea7d653fc3115..79cec7695d40f2 100644
--- a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data-mocks
 title: "@kbn/shared-ux-card-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-card-no-data-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data-mocks']
 ---
 import kbnSharedUxCardNoDataMocksObj from './kbn_shared_ux_card_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_context.mdx b/api_docs/kbn_shared_ux_file_context.mdx
index c601160e9c0e3c..1b3c24be94d938 100644
--- a/api_docs/kbn_shared_ux_file_context.mdx
+++ b/api_docs/kbn_shared_ux_file_context.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-context
 title: "@kbn/shared-ux-file-context"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-context plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-context']
 ---
 import kbnSharedUxFileContextObj from './kbn_shared_ux_file_context.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image.mdx b/api_docs/kbn_shared_ux_file_image.mdx
index 4091baad1d0a64..c7b8ca81270376 100644
--- a/api_docs/kbn_shared_ux_file_image.mdx
+++ b/api_docs/kbn_shared_ux_file_image.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image
 title: "@kbn/shared-ux-file-image"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image']
 ---
 import kbnSharedUxFileImageObj from './kbn_shared_ux_file_image.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_image_mocks.mdx b/api_docs/kbn_shared_ux_file_image_mocks.mdx
index c46ec896a61af2..6a92caa56e94c6 100644
--- a/api_docs/kbn_shared_ux_file_image_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_image_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image-mocks
 title: "@kbn/shared-ux-file-image-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-image-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image-mocks']
 ---
 import kbnSharedUxFileImageMocksObj from './kbn_shared_ux_file_image_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_mocks.mdx b/api_docs/kbn_shared_ux_file_mocks.mdx
index 3dcd98229eef42..0079df083f4f84 100644
--- a/api_docs/kbn_shared_ux_file_mocks.mdx
+++ b/api_docs/kbn_shared_ux_file_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-mocks
 title: "@kbn/shared-ux-file-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-mocks']
 ---
 import kbnSharedUxFileMocksObj from './kbn_shared_ux_file_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_picker.mdx b/api_docs/kbn_shared_ux_file_picker.mdx
index 6d7ad8f51789cc..f64e39b85256ac 100644
--- a/api_docs/kbn_shared_ux_file_picker.mdx
+++ b/api_docs/kbn_shared_ux_file_picker.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-picker
 title: "@kbn/shared-ux-file-picker"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-picker plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-picker']
 ---
 import kbnSharedUxFilePickerObj from './kbn_shared_ux_file_picker.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_upload.mdx b/api_docs/kbn_shared_ux_file_upload.mdx
index 9bd718ec117065..561112c471bcfd 100644
--- a/api_docs/kbn_shared_ux_file_upload.mdx
+++ b/api_docs/kbn_shared_ux_file_upload.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-upload
 title: "@kbn/shared-ux-file-upload"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-upload plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-upload']
 ---
 import kbnSharedUxFileUploadObj from './kbn_shared_ux_file_upload.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_file_util.mdx b/api_docs/kbn_shared_ux_file_util.mdx
index fb858c3a998d23..b3af472a664db0 100644
--- a/api_docs/kbn_shared_ux_file_util.mdx
+++ b/api_docs/kbn_shared_ux_file_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-util
 title: "@kbn/shared-ux-file-util"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-file-util plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-util']
 ---
 import kbnSharedUxFileUtilObj from './kbn_shared_ux_file_util.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app.mdx b/api_docs/kbn_shared_ux_link_redirect_app.mdx
index 90f08d26ce0b65..f894a306a78ac1 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app
 title: "@kbn/shared-ux-link-redirect-app"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app']
 ---
 import kbnSharedUxLinkRedirectAppObj from './kbn_shared_ux_link_redirect_app.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
index b6b57782430972..c059864f3cda65 100644
--- a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
+++ b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app-mocks
 title: "@kbn/shared-ux-link-redirect-app-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-link-redirect-app-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app-mocks']
 ---
 import kbnSharedUxLinkRedirectAppMocksObj from './kbn_shared_ux_link_redirect_app_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown.mdx b/api_docs/kbn_shared_ux_markdown.mdx
index 21523bac6f4133..17189623a529af 100644
--- a/api_docs/kbn_shared_ux_markdown.mdx
+++ b/api_docs/kbn_shared_ux_markdown.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown
 title: "@kbn/shared-ux-markdown"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown']
 ---
 import kbnSharedUxMarkdownObj from './kbn_shared_ux_markdown.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_markdown_mocks.mdx b/api_docs/kbn_shared_ux_markdown_mocks.mdx
index 1f326700d14a38..1817408a143596 100644
--- a/api_docs/kbn_shared_ux_markdown_mocks.mdx
+++ b/api_docs/kbn_shared_ux_markdown_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown-mocks
 title: "@kbn/shared-ux-markdown-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-markdown-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown-mocks']
 ---
 import kbnSharedUxMarkdownMocksObj from './kbn_shared_ux_markdown_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
index 88be05c18afa69..78b88625273a25 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data
 title: "@kbn/shared-ux-page-analytics-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data']
 ---
 import kbnSharedUxPageAnalyticsNoDataObj from './kbn_shared_ux_page_analytics_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
index 74152788e10e73..9885b9811f0b7d 100644
--- a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data-mocks
 title: "@kbn/shared-ux-page-analytics-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-analytics-no-data-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data-mocks']
 ---
 import kbnSharedUxPageAnalyticsNoDataMocksObj from './kbn_shared_ux_page_analytics_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
index 594ac5aa94e00b..3f0495e05e642a 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data
 title: "@kbn/shared-ux-page-kibana-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data']
 ---
 import kbnSharedUxPageKibanaNoDataObj from './kbn_shared_ux_page_kibana_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
index d0bc1d4e016ed4..cceee7a34091de 100644
--- a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data-mocks
 title: "@kbn/shared-ux-page-kibana-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-no-data-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data-mocks']
 ---
 import kbnSharedUxPageKibanaNoDataMocksObj from './kbn_shared_ux_page_kibana_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template.mdx b/api_docs/kbn_shared_ux_page_kibana_template.mdx
index ce6ff349ee3700..0c26d2e6c6637c 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template
 title: "@kbn/shared-ux-page-kibana-template"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template']
 ---
 import kbnSharedUxPageKibanaTemplateObj from './kbn_shared_ux_page_kibana_template.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
index 48b2e927b75f07..35224a1d37233f 100644
--- a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template-mocks
 title: "@kbn/shared-ux-page-kibana-template-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-kibana-template-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template-mocks']
 ---
 import kbnSharedUxPageKibanaTemplateMocksObj from './kbn_shared_ux_page_kibana_template_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data.mdx b/api_docs/kbn_shared_ux_page_no_data.mdx
index f8bd74793a86f2..891c1ef5cf11f4 100644
--- a/api_docs/kbn_shared_ux_page_no_data.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data
 title: "@kbn/shared-ux-page-no-data"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data']
 ---
 import kbnSharedUxPageNoDataObj from './kbn_shared_ux_page_no_data.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_config.mdx b/api_docs/kbn_shared_ux_page_no_data_config.mdx
index 3032aa1c158222..1f708fb570cbe7 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config
 title: "@kbn/shared-ux-page-no-data-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config']
 ---
 import kbnSharedUxPageNoDataConfigObj from './kbn_shared_ux_page_no_data_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
index e8d023533e8916..5a5fcda5e9291b 100644
--- a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config-mocks
 title: "@kbn/shared-ux-page-no-data-config-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-config-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config-mocks']
 ---
 import kbnSharedUxPageNoDataConfigMocksObj from './kbn_shared_ux_page_no_data_config_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
index 729c1581c42774..da7cdb477d8ca1 100644
--- a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
+++ b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-mocks
 title: "@kbn/shared-ux-page-no-data-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-no-data-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-mocks']
 ---
 import kbnSharedUxPageNoDataMocksObj from './kbn_shared_ux_page_no_data_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_page_solution_nav.mdx b/api_docs/kbn_shared_ux_page_solution_nav.mdx
index 0bd68b9280d320..014c5a61ad30a7 100644
--- a/api_docs/kbn_shared_ux_page_solution_nav.mdx
+++ b/api_docs/kbn_shared_ux_page_solution_nav.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-solution-nav
 title: "@kbn/shared-ux-page-solution-nav"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-page-solution-nav plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-solution-nav']
 ---
 import kbnSharedUxPageSolutionNavObj from './kbn_shared_ux_page_solution_nav.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
index 36c550d5909b0a..2328a4397af500 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views
 title: "@kbn/shared-ux-prompt-no-data-views"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views']
 ---
 import kbnSharedUxPromptNoDataViewsObj from './kbn_shared_ux_prompt_no_data_views.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
index f44f46d1bf3e2f..e4a5ad98a69407 100644
--- a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
+++ b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views-mocks
 title: "@kbn/shared-ux-prompt-no-data-views-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-no-data-views-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views-mocks']
 ---
 import kbnSharedUxPromptNoDataViewsMocksObj from './kbn_shared_ux_prompt_no_data_views_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_prompt_not_found.mdx b/api_docs/kbn_shared_ux_prompt_not_found.mdx
index 7b4b611ba7494d..f4f357b1080056 100644
--- a/api_docs/kbn_shared_ux_prompt_not_found.mdx
+++ b/api_docs/kbn_shared_ux_prompt_not_found.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-not-found
 title: "@kbn/shared-ux-prompt-not-found"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-prompt-not-found plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-not-found']
 ---
 import kbnSharedUxPromptNotFoundObj from './kbn_shared_ux_prompt_not_found.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router.mdx b/api_docs/kbn_shared_ux_router.mdx
index f2f10aaa709026..cf843b74cfaf5b 100644
--- a/api_docs/kbn_shared_ux_router.mdx
+++ b/api_docs/kbn_shared_ux_router.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router
 title: "@kbn/shared-ux-router"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router']
 ---
 import kbnSharedUxRouterObj from './kbn_shared_ux_router.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_router_mocks.mdx b/api_docs/kbn_shared_ux_router_mocks.mdx
index 875eeebf03863a..411da85281a0e7 100644
--- a/api_docs/kbn_shared_ux_router_mocks.mdx
+++ b/api_docs/kbn_shared_ux_router_mocks.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router-mocks
 title: "@kbn/shared-ux-router-mocks"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-router-mocks plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router-mocks']
 ---
 import kbnSharedUxRouterMocksObj from './kbn_shared_ux_router_mocks.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_config.mdx b/api_docs/kbn_shared_ux_storybook_config.mdx
index 954c13d4b4c883..3dcd3fd16c3168 100644
--- a/api_docs/kbn_shared_ux_storybook_config.mdx
+++ b/api_docs/kbn_shared_ux_storybook_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-config
 title: "@kbn/shared-ux-storybook-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-config plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-config']
 ---
 import kbnSharedUxStorybookConfigObj from './kbn_shared_ux_storybook_config.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_storybook_mock.mdx b/api_docs/kbn_shared_ux_storybook_mock.mdx
index ea21ea7c03bc96..aaff3cbae701a1 100644
--- a/api_docs/kbn_shared_ux_storybook_mock.mdx
+++ b/api_docs/kbn_shared_ux_storybook_mock.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-mock
 title: "@kbn/shared-ux-storybook-mock"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-storybook-mock plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-mock']
 ---
 import kbnSharedUxStorybookMockObj from './kbn_shared_ux_storybook_mock.devdocs.json';
diff --git a/api_docs/kbn_shared_ux_utility.mdx b/api_docs/kbn_shared_ux_utility.mdx
index 6239fedcc9cbde..728833559ff383 100644
--- a/api_docs/kbn_shared_ux_utility.mdx
+++ b/api_docs/kbn_shared_ux_utility.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-utility
 title: "@kbn/shared-ux-utility"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/shared-ux-utility plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-utility']
 ---
 import kbnSharedUxUtilityObj from './kbn_shared_ux_utility.devdocs.json';
diff --git a/api_docs/kbn_slo_schema.mdx b/api_docs/kbn_slo_schema.mdx
index 4826a46c18d1b0..eafeacdc387314 100644
--- a/api_docs/kbn_slo_schema.mdx
+++ b/api_docs/kbn_slo_schema.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-slo-schema
 title: "@kbn/slo-schema"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/slo-schema plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/slo-schema']
 ---
 import kbnSloSchemaObj from './kbn_slo_schema.devdocs.json';
diff --git a/api_docs/kbn_some_dev_log.mdx b/api_docs/kbn_some_dev_log.mdx
index b1ce48eac65cec..2a905ca49cda04 100644
--- a/api_docs/kbn_some_dev_log.mdx
+++ b/api_docs/kbn_some_dev_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-some-dev-log
 title: "@kbn/some-dev-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/some-dev-log plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/some-dev-log']
 ---
 import kbnSomeDevLogObj from './kbn_some_dev_log.devdocs.json';
diff --git a/api_docs/kbn_std.mdx b/api_docs/kbn_std.mdx
index a88939913f538d..e459334f636ddc 100644
--- a/api_docs/kbn_std.mdx
+++ b/api_docs/kbn_std.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-std
 title: "@kbn/std"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/std plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/std']
 ---
 import kbnStdObj from './kbn_std.devdocs.json';
diff --git a/api_docs/kbn_stdio_dev_helpers.mdx b/api_docs/kbn_stdio_dev_helpers.mdx
index 0e70e03dd440d9..e1f166ac9e078e 100644
--- a/api_docs/kbn_stdio_dev_helpers.mdx
+++ b/api_docs/kbn_stdio_dev_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-stdio-dev-helpers
 title: "@kbn/stdio-dev-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/stdio-dev-helpers plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/stdio-dev-helpers']
 ---
 import kbnStdioDevHelpersObj from './kbn_stdio_dev_helpers.devdocs.json';
diff --git a/api_docs/kbn_storybook.mdx b/api_docs/kbn_storybook.mdx
index 3b468a59d4690c..42170d62a0446d 100644
--- a/api_docs/kbn_storybook.mdx
+++ b/api_docs/kbn_storybook.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-storybook
 title: "@kbn/storybook"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/storybook plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/storybook']
 ---
 import kbnStorybookObj from './kbn_storybook.devdocs.json';
diff --git a/api_docs/kbn_telemetry_tools.mdx b/api_docs/kbn_telemetry_tools.mdx
index 674fb0b25ffa89..991491f0751fdd 100644
--- a/api_docs/kbn_telemetry_tools.mdx
+++ b/api_docs/kbn_telemetry_tools.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-telemetry-tools
 title: "@kbn/telemetry-tools"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/telemetry-tools plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/telemetry-tools']
 ---
 import kbnTelemetryToolsObj from './kbn_telemetry_tools.devdocs.json';
diff --git a/api_docs/kbn_test.mdx b/api_docs/kbn_test.mdx
index 8bc63b61812ae1..24e08a2548f075 100644
--- a/api_docs/kbn_test.mdx
+++ b/api_docs/kbn_test.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test
 title: "@kbn/test"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test']
 ---
 import kbnTestObj from './kbn_test.devdocs.json';
diff --git a/api_docs/kbn_test_jest_helpers.mdx b/api_docs/kbn_test_jest_helpers.mdx
index db8abf09889d8d..4f47a743598aca 100644
--- a/api_docs/kbn_test_jest_helpers.mdx
+++ b/api_docs/kbn_test_jest_helpers.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-jest-helpers
 title: "@kbn/test-jest-helpers"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-jest-helpers plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-jest-helpers']
 ---
 import kbnTestJestHelpersObj from './kbn_test_jest_helpers.devdocs.json';
diff --git a/api_docs/kbn_test_subj_selector.mdx b/api_docs/kbn_test_subj_selector.mdx
index cf8b64c5240a6d..de9f86c2a2754c 100644
--- a/api_docs/kbn_test_subj_selector.mdx
+++ b/api_docs/kbn_test_subj_selector.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-subj-selector
 title: "@kbn/test-subj-selector"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/test-subj-selector plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-subj-selector']
 ---
 import kbnTestSubjSelectorObj from './kbn_test_subj_selector.devdocs.json';
diff --git a/api_docs/kbn_tooling_log.mdx b/api_docs/kbn_tooling_log.mdx
index 82d2693bbba438..0a67dd81eaf74b 100644
--- a/api_docs/kbn_tooling_log.mdx
+++ b/api_docs/kbn_tooling_log.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-tooling-log
 title: "@kbn/tooling-log"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/tooling-log plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/tooling-log']
 ---
 import kbnToolingLogObj from './kbn_tooling_log.devdocs.json';
diff --git a/api_docs/kbn_ts_projects.mdx b/api_docs/kbn_ts_projects.mdx
index 1534dd1aeb107b..4a3866d17e3a25 100644
--- a/api_docs/kbn_ts_projects.mdx
+++ b/api_docs/kbn_ts_projects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ts-projects
 title: "@kbn/ts-projects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ts-projects plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ts-projects']
 ---
 import kbnTsProjectsObj from './kbn_ts_projects.devdocs.json';
diff --git a/api_docs/kbn_typed_react_router_config.mdx b/api_docs/kbn_typed_react_router_config.mdx
index 3f48fac5959e23..5f010946045396 100644
--- a/api_docs/kbn_typed_react_router_config.mdx
+++ b/api_docs/kbn_typed_react_router_config.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-typed-react-router-config
 title: "@kbn/typed-react-router-config"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/typed-react-router-config plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/typed-react-router-config']
 ---
 import kbnTypedReactRouterConfigObj from './kbn_typed_react_router_config.devdocs.json';
diff --git a/api_docs/kbn_ui_actions_browser.mdx b/api_docs/kbn_ui_actions_browser.mdx
index dc0896b76d2adb..0c07efce09e5e7 100644
--- a/api_docs/kbn_ui_actions_browser.mdx
+++ b/api_docs/kbn_ui_actions_browser.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-actions-browser
 title: "@kbn/ui-actions-browser"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-actions-browser plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-actions-browser']
 ---
 import kbnUiActionsBrowserObj from './kbn_ui_actions_browser.devdocs.json';
diff --git a/api_docs/kbn_ui_shared_deps_src.mdx b/api_docs/kbn_ui_shared_deps_src.mdx
index d235a96b1940c0..6bf235465a72f4 100644
--- a/api_docs/kbn_ui_shared_deps_src.mdx
+++ b/api_docs/kbn_ui_shared_deps_src.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-shared-deps-src
 title: "@kbn/ui-shared-deps-src"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-shared-deps-src plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-shared-deps-src']
 ---
 import kbnUiSharedDepsSrcObj from './kbn_ui_shared_deps_src.devdocs.json';
diff --git a/api_docs/kbn_ui_theme.mdx b/api_docs/kbn_ui_theme.mdx
index 2062c1cec80bd4..17a19f4939f358 100644
--- a/api_docs/kbn_ui_theme.mdx
+++ b/api_docs/kbn_ui_theme.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-theme
 title: "@kbn/ui-theme"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/ui-theme plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-theme']
 ---
 import kbnUiThemeObj from './kbn_ui_theme.devdocs.json';
diff --git a/api_docs/kbn_user_profile_components.mdx b/api_docs/kbn_user_profile_components.mdx
index ec8b39956d5f3c..44336a7dba89fd 100644
--- a/api_docs/kbn_user_profile_components.mdx
+++ b/api_docs/kbn_user_profile_components.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-user-profile-components
 title: "@kbn/user-profile-components"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/user-profile-components plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/user-profile-components']
 ---
 import kbnUserProfileComponentsObj from './kbn_user_profile_components.devdocs.json';
diff --git a/api_docs/kbn_utility_types.mdx b/api_docs/kbn_utility_types.mdx
index 1427c0d970bf20..0b3c7a242736bc 100644
--- a/api_docs/kbn_utility_types.mdx
+++ b/api_docs/kbn_utility_types.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types
 title: "@kbn/utility-types"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types']
 ---
 import kbnUtilityTypesObj from './kbn_utility_types.devdocs.json';
diff --git a/api_docs/kbn_utility_types_jest.mdx b/api_docs/kbn_utility_types_jest.mdx
index d2240f2ca4d6bf..2fef44fc5b17fc 100644
--- a/api_docs/kbn_utility_types_jest.mdx
+++ b/api_docs/kbn_utility_types_jest.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types-jest
 title: "@kbn/utility-types-jest"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utility-types-jest plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types-jest']
 ---
 import kbnUtilityTypesJestObj from './kbn_utility_types_jest.devdocs.json';
diff --git a/api_docs/kbn_utils.mdx b/api_docs/kbn_utils.mdx
index 25cb237a4adeb7..f0570e9080b499 100644
--- a/api_docs/kbn_utils.mdx
+++ b/api_docs/kbn_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utils
 title: "@kbn/utils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/utils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utils']
 ---
 import kbnUtilsObj from './kbn_utils.devdocs.json';
diff --git a/api_docs/kbn_yarn_lock_validator.mdx b/api_docs/kbn_yarn_lock_validator.mdx
index cffb97c1d533bd..a260131c24776a 100644
--- a/api_docs/kbn_yarn_lock_validator.mdx
+++ b/api_docs/kbn_yarn_lock_validator.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-yarn-lock-validator
 title: "@kbn/yarn-lock-validator"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the @kbn/yarn-lock-validator plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/yarn-lock-validator']
 ---
 import kbnYarnLockValidatorObj from './kbn_yarn_lock_validator.devdocs.json';
diff --git a/api_docs/kibana_overview.mdx b/api_docs/kibana_overview.mdx
index 85b8bd0f9880d6..ec5441569c8d8a 100644
--- a/api_docs/kibana_overview.mdx
+++ b/api_docs/kibana_overview.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaOverview
 title: "kibanaOverview"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaOverview plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaOverview']
 ---
 import kibanaOverviewObj from './kibana_overview.devdocs.json';
diff --git a/api_docs/kibana_react.devdocs.json b/api_docs/kibana_react.devdocs.json
index 38fd13a5e66a83..9d5150e9752265 100644
--- a/api_docs/kibana_react.devdocs.json
+++ b/api_docs/kibana_react.devdocs.json
@@ -580,18 +580,6 @@
             "plugin": "home",
             "path": "src/plugins/home/public/application/components/tutorial/tutorial.js"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx"
-          },
           {
             "plugin": "canvas",
             "path": "x-pack/plugins/canvas/public/components/home/home.component.tsx"
@@ -1316,18 +1304,6 @@
             "plugin": "observability",
             "path": "x-pack/plugins/observability/public/application/index.tsx"
           },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx"
-          },
-          {
-            "plugin": "ml",
-            "path": "x-pack/plugins/ml/public/application/components/ml_page/ml_page.tsx"
-          },
           {
             "plugin": "ml",
             "path": "x-pack/plugins/ml/public/application/management/jobs_list/components/jobs_list_page/jobs_list_page.tsx"
diff --git a/api_docs/kibana_react.mdx b/api_docs/kibana_react.mdx
index 751d6620108ae9..291b5ca3202c7b 100644
--- a/api_docs/kibana_react.mdx
+++ b/api_docs/kibana_react.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaReact
 title: "kibanaReact"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaReact plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaReact']
 ---
 import kibanaReactObj from './kibana_react.devdocs.json';
diff --git a/api_docs/kibana_utils.mdx b/api_docs/kibana_utils.mdx
index 118b109e5689b1..e4801f606a949f 100644
--- a/api_docs/kibana_utils.mdx
+++ b/api_docs/kibana_utils.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaUtils
 title: "kibanaUtils"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kibanaUtils plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaUtils']
 ---
 import kibanaUtilsObj from './kibana_utils.devdocs.json';
diff --git a/api_docs/kubernetes_security.mdx b/api_docs/kubernetes_security.mdx
index 95212ed32d42af..5c623d4de19e57 100644
--- a/api_docs/kubernetes_security.mdx
+++ b/api_docs/kubernetes_security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kubernetesSecurity
 title: "kubernetesSecurity"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the kubernetesSecurity plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kubernetesSecurity']
 ---
 import kubernetesSecurityObj from './kubernetes_security.devdocs.json';
diff --git a/api_docs/lens.devdocs.json b/api_docs/lens.devdocs.json
index 2a328fffb3a3e7..222009d8f902cc 100644
--- a/api_docs/lens.devdocs.json
+++ b/api_docs/lens.devdocs.json
@@ -181,6 +181,57 @@
             ],
             "returnComment": []
           },
+          {
+            "parentPluginId": "lens",
+            "id": "def-public.Embeddable.getUserMessages",
+            "type": "Function",
+            "tags": [],
+            "label": "getUserMessages",
+            "description": [],
+            "signature": [
+              "(locationId: \"banner\" | \"toolbar\" | \"visualization\" | \"embeddableBadge\" | \"visualizationOnEmbeddable\" | \"visualizationInEditor\" | \"textBasedLanguagesQueryInput\" | \"dimensionTrigger\" | (\"banner\" | \"toolbar\" | \"visualization\" | \"embeddableBadge\" | \"visualizationOnEmbeddable\" | \"visualizationInEditor\" | \"textBasedLanguagesQueryInput\" | \"dimensionTrigger\")[] | undefined, filters: ",
+              "UserMessageFilters",
+              ") => ",
+              "UserMessage",
+              "[]"
+            ],
+            "path": "x-pack/plugins/lens/public/embeddable/embeddable.tsx",
+            "deprecated": false,
+            "trackAdoption": false,
+            "children": [
+              {
+                "parentPluginId": "lens",
+                "id": "def-public.Embeddable.getUserMessages.$1",
+                "type": "CompoundType",
+                "tags": [],
+                "label": "locationId",
+                "description": [],
+                "signature": [
+                  "\"banner\" | \"toolbar\" | \"visualization\" | \"embeddableBadge\" | \"visualizationOnEmbeddable\" | \"visualizationInEditor\" | \"textBasedLanguagesQueryInput\" | \"dimensionTrigger\" | (\"banner\" | \"toolbar\" | \"visualization\" | \"embeddableBadge\" | \"visualizationOnEmbeddable\" | \"visualizationInEditor\" | \"textBasedLanguagesQueryInput\" | \"dimensionTrigger\")[] | undefined"
+                ],
+                "path": "x-pack/plugins/lens/public/embeddable/embeddable.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": false
+              },
+              {
+                "parentPluginId": "lens",
+                "id": "def-public.Embeddable.getUserMessages.$2",
+                "type": "Object",
+                "tags": [],
+                "label": "filters",
+                "description": [],
+                "signature": [
+                  "UserMessageFilters"
+                ],
+                "path": "x-pack/plugins/lens/public/embeddable/embeddable.tsx",
+                "deprecated": false,
+                "trackAdoption": false,
+                "isRequired": true
+              }
+            ],
+            "returnComment": []
+          },
           {
             "parentPluginId": "lens",
             "id": "def-public.Embeddable.reportsEmbeddableLoad",
@@ -6394,7 +6445,7 @@
               "\nRenders dimension trigger. Used only for noDatasource layers"
             ],
             "signature": [
-              "((props: { columnId: string; label: string; hideTooltip?: boolean | undefined; invalid?: boolean | undefined; invalidMessage?: string | undefined; }) => JSX.Element | null) | undefined"
+              "((props: { columnId: string; label: string; hideTooltip?: boolean | undefined; invalid?: boolean | undefined; invalidMessage?: React.ReactNode; }) => JSX.Element | null) | undefined"
             ],
             "path": "x-pack/plugins/lens/public/types.ts",
             "deprecated": false,
@@ -6464,12 +6515,12 @@
                   {
                     "parentPluginId": "lens",
                     "id": "def-public.Visualization.renderDimensionTrigger.$1.invalidMessage",
-                    "type": "string",
+                    "type": "CompoundType",
                     "tags": [],
                     "label": "invalidMessage",
                     "description": [],
                     "signature": [
-                      "string | undefined"
+                      "boolean | React.ReactChild | React.ReactFragment | React.ReactPortal | null | undefined"
                     ],
                     "path": "x-pack/plugins/lens/public/types.ts",
                     "deprecated": false,
@@ -6794,169 +6845,19 @@
           },
           {
             "parentPluginId": "lens",
-            "id": "def-public.Visualization.getErrorMessages",
+            "id": "def-public.Visualization.getUserMessages",
             "type": "Function",
             "tags": [],
-            "label": "getErrorMessages",
+            "label": "getUserMessages",
             "description": [
               "\nThe frame will call this function on all visualizations at few stages (pre-build/build error) in order\nto provide more context to the error and show it to the user"
             ],
             "signature": [
-              "(state: T, frame?: Pick<",
-              "FramePublicAPI",
-              ", \"dataViews\" | \"datasourceLayers\"> | undefined) => { shortMessage: string; longMessage: React.ReactNode; }[] | undefined"
-            ],
-            "path": "x-pack/plugins/lens/public/types.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "lens",
-                "id": "def-public.Visualization.getErrorMessages.$1",
-                "type": "Uncategorized",
-                "tags": [],
-                "label": "state",
-                "description": [],
-                "signature": [
-                  "T"
-                ],
-                "path": "x-pack/plugins/lens/public/types.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "lens",
-                "id": "def-public.Visualization.getErrorMessages.$2",
-                "type": "Object",
-                "tags": [],
-                "label": "frame",
-                "description": [],
-                "signature": [
-                  "Pick<",
-                  "FramePublicAPI",
-                  ", \"dataViews\" | \"datasourceLayers\"> | undefined"
-                ],
-                "path": "x-pack/plugins/lens/public/types.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": false
-              }
-            ],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "lens",
-            "id": "def-public.Visualization.validateColumn",
-            "type": "Function",
-            "tags": [],
-            "label": "validateColumn",
-            "description": [],
-            "signature": [
-              "((state: T, frame: Pick<",
-              "FramePublicAPI",
-              ", \"dataViews\">, layerId: string, columnId: string, group?: ",
-              "VisualizationDimensionGroupConfig",
-              " | undefined) => { invalid: boolean; invalidMessage?: string | undefined; }) | undefined"
-            ],
-            "path": "x-pack/plugins/lens/public/types.ts",
-            "deprecated": false,
-            "trackAdoption": false,
-            "children": [
-              {
-                "parentPluginId": "lens",
-                "id": "def-public.Visualization.validateColumn.$1",
-                "type": "Uncategorized",
-                "tags": [],
-                "label": "state",
-                "description": [],
-                "signature": [
-                  "T"
-                ],
-                "path": "x-pack/plugins/lens/public/types.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "lens",
-                "id": "def-public.Visualization.validateColumn.$2",
-                "type": "Object",
-                "tags": [],
-                "label": "frame",
-                "description": [],
-                "signature": [
-                  "Pick<",
-                  "FramePublicAPI",
-                  ", \"dataViews\">"
-                ],
-                "path": "x-pack/plugins/lens/public/types.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "lens",
-                "id": "def-public.Visualization.validateColumn.$3",
-                "type": "string",
-                "tags": [],
-                "label": "layerId",
-                "description": [],
-                "signature": [
-                  "string"
-                ],
-                "path": "x-pack/plugins/lens/public/types.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "lens",
-                "id": "def-public.Visualization.validateColumn.$4",
-                "type": "string",
-                "tags": [],
-                "label": "columnId",
-                "description": [],
-                "signature": [
-                  "string"
-                ],
-                "path": "x-pack/plugins/lens/public/types.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": true
-              },
-              {
-                "parentPluginId": "lens",
-                "id": "def-public.Visualization.validateColumn.$5",
-                "type": "CompoundType",
-                "tags": [],
-                "label": "group",
-                "description": [],
-                "signature": [
-                  "VisualizationDimensionGroupConfig",
-                  " | undefined"
-                ],
-                "path": "x-pack/plugins/lens/public/types.ts",
-                "deprecated": false,
-                "trackAdoption": false,
-                "isRequired": false
-              }
-            ],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "lens",
-            "id": "def-public.Visualization.getWarningMessages",
-            "type": "Function",
-            "tags": [],
-            "label": "getWarningMessages",
-            "description": [
-              "\nThe frame calls this function to display warnings about visualization"
-            ],
-            "signature": [
-              "((state: T, frame: ",
+              "((state: T, deps: { frame: ",
               "FramePublicAPI",
-              ") => React.ReactNode[] | undefined) | undefined"
+              "; }) => ",
+              "UserMessage",
+              "[]) | undefined"
             ],
             "path": "x-pack/plugins/lens/public/types.ts",
             "deprecated": false,
@@ -6964,7 +6865,7 @@
             "children": [
               {
                 "parentPluginId": "lens",
-                "id": "def-public.Visualization.getWarningMessages.$1",
+                "id": "def-public.Visualization.getUserMessages.$1",
                 "type": "Uncategorized",
                 "tags": [],
                 "label": "state",
@@ -6979,18 +6880,30 @@
               },
               {
                 "parentPluginId": "lens",
-                "id": "def-public.Visualization.getWarningMessages.$2",
+                "id": "def-public.Visualization.getUserMessages.$2",
                 "type": "Object",
                 "tags": [],
-                "label": "frame",
+                "label": "deps",
                 "description": [],
-                "signature": [
-                  "FramePublicAPI"
-                ],
                 "path": "x-pack/plugins/lens/public/types.ts",
                 "deprecated": false,
                 "trackAdoption": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "lens",
+                    "id": "def-public.Visualization.getUserMessages.$2.frame",
+                    "type": "Object",
+                    "tags": [],
+                    "label": "frame",
+                    "description": [],
+                    "signature": [
+                      "FramePublicAPI"
+                    ],
+                    "path": "x-pack/plugins/lens/public/types.ts",
+                    "deprecated": false,
+                    "trackAdoption": false
+                  }
+                ]
               }
             ],
             "returnComment": []
diff --git a/api_docs/lens.mdx b/api_docs/lens.mdx
index dea24ab0fa93b6..91643daa835ca3 100644
--- a/api_docs/lens.mdx
+++ b/api_docs/lens.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lens
 title: "lens"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lens plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lens']
 ---
 import lensObj from './lens.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualization
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 698 | 0 | 602 | 50 |
+| 693 | 0 | 598 | 52 |
 
 ## Client
 
diff --git a/api_docs/license_api_guard.mdx b/api_docs/license_api_guard.mdx
index 54678407a88b3e..ef480ba5f92873 100644
--- a/api_docs/license_api_guard.mdx
+++ b/api_docs/license_api_guard.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseApiGuard
 title: "licenseApiGuard"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseApiGuard plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseApiGuard']
 ---
 import licenseApiGuardObj from './license_api_guard.devdocs.json';
diff --git a/api_docs/license_management.mdx b/api_docs/license_management.mdx
index 7a327d7e8cd80b..8ca729ecbd008a 100644
--- a/api_docs/license_management.mdx
+++ b/api_docs/license_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseManagement
 title: "licenseManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licenseManagement plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseManagement']
 ---
 import licenseManagementObj from './license_management.devdocs.json';
diff --git a/api_docs/licensing.mdx b/api_docs/licensing.mdx
index 50959f01886764..35357f5f36bd29 100644
--- a/api_docs/licensing.mdx
+++ b/api_docs/licensing.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licensing
 title: "licensing"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the licensing plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licensing']
 ---
 import licensingObj from './licensing.devdocs.json';
diff --git a/api_docs/lists.mdx b/api_docs/lists.mdx
index 3bf51da3689eb9..c22bfac5d3dde9 100644
--- a/api_docs/lists.mdx
+++ b/api_docs/lists.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lists
 title: "lists"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the lists plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lists']
 ---
 import listsObj from './lists.devdocs.json';
diff --git a/api_docs/management.mdx b/api_docs/management.mdx
index 3843f133a7c0b3..9c49a4bacd7c2f 100644
--- a/api_docs/management.mdx
+++ b/api_docs/management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/management
 title: "management"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the management plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'management']
 ---
 import managementObj from './management.devdocs.json';
diff --git a/api_docs/maps.mdx b/api_docs/maps.mdx
index 308a442d84406f..32a3531008d025 100644
--- a/api_docs/maps.mdx
+++ b/api_docs/maps.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/maps
 title: "maps"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the maps plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'maps']
 ---
 import mapsObj from './maps.devdocs.json';
diff --git a/api_docs/maps_ems.mdx b/api_docs/maps_ems.mdx
index df2378722a4fd0..6d42c9f0a0fdc2 100644
--- a/api_docs/maps_ems.mdx
+++ b/api_docs/maps_ems.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/mapsEms
 title: "mapsEms"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the mapsEms plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'mapsEms']
 ---
 import mapsEmsObj from './maps_ems.devdocs.json';
diff --git a/api_docs/ml.mdx b/api_docs/ml.mdx
index b862c56eda85cb..e9fff64a18949f 100644
--- a/api_docs/ml.mdx
+++ b/api_docs/ml.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ml
 title: "ml"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ml plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ml']
 ---
 import mlObj from './ml.devdocs.json';
diff --git a/api_docs/monitoring.mdx b/api_docs/monitoring.mdx
index 7037c88bc93f18..1496a072adbd7b 100644
--- a/api_docs/monitoring.mdx
+++ b/api_docs/monitoring.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoring
 title: "monitoring"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoring plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoring']
 ---
 import monitoringObj from './monitoring.devdocs.json';
diff --git a/api_docs/monitoring_collection.mdx b/api_docs/monitoring_collection.mdx
index 9759dd3c2cf73a..15be10b40cc443 100644
--- a/api_docs/monitoring_collection.mdx
+++ b/api_docs/monitoring_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoringCollection
 title: "monitoringCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the monitoringCollection plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoringCollection']
 ---
 import monitoringCollectionObj from './monitoring_collection.devdocs.json';
diff --git a/api_docs/navigation.mdx b/api_docs/navigation.mdx
index d0595e73e6ae16..7637ab1a93ad6a 100644
--- a/api_docs/navigation.mdx
+++ b/api_docs/navigation.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/navigation
 title: "navigation"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the navigation plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'navigation']
 ---
 import navigationObj from './navigation.devdocs.json';
diff --git a/api_docs/newsfeed.mdx b/api_docs/newsfeed.mdx
index 65ae4a25bb31fd..22e51d34dcff15 100644
--- a/api_docs/newsfeed.mdx
+++ b/api_docs/newsfeed.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/newsfeed
 title: "newsfeed"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the newsfeed plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'newsfeed']
 ---
 import newsfeedObj from './newsfeed.devdocs.json';
diff --git a/api_docs/notifications.mdx b/api_docs/notifications.mdx
index b340b24159c7e9..ecd955659daac1 100644
--- a/api_docs/notifications.mdx
+++ b/api_docs/notifications.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/notifications
 title: "notifications"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the notifications plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'notifications']
 ---
 import notificationsObj from './notifications.devdocs.json';
diff --git a/api_docs/observability.mdx b/api_docs/observability.mdx
index 8d3b351cc81d92..1100bdcab6fdb2 100644
--- a/api_docs/observability.mdx
+++ b/api_docs/observability.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observability
 title: "observability"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the observability plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observability']
 ---
 import observabilityObj from './observability.devdocs.json';
diff --git a/api_docs/osquery.mdx b/api_docs/osquery.mdx
index b8b65538131011..2ae28294b8cda3 100644
--- a/api_docs/osquery.mdx
+++ b/api_docs/osquery.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/osquery
 title: "osquery"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the osquery plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'osquery']
 ---
 import osqueryObj from './osquery.devdocs.json';
diff --git a/api_docs/plugin_directory.mdx b/api_docs/plugin_directory.mdx
index 52b572450a0e00..b2886a71063e7f 100644
--- a/api_docs/plugin_directory.mdx
+++ b/api_docs/plugin_directory.mdx
@@ -7,7 +7,7 @@ id: kibDevDocsPluginDirectory
 slug: /kibana-dev-docs/api-meta/plugin-api-directory
 title: Directory
 description: Directory of public APIs available through plugins or packages.
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana']
 ---
 
@@ -15,22 +15,22 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 
 | Count | Plugins or Packages with a <br /> public API | Number of teams |
 |--------------|----------|------------------------|
-| 561 | 463 | 42 |
+| 562 | 464 | 42 |
 
 ### Public API health stats
 
 | API Count | Any Count | Missing comments | Missing exports |
 |--------------|----------|-----------------|--------|
-| 34429 | 526 | 24089 | 1200 |
+| 34879 | 527 | 24525 | 1244 |
 
 ## Plugin Directory
 
 | Plugin name &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  | Maintaining team | Description | API Cnt | Any Cnt | Missing<br />comments | Missing<br />exports |
 |--------------|----------------|-----------|--------------|----------|---------------|--------|
-| <DocLink id="kibActionsPluginApi" text="actions"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 220 | 8 | 215 | 24 |
+| <DocLink id="kibActionsPluginApi" text="actions"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 256 | 8 | 251 | 24 |
 | <DocLink id="kibAdvancedSettingsPluginApi" text="advancedSettings"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 36 | 1 | 32 | 2 |
 | <DocLink id="kibAiopsPluginApi" text="aiops"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | AIOps plugin maintained by ML team. | 12 | 0 | 1 | 2 |
-| <DocLink id="kibAlertingPluginApi" text="alerting"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 465 | 0 | 456 | 38 |
+| <DocLink id="kibAlertingPluginApi" text="alerting"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 467 | 0 | 457 | 39 |
 | <DocLink id="kibApmPluginApi" text="apm"/> | [APM UI](https://github.com/orgs/elastic/teams/apm-ui) | The user interface for Elastic APM | 42 | 0 | 42 | 61 |
 | <DocLink id="kibBannersPluginApi" text="banners"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 9 | 0 | 9 | 0 |
 | <DocLink id="kibBfetchPluginApi" text="bfetch"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Considering using bfetch capabilities when fetching large amounts of data. This services supports batching HTTP requests and streaming responses back. | 89 | 1 | 74 | 2 |
@@ -48,11 +48,11 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibCloudSecurityPosturePluginApi" text="cloudSecurityPosture"/> | [Cloud Security Posture](https://github.com/orgs/elastic/teams/cloud-posture-security) | The cloud security posture plugin | 17 | 0 | 2 | 2 |
 | <DocLink id="kibConsolePluginApi" text="console"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 13 | 0 | 13 | 1 |
 | <DocLink id="kibControlsPluginApi" text="controls"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Controls Plugin contains embeddable components intended to create a simple query interface for end users, and a powerful editing suite that allows dashboard authors to build controls | 264 | 0 | 260 | 9 |
-| <DocLink id="kibCorePluginApi" text="core"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 2806 | 17 | 1017 | 0 |
+| <DocLink id="kibCorePluginApi" text="core"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 2810 | 17 | 1018 | 0 |
 | crossClusterReplication | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
 | customBranding | [global-experience](https://github.com/orgs/elastic/teams/kibana-global-experience) |  Enables customization of Kibana | 0 | 0 | 0 | 0 |
 | <DocLink id="kibCustomIntegrationsPluginApi" text="customIntegrations"/> | [Fleet](https://github.com/orgs/elastic/teams/fleet) | Add custom data integrations so they can be displayed in the Fleet integrations app | 107 | 0 | 88 | 1 |
-| <DocLink id="kibDashboardPluginApi" text="dashboard"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds the Dashboard app to Kibana | 113 | 0 | 109 | 2 |
+| <DocLink id="kibDashboardPluginApi" text="dashboard"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds the Dashboard app to Kibana | 171 | 0 | 163 | 10 |
 | <DocLink id="kibDashboardEnhancedPluginApi" text="dashboardEnhanced"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 54 | 0 | 51 | 0 |
 | <DocLink id="kibDataPluginApi" text="data"/> | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Data services are useful for searching and querying data from Elasticsearch. Helpful utilities include: a re-usable react query bar, KQL autocomplete, async search, Data Views (Index Patterns) and field formatters. | 3276 | 119 | 2578 | 27 |
 | <DocLink id="kibDataViewEditorPluginApi" text="dataViewEditor"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | This plugin provides the ability to create data views via a modal flyout inside Kibana apps | 16 | 0 | 7 | 0 |
@@ -69,7 +69,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibEnterpriseSearchPluginApi" text="enterpriseSearch"/> | [Enterprise Search](https://github.com/orgs/elastic/teams/enterprise-search-frontend) | Adds dashboards for discovering and managing Enterprise Search products. | 9 | 0 | 9 | 0 |
 | <DocLink id="kibEsUiSharedPluginApi" text="esUiShared"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 114 | 3 | 110 | 5 |
 | <DocLink id="kibEventAnnotationPluginApi" text="eventAnnotation"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | The Event Annotation service contains expressions for event annotations | 172 | 30 | 172 | 3 |
-| <DocLink id="kibEventLogPluginApi" text="eventLog"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 115 | 0 | 115 | 11 |
+| <DocLink id="kibEventLogPluginApi" text="eventLog"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 116 | 0 | 116 | 11 |
 | <DocLink id="kibExpressionErrorPluginApi" text="expressionError"/> | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds 'error' renderer to expressions | 17 | 0 | 15 | 2 |
 | <DocLink id="kibExpressionGaugePluginApi" text="expressionGauge"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | Expression Gauge plugin adds a `gauge` renderer and function to the expression plugin. The renderer will display the `gauge` chart. | 58 | 0 | 58 | 2 |
 | <DocLink id="kibExpressionHeatmapPluginApi" text="expressionHeatmap"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | Expression Heatmap plugin adds a `heatmap` renderer and function to the expression plugin. The renderer will display the `heatmap` chart. | 111 | 14 | 107 | 2 |
@@ -89,7 +89,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibFileUploadPluginApi" text="fileUpload"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | The file upload plugin contains components and services for uploading a file, analyzing its data, and then importing the data into an Elasticsearch index. Supported file types include CSV, TSV, newline-delimited JSON and GeoJSON. | 62 | 0 | 62 | 2 |
 | <DocLink id="kibFilesPluginApi" text="files"/> | [@elastic/kibana-app-services](https://github.com/orgs/elastic/teams/team:AppServicesUx) | File upload, download, sharing, and serving over HTTP implementation in Kibana. | 254 | 1 | 45 | 5 |
 | <DocLink id="kibFilesManagementPluginApi" text="filesManagement"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/@elastic/appex-sharedux) | Simple UI for managing files in Kibana | 2 | 1 | 2 | 0 |
-| <DocLink id="kibFleetPluginApi" text="fleet"/> | [Fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1039 | 3 | 934 | 24 |
+| <DocLink id="kibFleetPluginApi" text="fleet"/> | [Fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1040 | 3 | 935 | 25 |
 | <DocLink id="kibGlobalSearchPluginApi" text="globalSearch"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 68 | 0 | 14 | 5 |
 | globalSearchBar | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 |
 | globalSearchProviders | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 |
@@ -100,7 +100,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibImageEmbeddablePluginApi" text="imageEmbeddable"/> | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/@elastic/appex-sharedux) | Image embeddable | 3 | 0 | 3 | 1 |
 | <DocLink id="kibIndexLifecycleManagementPluginApi" text="indexLifecycleManagement"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 4 | 0 | 4 | 0 |
 | <DocLink id="kibIndexManagementPluginApi" text="indexManagement"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 177 | 0 | 172 | 3 |
-| <DocLink id="kibInfraPluginApi" text="infra"/> | [Logs and Metrics UI](https://github.com/orgs/elastic/teams/logs-metrics-ui) | This plugin visualizes data from Filebeat and Metricbeat, and integrates with other Observability solutions | 42 | 0 | 39 | 8 |
+| <DocLink id="kibInfraPluginApi" text="infra"/> | [Logs and Metrics UI](https://github.com/orgs/elastic/teams/logs-metrics-ui) | This plugin visualizes data from Filebeat and Metricbeat, and integrates with other Observability solutions | 43 | 0 | 40 | 9 |
 | ingestPipelines | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 |
 | inputControlVis | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds Input Control visualization to Kibana | 0 | 0 | 0 | 0 |
 | <DocLink id="kibInspectorPluginApi" text="inspector"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 123 | 2 | 96 | 4 |
@@ -110,7 +110,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | kibanaUsageCollection | [Kibana Telemetry](https://github.com/orgs/elastic/teams/kibana-telemetry) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibKibanaUtilsPluginApi" text="kibanaUtils"/> | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | - | 609 | 3 | 416 | 9 |
 | <DocLink id="kibKubernetesSecurityPluginApi" text="kubernetesSecurity"/> | [Security Team](https://github.com/orgs/elastic/teams/security-team) | - | 3 | 0 | 3 | 1 |
-| <DocLink id="kibLensPluginApi" text="lens"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | Visualization editor allowing to quickly and easily configure compelling visualizations to use on dashboards and canvas workpads. Exposes components to embed visualizations and link into the Lens editor from within other apps in Kibana. | 698 | 0 | 602 | 50 |
+| <DocLink id="kibLensPluginApi" text="lens"/> | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | Visualization editor allowing to quickly and easily configure compelling visualizations to use on dashboards and canvas workpads. Exposes components to embed visualizations and link into the Lens editor from within other apps in Kibana. | 693 | 0 | 598 | 52 |
 | <DocLink id="kibLicenseApiGuardPluginApi" text="licenseApiGuard"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 8 | 0 | 8 | 0 |
 | <DocLink id="kibLicenseManagementPluginApi" text="licenseManagement"/> | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 3 | 0 | 3 | 0 |
 | <DocLink id="kibLicensingPluginApi" text="licensing"/> | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 117 | 0 | 42 | 10 |
@@ -159,7 +159,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibTelemetryCollectionXpackPluginApi" text="telemetryCollectionXpack"/> | [Kibana Telemetry](https://github.com/orgs/elastic/teams/kibana-telemetry) | - | 1 | 0 | 1 | 0 |
 | <DocLink id="kibTelemetryManagementSectionPluginApi" text="telemetryManagementSection"/> | [Kibana Telemetry](https://github.com/orgs/elastic/teams/kibana-telemetry) | - | 5 | 0 | 0 | 0 |
 | <DocLink id="kibThreatIntelligencePluginApi" text="threatIntelligence"/> | [Protections Experience Team](https://github.com/orgs/elastic/teams/protections-experience) | Elastic threat intelligence helps you see if you are open to or have been subject to current or historical known threats | 35 | 0 | 15 | 5 |
-| <DocLink id="kibTimelinesPluginApi" text="timelines"/> | [Security solution](https://github.com/orgs/elastic/teams/security-solution) | - | 257 | 1 | 214 | 21 |
+| <DocLink id="kibTimelinesPluginApi" text="timelines"/> | [Security solution](https://github.com/orgs/elastic/teams/security-solution) | - | 257 | 1 | 214 | 20 |
 | <DocLink id="kibTransformPluginApi" text="transform"/> | [Machine Learning UI](https://github.com/orgs/elastic/teams/ml-ui) | This plugin provides access to the transforms features provided by Elastic. Transforms enable you to convert existing Elasticsearch indices into summarized indices, which provide opportunities for new insights and analytics. | 4 | 0 | 4 | 1 |
 | translations | [Kibana Localization](https://github.com/orgs/elastic/teams/kibana-localization) | - | 0 | 0 | 0 | 0 |
 | <DocLink id="kibTriggersActionsUiPluginApi" text="triggersActionsUi"/> | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 586 | 11 | 557 | 53 |
@@ -350,7 +350,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnCoreSavedObjectsImportExportServerMocksPluginApi" text="@kbn/core-saved-objects-import-export-server-mocks"/> | Kibana Core | - | 4 | 0 | 4 | 0 |
 | <DocLink id="kibKbnCoreSavedObjectsMigrationServerInternalPluginApi" text="@kbn/core-saved-objects-migration-server-internal"/> | Kibana Core | - | 112 | 0 | 79 | 45 |
 | <DocLink id="kibKbnCoreSavedObjectsMigrationServerMocksPluginApi" text="@kbn/core-saved-objects-migration-server-mocks"/> | Kibana Core | - | 12 | 0 | 12 | 0 |
-| <DocLink id="kibKbnCoreSavedObjectsServerPluginApi" text="@kbn/core-saved-objects-server"/> | Kibana Core | - | 325 | 0 | 95 | 1 |
+| <DocLink id="kibKbnCoreSavedObjectsServerPluginApi" text="@kbn/core-saved-objects-server"/> | Kibana Core | - | 329 | 0 | 96 | 1 |
 | <DocLink id="kibKbnCoreSavedObjectsServerInternalPluginApi" text="@kbn/core-saved-objects-server-internal"/> | Kibana Core | - | 69 | 0 | 69 | 4 |
 | <DocLink id="kibKbnCoreSavedObjectsServerMocksPluginApi" text="@kbn/core-saved-objects-server-mocks"/> | Kibana Core | - | 14 | 0 | 14 | 0 |
 | <DocLink id="kibKbnCoreSavedObjectsUtilsServerPluginApi" text="@kbn/core-saved-objects-utils-server"/> | Kibana Core | - | 108 | 1 | 84 | 0 |
@@ -363,7 +363,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnCoreTestHelpersHttpSetupBrowserPluginApi" text="@kbn/core-test-helpers-http-setup-browser"/> | Kibana Core | - | 5 | 0 | 5 | 0 |
 | <DocLink id="kibKbnCoreTestHelpersKbnServerPluginApi" text="@kbn/core-test-helpers-kbn-server"/> | Kibana Core | - | 54 | 1 | 48 | 0 |
 | <DocLink id="kibKbnCoreTestHelpersSoTypeSerializerPluginApi" text="@kbn/core-test-helpers-so-type-serializer"/> | Kibana Core | - | 13 | 0 | 12 | 0 |
-| <DocLink id="kibKbnCoreTestHelpersTestUtilsPluginApi" text="@kbn/core-test-helpers-test-utils"/> | [Owner missing] | - | 4 | 0 | 4 | 0 |
+| <DocLink id="kibKbnCoreTestHelpersTestUtilsPluginApi" text="@kbn/core-test-helpers-test-utils"/> | [Owner missing] | - | 9 | 0 | 9 | 0 |
 | <DocLink id="kibKbnCoreThemeBrowserPluginApi" text="@kbn/core-theme-browser"/> | Kibana Core | - | 6 | 0 | 4 | 0 |
 | <DocLink id="kibKbnCoreThemeBrowserInternalPluginApi" text="@kbn/core-theme-browser-internal"/> | Kibana Core | - | 2 | 0 | 1 | 0 |
 | <DocLink id="kibKbnCoreThemeBrowserMocksPluginApi" text="@kbn/core-theme-browser-mocks"/> | Kibana Core | - | 6 | 0 | 6 | 0 |
@@ -442,8 +442,9 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana']
 | <DocLink id="kibKbnRepoPathPluginApi" text="@kbn/repo-path"/> | [Owner missing] | - | 13 | 0 | 9 | 0 |
 | <DocLink id="kibKbnRepoSourceClassifierPluginApi" text="@kbn/repo-source-classifier"/> | [Owner missing] | - | 6 | 0 | 6 | 1 |
 | <DocLink id="kibKbnRisonPluginApi" text="@kbn/rison"/> | [Owner missing] | - | 13 | 2 | 8 | 0 |
-| <DocLink id="kibKbnRuleDataUtilsPluginApi" text="@kbn/rule-data-utils"/> | [Owner missing] | - | 97 | 0 | 94 | 0 |
+| <DocLink id="kibKbnRuleDataUtilsPluginApi" text="@kbn/rule-data-utils"/> | [Owner missing] | - | 99 | 0 | 96 | 0 |
 | <DocLink id="kibKbnSecuritysolutionAutocompletePluginApi" text="@kbn/securitysolution-autocomplete"/> | [Owner missing] | Security Solution auto complete | 56 | 1 | 41 | 1 |
+| <DocLink id="kibKbnSecuritysolutionEcsPluginApi" text="@kbn/securitysolution-ecs"/> | [Owner missing] | - | 341 | 1 | 337 | 32 |
 | <DocLink id="kibKbnSecuritysolutionEsUtilsPluginApi" text="@kbn/securitysolution-es-utils"/> | [Owner missing] | security solution elastic search utilities to use across plugins such lists, security_solution, cases, etc... | 67 | 0 | 61 | 1 |
 | <DocLink id="kibKbnSecuritysolutionExceptionListComponentsPluginApi" text="@kbn/securitysolution-exception-list-components"/> | [Owner missing] | - | 104 | 0 | 93 | 1 |
 | <DocLink id="kibKbnSecuritysolutionHookUtilsPluginApi" text="@kbn/securitysolution-hook-utils"/> | [Owner missing] | Security Solution utilities for React hooks | 15 | 0 | 7 | 0 |
diff --git a/api_docs/presentation_util.mdx b/api_docs/presentation_util.mdx
index 26e7e1c57f347a..4a667dbf1b54d9 100644
--- a/api_docs/presentation_util.mdx
+++ b/api_docs/presentation_util.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/presentationUtil
 title: "presentationUtil"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the presentationUtil plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'presentationUtil']
 ---
 import presentationUtilObj from './presentation_util.devdocs.json';
diff --git a/api_docs/profiling.mdx b/api_docs/profiling.mdx
index 90201aa39ea324..f437955259942b 100644
--- a/api_docs/profiling.mdx
+++ b/api_docs/profiling.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/profiling
 title: "profiling"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the profiling plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'profiling']
 ---
 import profilingObj from './profiling.devdocs.json';
diff --git a/api_docs/remote_clusters.mdx b/api_docs/remote_clusters.mdx
index a6124e49fcec0f..ae3edb3cae30fe 100644
--- a/api_docs/remote_clusters.mdx
+++ b/api_docs/remote_clusters.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/remoteClusters
 title: "remoteClusters"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the remoteClusters plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'remoteClusters']
 ---
 import remoteClustersObj from './remote_clusters.devdocs.json';
diff --git a/api_docs/reporting.mdx b/api_docs/reporting.mdx
index 6816029fa71245..15328235b2ffdd 100644
--- a/api_docs/reporting.mdx
+++ b/api_docs/reporting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/reporting
 title: "reporting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the reporting plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'reporting']
 ---
 import reportingObj from './reporting.devdocs.json';
diff --git a/api_docs/rollup.mdx b/api_docs/rollup.mdx
index 4a0fe211a68841..bb4cd64052838e 100644
--- a/api_docs/rollup.mdx
+++ b/api_docs/rollup.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/rollup
 title: "rollup"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the rollup plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'rollup']
 ---
 import rollupObj from './rollup.devdocs.json';
diff --git a/api_docs/rule_registry.devdocs.json b/api_docs/rule_registry.devdocs.json
index cc9725bb52f3d3..7ccd61d57cad55 100644
--- a/api_docs/rule_registry.devdocs.json
+++ b/api_docs/rule_registry.devdocs.json
@@ -1803,7 +1803,9 @@
           },
           ") => Promise<{ new: { count: number; data: {}[]; }; ongoing: { count: number; data: {}[]; }; recovered: { count: number; data: {}[]; }; }>; name: string; validate?: { params?: ",
           "RuleTypeParamsValidator",
-          "<TParams> | undefined; } | undefined; id: string; cancelAlertsOnRuleTimeout?: boolean | undefined; actionGroups: ",
+          "<TParams> | undefined; } | undefined; id: string; cancelAlertsOnRuleTimeout?: boolean | undefined; alerts?: ",
+          "IRuleTypeAlerts",
+          " | undefined; actionGroups: ",
           {
             "pluginId": "alerting",
             "scope": "common",
@@ -1859,7 +1861,7 @@
             "section": "def-common.SavedObjectReference",
             "text": "SavedObjectReference"
           },
-          "[]) => TParams; } | undefined; isExportable: boolean; defaultScheduleInterval?: string | undefined; ruleTaskTimeout?: string | undefined; doesSetRecoveryContext?: boolean | undefined; }"
+          "[]) => TParams; } | undefined; isExportable: boolean; defaultScheduleInterval?: string | undefined; ruleTaskTimeout?: string | undefined; doesSetRecoveryContext?: boolean | undefined; autoRecoverAlerts?: boolean | undefined; }"
         ],
         "path": "x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_wrapper.ts",
         "deprecated": false,
diff --git a/api_docs/rule_registry.mdx b/api_docs/rule_registry.mdx
index cd5bb058babca7..dc7f15d44c7be5 100644
--- a/api_docs/rule_registry.mdx
+++ b/api_docs/rule_registry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ruleRegistry
 title: "ruleRegistry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ruleRegistry plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ruleRegistry']
 ---
 import ruleRegistryObj from './rule_registry.devdocs.json';
diff --git a/api_docs/runtime_fields.mdx b/api_docs/runtime_fields.mdx
index 9e4c1c5da5b864..5e7496106952dc 100644
--- a/api_docs/runtime_fields.mdx
+++ b/api_docs/runtime_fields.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/runtimeFields
 title: "runtimeFields"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the runtimeFields plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'runtimeFields']
 ---
 import runtimeFieldsObj from './runtime_fields.devdocs.json';
diff --git a/api_docs/saved_objects.mdx b/api_docs/saved_objects.mdx
index e51aa85cd0f3ef..4773de4ce7489f 100644
--- a/api_docs/saved_objects.mdx
+++ b/api_docs/saved_objects.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjects
 title: "savedObjects"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjects plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjects']
 ---
 import savedObjectsObj from './saved_objects.devdocs.json';
diff --git a/api_docs/saved_objects_finder.mdx b/api_docs/saved_objects_finder.mdx
index c187fc74f315e0..a208b590d5b5f3 100644
--- a/api_docs/saved_objects_finder.mdx
+++ b/api_docs/saved_objects_finder.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsFinder
 title: "savedObjectsFinder"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsFinder plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsFinder']
 ---
 import savedObjectsFinderObj from './saved_objects_finder.devdocs.json';
diff --git a/api_docs/saved_objects_management.mdx b/api_docs/saved_objects_management.mdx
index f181460eda726f..c2d4542264eced 100644
--- a/api_docs/saved_objects_management.mdx
+++ b/api_docs/saved_objects_management.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsManagement
 title: "savedObjectsManagement"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsManagement plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsManagement']
 ---
 import savedObjectsManagementObj from './saved_objects_management.devdocs.json';
diff --git a/api_docs/saved_objects_tagging.mdx b/api_docs/saved_objects_tagging.mdx
index 893fbb88ed64f7..6d87e255e34ae8 100644
--- a/api_docs/saved_objects_tagging.mdx
+++ b/api_docs/saved_objects_tagging.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTagging
 title: "savedObjectsTagging"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTagging plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTagging']
 ---
 import savedObjectsTaggingObj from './saved_objects_tagging.devdocs.json';
diff --git a/api_docs/saved_objects_tagging_oss.mdx b/api_docs/saved_objects_tagging_oss.mdx
index 86d1e07bdf8ca1..db3a99f65f89fe 100644
--- a/api_docs/saved_objects_tagging_oss.mdx
+++ b/api_docs/saved_objects_tagging_oss.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTaggingOss
 title: "savedObjectsTaggingOss"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedObjectsTaggingOss plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTaggingOss']
 ---
 import savedObjectsTaggingOssObj from './saved_objects_tagging_oss.devdocs.json';
diff --git a/api_docs/saved_search.mdx b/api_docs/saved_search.mdx
index 48c1a4fc3605c9..199899b2a42d2b 100644
--- a/api_docs/saved_search.mdx
+++ b/api_docs/saved_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedSearch
 title: "savedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the savedSearch plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedSearch']
 ---
 import savedSearchObj from './saved_search.devdocs.json';
diff --git a/api_docs/screenshot_mode.mdx b/api_docs/screenshot_mode.mdx
index 9b1d4ee4f94d28..afb40e68ed0a4d 100644
--- a/api_docs/screenshot_mode.mdx
+++ b/api_docs/screenshot_mode.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotMode
 title: "screenshotMode"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotMode plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotMode']
 ---
 import screenshotModeObj from './screenshot_mode.devdocs.json';
diff --git a/api_docs/screenshotting.mdx b/api_docs/screenshotting.mdx
index 8646d20df3da29..7a4f77ad57fa06 100644
--- a/api_docs/screenshotting.mdx
+++ b/api_docs/screenshotting.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotting
 title: "screenshotting"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the screenshotting plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotting']
 ---
 import screenshottingObj from './screenshotting.devdocs.json';
diff --git a/api_docs/security.mdx b/api_docs/security.mdx
index 34a52cb1cce444..b2110708e7adb0 100644
--- a/api_docs/security.mdx
+++ b/api_docs/security.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/security
 title: "security"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the security plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'security']
 ---
 import securityObj from './security.devdocs.json';
diff --git a/api_docs/security_solution.mdx b/api_docs/security_solution.mdx
index 467e61b1e17035..1f4d03c54951ba 100644
--- a/api_docs/security_solution.mdx
+++ b/api_docs/security_solution.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolution
 title: "securitySolution"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the securitySolution plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolution']
 ---
 import securitySolutionObj from './security_solution.devdocs.json';
diff --git a/api_docs/session_view.mdx b/api_docs/session_view.mdx
index 6f2a5232ed0008..c373e4ac895fd2 100644
--- a/api_docs/session_view.mdx
+++ b/api_docs/session_view.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/sessionView
 title: "sessionView"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the sessionView plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'sessionView']
 ---
 import sessionViewObj from './session_view.devdocs.json';
diff --git a/api_docs/share.mdx b/api_docs/share.mdx
index 789b2d6053949b..eb765b8abb7d08 100644
--- a/api_docs/share.mdx
+++ b/api_docs/share.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/share
 title: "share"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the share plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'share']
 ---
 import shareObj from './share.devdocs.json';
diff --git a/api_docs/snapshot_restore.mdx b/api_docs/snapshot_restore.mdx
index 9e0d060b3751c2..6a4bec58b36bbe 100644
--- a/api_docs/snapshot_restore.mdx
+++ b/api_docs/snapshot_restore.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/snapshotRestore
 title: "snapshotRestore"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the snapshotRestore plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'snapshotRestore']
 ---
 import snapshotRestoreObj from './snapshot_restore.devdocs.json';
diff --git a/api_docs/spaces.mdx b/api_docs/spaces.mdx
index 3a2e632b21f528..e2196c70e2a056 100644
--- a/api_docs/spaces.mdx
+++ b/api_docs/spaces.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/spaces
 title: "spaces"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the spaces plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'spaces']
 ---
 import spacesObj from './spaces.devdocs.json';
diff --git a/api_docs/stack_alerts.mdx b/api_docs/stack_alerts.mdx
index 65ccf5447dc68c..6bb32b0389695e 100644
--- a/api_docs/stack_alerts.mdx
+++ b/api_docs/stack_alerts.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackAlerts
 title: "stackAlerts"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackAlerts plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackAlerts']
 ---
 import stackAlertsObj from './stack_alerts.devdocs.json';
diff --git a/api_docs/stack_connectors.mdx b/api_docs/stack_connectors.mdx
index 1a4818419f4028..c9b5c7b67b4d39 100644
--- a/api_docs/stack_connectors.mdx
+++ b/api_docs/stack_connectors.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackConnectors
 title: "stackConnectors"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the stackConnectors plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackConnectors']
 ---
 import stackConnectorsObj from './stack_connectors.devdocs.json';
diff --git a/api_docs/task_manager.mdx b/api_docs/task_manager.mdx
index bebc8d16ce6346..6c7b69bc663992 100644
--- a/api_docs/task_manager.mdx
+++ b/api_docs/task_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/taskManager
 title: "taskManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the taskManager plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'taskManager']
 ---
 import taskManagerObj from './task_manager.devdocs.json';
diff --git a/api_docs/telemetry.mdx b/api_docs/telemetry.mdx
index 9819227f037167..34a58c9c6dfa6e 100644
--- a/api_docs/telemetry.mdx
+++ b/api_docs/telemetry.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetry
 title: "telemetry"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetry plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetry']
 ---
 import telemetryObj from './telemetry.devdocs.json';
diff --git a/api_docs/telemetry_collection_manager.mdx b/api_docs/telemetry_collection_manager.mdx
index 7cdcf1aeb4e4f3..ddac6ac33dfa4a 100644
--- a/api_docs/telemetry_collection_manager.mdx
+++ b/api_docs/telemetry_collection_manager.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionManager
 title: "telemetryCollectionManager"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionManager plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionManager']
 ---
 import telemetryCollectionManagerObj from './telemetry_collection_manager.devdocs.json';
diff --git a/api_docs/telemetry_collection_xpack.mdx b/api_docs/telemetry_collection_xpack.mdx
index 03f3319a24a21a..4d1e3231f88c9a 100644
--- a/api_docs/telemetry_collection_xpack.mdx
+++ b/api_docs/telemetry_collection_xpack.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionXpack
 title: "telemetryCollectionXpack"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryCollectionXpack plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionXpack']
 ---
 import telemetryCollectionXpackObj from './telemetry_collection_xpack.devdocs.json';
diff --git a/api_docs/telemetry_management_section.mdx b/api_docs/telemetry_management_section.mdx
index 9177ef6b274d49..147d3edc5794e5 100644
--- a/api_docs/telemetry_management_section.mdx
+++ b/api_docs/telemetry_management_section.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryManagementSection
 title: "telemetryManagementSection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the telemetryManagementSection plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryManagementSection']
 ---
 import telemetryManagementSectionObj from './telemetry_management_section.devdocs.json';
diff --git a/api_docs/threat_intelligence.mdx b/api_docs/threat_intelligence.mdx
index a1aa998ce88972..04ea56346a8eb0 100644
--- a/api_docs/threat_intelligence.mdx
+++ b/api_docs/threat_intelligence.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/threatIntelligence
 title: "threatIntelligence"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the threatIntelligence plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'threatIntelligence']
 ---
 import threatIntelligenceObj from './threat_intelligence.devdocs.json';
diff --git a/api_docs/timelines.devdocs.json b/api_docs/timelines.devdocs.json
index 2f347aa6d81a6f..a0b03b6f182b48 100644
--- a/api_docs/timelines.devdocs.json
+++ b/api_docs/timelines.devdocs.json
@@ -2459,7 +2459,13 @@
             "description": [],
             "signature": [
               "(data: ",
-              "Ecs",
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.EcsSecurityExtension",
+                "text": "EcsSecurityExtension"
+              },
               ") => boolean"
             ],
             "path": "x-pack/plugins/timelines/common/types/timeline/rows/index.ts",
@@ -2474,7 +2480,13 @@
                 "label": "data",
                 "description": [],
                 "signature": [
-                  "Ecs"
+                  {
+                    "pluginId": "@kbn/securitysolution-ecs",
+                    "scope": "common",
+                    "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                    "section": "def-common.EcsSecurityExtension",
+                    "text": "EcsSecurityExtension"
+                  }
                 ],
                 "path": "x-pack/plugins/timelines/common/types/timeline/rows/index.ts",
                 "deprecated": false,
@@ -2493,7 +2505,13 @@
             "description": [],
             "signature": [
               "({ contextId, data, isDraggable, scopeId, }: { contextId?: string | undefined; data: ",
-              "Ecs",
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.EcsSecurityExtension",
+                "text": "EcsSecurityExtension"
+              },
               "; isDraggable: boolean; scopeId: string; }) => React.ReactNode"
             ],
             "path": "x-pack/plugins/timelines/common/types/timeline/rows/index.ts",
@@ -2533,7 +2551,13 @@
                     "label": "data",
                     "description": [],
                     "signature": [
-                      "Ecs"
+                      {
+                        "pluginId": "@kbn/securitysolution-ecs",
+                        "scope": "common",
+                        "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                        "section": "def-common.EcsSecurityExtension",
+                        "text": "EcsSecurityExtension"
+                      }
                     ],
                     "path": "x-pack/plugins/timelines/common/types/timeline/rows/index.ts",
                     "deprecated": false,
@@ -3351,7 +3375,13 @@
             "signature": [
               "Maybe",
               "<",
-              "Ecs",
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.EcsSecurityExtension",
+                "text": "EcsSecurityExtension"
+              },
               "> | undefined"
             ],
             "path": "x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts",
@@ -3600,7 +3630,13 @@
             "label": "ecs",
             "description": [],
             "signature": [
-              "Ecs"
+              {
+                "pluginId": "@kbn/securitysolution-ecs",
+                "scope": "common",
+                "docId": "kibKbnSecuritysolutionEcsPluginApi",
+                "section": "def-common.EcsSecurityExtension",
+                "text": "EcsSecurityExtension"
+              }
             ],
             "path": "x-pack/plugins/timelines/common/search_strategy/timeline/events/all/index.ts",
             "deprecated": false,
@@ -3974,7 +4010,13 @@
             "text": "TimelineNonEcsData"
           },
           "[]; ecsData?: ",
-          "Ecs",
+          {
+            "pluginId": "@kbn/securitysolution-ecs",
+            "scope": "common",
+            "docId": "kibKbnSecuritysolutionEcsPluginApi",
+            "section": "def-common.EcsSecurityExtension",
+            "text": "EcsSecurityExtension"
+          },
           " | undefined; eventId: string; globalFilters?: ",
           {
             "pluginId": "@kbn/es-query",
diff --git a/api_docs/timelines.mdx b/api_docs/timelines.mdx
index 60e78dee3b9a2c..bc205c49a267a9 100644
--- a/api_docs/timelines.mdx
+++ b/api_docs/timelines.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/timelines
 title: "timelines"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the timelines plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'timelines']
 ---
 import timelinesObj from './timelines.devdocs.json';
@@ -21,7 +21,7 @@ Contact [Security solution](https://github.com/orgs/elastic/teams/security-solut
 
 | Public API count  | Any count | Items lacking comments | Missing exports |
 |-------------------|-----------|------------------------|-----------------|
-| 257 | 1 | 214 | 21 |
+| 257 | 1 | 214 | 20 |
 
 ## Client
 
diff --git a/api_docs/transform.mdx b/api_docs/transform.mdx
index 851a2bcde33ea7..c80559eab8dc09 100644
--- a/api_docs/transform.mdx
+++ b/api_docs/transform.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/transform
 title: "transform"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the transform plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'transform']
 ---
 import transformObj from './transform.devdocs.json';
diff --git a/api_docs/triggers_actions_ui.devdocs.json b/api_docs/triggers_actions_ui.devdocs.json
index 4987c06f62d115..1f9c656c50a765 100644
--- a/api_docs/triggers_actions_ui.devdocs.json
+++ b/api_docs/triggers_actions_ui.devdocs.json
@@ -3365,7 +3365,7 @@
             "description": [],
             "signature": [
               "BasicFields",
-              " & { tags?: string[] | undefined; kibana?: string[] | undefined; \"@timestamp\"?: string[] | undefined; \"event.action\"?: string[] | undefined; \"kibana.alert.rule.execution.uuid\"?: string[] | undefined; \"kibana.alert.rule.rule_type_id\"?: string[] | undefined; \"kibana.alert.rule.consumer\"?: string[] | undefined; \"kibana.alert\"?: string[] | undefined; \"kibana.alert.rule\"?: string[] | undefined; \"kibana.alert.rule.parameters\"?: string[] | undefined; \"kibana.alert.rule.producer\"?: string[] | undefined; \"kibana.space_ids\"?: string[] | undefined; \"kibana.alert.uuid\"?: string[] | undefined; \"kibana.alert.instance.id\"?: string[] | undefined; \"kibana.alert.start\"?: string[] | undefined; \"kibana.alert.time_range\"?: string[] | undefined; \"kibana.alert.end\"?: string[] | undefined; \"kibana.alert.duration.us\"?: string[] | undefined; \"kibana.alert.severity\"?: string[] | undefined; \"kibana.alert.status\"?: string[] | undefined; \"kibana.alert.flapping\"?: string[] | undefined; \"kibana.version\"?: string[] | undefined; \"ecs.version\"?: string[] | undefined; \"kibana.alert.risk_score\"?: string[] | undefined; \"kibana.alert.workflow_status\"?: string[] | undefined; \"kibana.alert.workflow_user\"?: string[] | undefined; \"kibana.alert.workflow_reason\"?: string[] | undefined; \"kibana.alert.system_status\"?: string[] | undefined; \"kibana.alert.action_group\"?: string[] | undefined; \"kibana.alert.reason\"?: string[] | undefined; \"kibana.alert.case_ids\"?: string[] | undefined; \"kibana.alert.rule.author\"?: string[] | undefined; \"kibana.alert.rule.category\"?: string[] | undefined; \"kibana.alert.rule.uuid\"?: string[] | undefined; \"kibana.alert.rule.created_at\"?: string[] | undefined; \"kibana.alert.rule.created_by\"?: string[] | undefined; \"kibana.alert.rule.description\"?: string[] | undefined; \"kibana.alert.rule.enabled\"?: string[] | undefined; \"kibana.alert.rule.from\"?: string[] | undefined; \"kibana.alert.rule.interval\"?: string[] | undefined; \"kibana.alert.rule.license\"?: string[] | undefined; \"kibana.alert.rule.name\"?: string[] | undefined; \"kibana.alert.rule.note\"?: string[] | undefined; \"kibana.alert.rule.references\"?: string[] | undefined; \"kibana.alert.rule.rule_id\"?: string[] | undefined; \"kibana.alert.rule.rule_name_override\"?: string[] | undefined; \"kibana.alert.rule.tags\"?: string[] | undefined; \"kibana.alert.rule.to\"?: string[] | undefined; \"kibana.alert.rule.type\"?: string[] | undefined; \"kibana.alert.rule.updated_at\"?: string[] | undefined; \"kibana.alert.rule.updated_by\"?: string[] | undefined; \"kibana.alert.rule.version\"?: string[] | undefined; \"kibana.alert.suppression.terms\"?: string[] | undefined; \"kibana.alert.suppression.terms.field\"?: string[] | undefined; \"kibana.alert.suppression.terms.value\"?: string[] | undefined; \"kibana.alert.suppression.start\"?: string[] | undefined; \"kibana.alert.suppression.end\"?: string[] | undefined; \"kibana.alert.suppression.docs_count\"?: string[] | undefined; \"event.kind\"?: string[] | undefined; \"event.module\"?: string[] | undefined; \"kibana.alert.evaluation.threshold\"?: string[] | undefined; \"kibana.alert.evaluation.value\"?: string[] | undefined; \"kibana.alert.building_block_type\"?: string[] | undefined; \"kibana.alert.rule.exceptions_list\"?: string[] | undefined; \"kibana.alert.rule.namespace\"?: string[] | undefined; \"kibana.alert.rule.threat.framework\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.id\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.name\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.reference\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.id\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.name\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.reference\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.id\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.name\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.reference\"?: string[] | undefined; } & { [x: string]: unknown[]; }"
+              " & { tags?: string[] | undefined; kibana?: string[] | undefined; \"@timestamp\"?: string[] | undefined; \"event.action\"?: string[] | undefined; \"kibana.alert.rule.rule_type_id\"?: string[] | undefined; \"kibana.alert.rule.consumer\"?: string[] | undefined; \"kibana.alert.rule.execution.uuid\"?: string[] | undefined; \"kibana.alert\"?: string[] | undefined; \"kibana.alert.rule\"?: string[] | undefined; \"kibana.alert.rule.parameters\"?: string[] | undefined; \"kibana.alert.rule.producer\"?: string[] | undefined; \"kibana.space_ids\"?: string[] | undefined; \"kibana.alert.uuid\"?: string[] | undefined; \"kibana.alert.instance.id\"?: string[] | undefined; \"kibana.alert.start\"?: string[] | undefined; \"kibana.alert.time_range\"?: string[] | undefined; \"kibana.alert.end\"?: string[] | undefined; \"kibana.alert.duration.us\"?: string[] | undefined; \"kibana.alert.severity\"?: string[] | undefined; \"kibana.alert.status\"?: string[] | undefined; \"kibana.alert.flapping\"?: string[] | undefined; \"kibana.version\"?: string[] | undefined; \"ecs.version\"?: string[] | undefined; \"kibana.alert.risk_score\"?: string[] | undefined; \"kibana.alert.workflow_status\"?: string[] | undefined; \"kibana.alert.workflow_user\"?: string[] | undefined; \"kibana.alert.workflow_reason\"?: string[] | undefined; \"kibana.alert.system_status\"?: string[] | undefined; \"kibana.alert.action_group\"?: string[] | undefined; \"kibana.alert.reason\"?: string[] | undefined; \"kibana.alert.case_ids\"?: string[] | undefined; \"kibana.alert.rule.author\"?: string[] | undefined; \"kibana.alert.rule.category\"?: string[] | undefined; \"kibana.alert.rule.uuid\"?: string[] | undefined; \"kibana.alert.rule.created_at\"?: string[] | undefined; \"kibana.alert.rule.created_by\"?: string[] | undefined; \"kibana.alert.rule.description\"?: string[] | undefined; \"kibana.alert.rule.enabled\"?: string[] | undefined; \"kibana.alert.rule.from\"?: string[] | undefined; \"kibana.alert.rule.interval\"?: string[] | undefined; \"kibana.alert.rule.license\"?: string[] | undefined; \"kibana.alert.rule.name\"?: string[] | undefined; \"kibana.alert.rule.note\"?: string[] | undefined; \"kibana.alert.rule.references\"?: string[] | undefined; \"kibana.alert.rule.rule_id\"?: string[] | undefined; \"kibana.alert.rule.rule_name_override\"?: string[] | undefined; \"kibana.alert.rule.tags\"?: string[] | undefined; \"kibana.alert.rule.to\"?: string[] | undefined; \"kibana.alert.rule.type\"?: string[] | undefined; \"kibana.alert.rule.updated_at\"?: string[] | undefined; \"kibana.alert.rule.updated_by\"?: string[] | undefined; \"kibana.alert.rule.version\"?: string[] | undefined; \"kibana.alert.suppression.terms\"?: string[] | undefined; \"kibana.alert.suppression.terms.field\"?: string[] | undefined; \"kibana.alert.suppression.terms.value\"?: string[] | undefined; \"kibana.alert.suppression.start\"?: string[] | undefined; \"kibana.alert.suppression.end\"?: string[] | undefined; \"kibana.alert.suppression.docs_count\"?: string[] | undefined; \"event.kind\"?: string[] | undefined; \"event.module\"?: string[] | undefined; \"kibana.alert.evaluation.threshold\"?: string[] | undefined; \"kibana.alert.evaluation.value\"?: string[] | undefined; \"kibana.alert.building_block_type\"?: string[] | undefined; \"kibana.alert.rule.exceptions_list\"?: string[] | undefined; \"kibana.alert.rule.namespace\"?: string[] | undefined; \"kibana.alert.rule.threat.framework\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.id\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.name\"?: string[] | undefined; \"kibana.alert.rule.threat.tactic.reference\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.id\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.name\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.reference\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.id\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.name\"?: string[] | undefined; \"kibana.alert.rule.threat.technique.subtechnique.reference\"?: string[] | undefined; } & { [x: string]: unknown[]; }"
             ],
             "path": "x-pack/plugins/triggers_actions_ui/public/types.ts",
             "deprecated": false,
diff --git a/api_docs/triggers_actions_ui.mdx b/api_docs/triggers_actions_ui.mdx
index 5d981ba61183f7..c3bab17c76d180 100644
--- a/api_docs/triggers_actions_ui.mdx
+++ b/api_docs/triggers_actions_ui.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/triggersActionsUi
 title: "triggersActionsUi"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the triggersActionsUi plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'triggersActionsUi']
 ---
 import triggersActionsUiObj from './triggers_actions_ui.devdocs.json';
diff --git a/api_docs/ui_actions.mdx b/api_docs/ui_actions.mdx
index 8c47375d5532d4..5768d4d47e19ae 100644
--- a/api_docs/ui_actions.mdx
+++ b/api_docs/ui_actions.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActions
 title: "uiActions"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActions plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActions']
 ---
 import uiActionsObj from './ui_actions.devdocs.json';
diff --git a/api_docs/ui_actions_enhanced.mdx b/api_docs/ui_actions_enhanced.mdx
index cfedc3f66a919a..9a2e2688c618bc 100644
--- a/api_docs/ui_actions_enhanced.mdx
+++ b/api_docs/ui_actions_enhanced.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActionsEnhanced
 title: "uiActionsEnhanced"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the uiActionsEnhanced plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActionsEnhanced']
 ---
 import uiActionsEnhancedObj from './ui_actions_enhanced.devdocs.json';
diff --git a/api_docs/unified_field_list.mdx b/api_docs/unified_field_list.mdx
index 7ee1f3878b5676..4af77b69a2a50e 100644
--- a/api_docs/unified_field_list.mdx
+++ b/api_docs/unified_field_list.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedFieldList
 title: "unifiedFieldList"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedFieldList plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedFieldList']
 ---
 import unifiedFieldListObj from './unified_field_list.devdocs.json';
diff --git a/api_docs/unified_histogram.mdx b/api_docs/unified_histogram.mdx
index c72e5eb087f3f4..d426e0f5750fe1 100644
--- a/api_docs/unified_histogram.mdx
+++ b/api_docs/unified_histogram.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedHistogram
 title: "unifiedHistogram"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedHistogram plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedHistogram']
 ---
 import unifiedHistogramObj from './unified_histogram.devdocs.json';
diff --git a/api_docs/unified_search.mdx b/api_docs/unified_search.mdx
index fb4bd4dba14268..7b5afe12f98136 100644
--- a/api_docs/unified_search.mdx
+++ b/api_docs/unified_search.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch
 title: "unifiedSearch"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch']
 ---
 import unifiedSearchObj from './unified_search.devdocs.json';
diff --git a/api_docs/unified_search_autocomplete.mdx b/api_docs/unified_search_autocomplete.mdx
index 5735e950dd9e4d..548439614f5382 100644
--- a/api_docs/unified_search_autocomplete.mdx
+++ b/api_docs/unified_search_autocomplete.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch-autocomplete
 title: "unifiedSearch.autocomplete"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the unifiedSearch.autocomplete plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch.autocomplete']
 ---
 import unifiedSearchAutocompleteObj from './unified_search_autocomplete.devdocs.json';
diff --git a/api_docs/url_forwarding.mdx b/api_docs/url_forwarding.mdx
index 82ed77a953e28c..2bbad182b74335 100644
--- a/api_docs/url_forwarding.mdx
+++ b/api_docs/url_forwarding.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/urlForwarding
 title: "urlForwarding"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the urlForwarding plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'urlForwarding']
 ---
 import urlForwardingObj from './url_forwarding.devdocs.json';
diff --git a/api_docs/usage_collection.mdx b/api_docs/usage_collection.mdx
index 7af3d592999e83..f22ed712c50bbd 100644
--- a/api_docs/usage_collection.mdx
+++ b/api_docs/usage_collection.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/usageCollection
 title: "usageCollection"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the usageCollection plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'usageCollection']
 ---
 import usageCollectionObj from './usage_collection.devdocs.json';
diff --git a/api_docs/ux.mdx b/api_docs/ux.mdx
index cbcd05f096a12c..fb4ae1f8b06380 100644
--- a/api_docs/ux.mdx
+++ b/api_docs/ux.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ux
 title: "ux"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the ux plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ux']
 ---
 import uxObj from './ux.devdocs.json';
diff --git a/api_docs/vis_default_editor.mdx b/api_docs/vis_default_editor.mdx
index 01b4a9f98e7b84..bd7955854a3671 100644
--- a/api_docs/vis_default_editor.mdx
+++ b/api_docs/vis_default_editor.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visDefaultEditor
 title: "visDefaultEditor"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visDefaultEditor plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visDefaultEditor']
 ---
 import visDefaultEditorObj from './vis_default_editor.devdocs.json';
diff --git a/api_docs/vis_type_gauge.mdx b/api_docs/vis_type_gauge.mdx
index 7bff9670c5818d..97eb2a8aa1d2f2 100644
--- a/api_docs/vis_type_gauge.mdx
+++ b/api_docs/vis_type_gauge.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeGauge
 title: "visTypeGauge"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeGauge plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeGauge']
 ---
 import visTypeGaugeObj from './vis_type_gauge.devdocs.json';
diff --git a/api_docs/vis_type_heatmap.mdx b/api_docs/vis_type_heatmap.mdx
index 492901d663c00f..710d90af79daee 100644
--- a/api_docs/vis_type_heatmap.mdx
+++ b/api_docs/vis_type_heatmap.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeHeatmap
 title: "visTypeHeatmap"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeHeatmap plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeHeatmap']
 ---
 import visTypeHeatmapObj from './vis_type_heatmap.devdocs.json';
diff --git a/api_docs/vis_type_pie.mdx b/api_docs/vis_type_pie.mdx
index 278d71b3f35003..52dad7f788308c 100644
--- a/api_docs/vis_type_pie.mdx
+++ b/api_docs/vis_type_pie.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypePie
 title: "visTypePie"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypePie plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypePie']
 ---
 import visTypePieObj from './vis_type_pie.devdocs.json';
diff --git a/api_docs/vis_type_table.mdx b/api_docs/vis_type_table.mdx
index 22516a52290b1a..f35350542f025e 100644
--- a/api_docs/vis_type_table.mdx
+++ b/api_docs/vis_type_table.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTable
 title: "visTypeTable"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTable plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTable']
 ---
 import visTypeTableObj from './vis_type_table.devdocs.json';
diff --git a/api_docs/vis_type_timelion.mdx b/api_docs/vis_type_timelion.mdx
index 388541ac59fcef..eb1a93c15b37d3 100644
--- a/api_docs/vis_type_timelion.mdx
+++ b/api_docs/vis_type_timelion.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimelion
 title: "visTypeTimelion"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimelion plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimelion']
 ---
 import visTypeTimelionObj from './vis_type_timelion.devdocs.json';
diff --git a/api_docs/vis_type_timeseries.mdx b/api_docs/vis_type_timeseries.mdx
index e36f7b12a10c0c..0f545cb502b3a5 100644
--- a/api_docs/vis_type_timeseries.mdx
+++ b/api_docs/vis_type_timeseries.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimeseries
 title: "visTypeTimeseries"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeTimeseries plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimeseries']
 ---
 import visTypeTimeseriesObj from './vis_type_timeseries.devdocs.json';
diff --git a/api_docs/vis_type_vega.mdx b/api_docs/vis_type_vega.mdx
index ed72bfafabc61c..c581d4537320f2 100644
--- a/api_docs/vis_type_vega.mdx
+++ b/api_docs/vis_type_vega.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVega
 title: "visTypeVega"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVega plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVega']
 ---
 import visTypeVegaObj from './vis_type_vega.devdocs.json';
diff --git a/api_docs/vis_type_vislib.mdx b/api_docs/vis_type_vislib.mdx
index b6a172489358fb..8a598f2a8af514 100644
--- a/api_docs/vis_type_vislib.mdx
+++ b/api_docs/vis_type_vislib.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVislib
 title: "visTypeVislib"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeVislib plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVislib']
 ---
 import visTypeVislibObj from './vis_type_vislib.devdocs.json';
diff --git a/api_docs/vis_type_xy.mdx b/api_docs/vis_type_xy.mdx
index 3e497b1426b591..9181fa899b6816 100644
--- a/api_docs/vis_type_xy.mdx
+++ b/api_docs/vis_type_xy.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeXy
 title: "visTypeXy"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visTypeXy plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeXy']
 ---
 import visTypeXyObj from './vis_type_xy.devdocs.json';
diff --git a/api_docs/visualizations.devdocs.json b/api_docs/visualizations.devdocs.json
index 504fa443dabb06..2d07aa3db8e215 100644
--- a/api_docs/visualizations.devdocs.json
+++ b/api_docs/visualizations.devdocs.json
@@ -6320,7 +6320,7 @@
             "section": "def-public.VisualizeInput",
             "text": "VisualizeInput"
           },
-          "; getDescription: () => string; destroy: () => void; readonly parent?: ",
+          "; getDescription: () => string; reload: () => Promise<void>; destroy: () => void; readonly parent?: ",
           {
             "pluginId": "embeddable",
             "scope": "public",
@@ -6416,7 +6416,7 @@
             "section": "def-public.ExpressionRenderError",
             "text": "ExpressionRenderError"
           },
-          ") => void; reload: () => Promise<void>; supportedTriggers: () => string[]; getExpressionVariables$: () => ",
+          ") => void; supportedTriggers: () => string[]; getExpressionVariables$: () => ",
           "Observable",
           "<Record<string, unknown> | undefined>; getExpressionVariables: () => Record<string, unknown> | undefined; inputIsRefType: (input: ",
           {
diff --git a/api_docs/visualizations.mdx b/api_docs/visualizations.mdx
index a09b11b2250f98..fbb176e39d392f 100644
--- a/api_docs/visualizations.mdx
+++ b/api_docs/visualizations.mdx
@@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visualizations
 title: "visualizations"
 image: https://source.unsplash.com/400x175/?github
 description: API docs for the visualizations plugin
-date: 2023-01-23
+date: 2023-01-24
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visualizations']
 ---
 import visualizationsObj from './visualizations.devdocs.json';

From 45256085db0bcd0b13436acd6801673555b6de7d Mon Sep 17 00:00:00 2001
From: Alexander Wert <AlexanderWert@users.noreply.github.com>
Date: Tue, 24 Jan 2023 07:21:13 +0100
Subject: [PATCH 34/54] Added LDAP icon to span icons (#149330)

## Summary

With https://github.com/elastic/apm-agent-java/pull/2977 the Java agent
adds instrumentation for LDAP spans.
Added span icon for LDAP spans:

<img width="590" alt="image"
src="https://user-images.githubusercontent.com/866830/214064572-66be6de5-d3de-4ea0-9e1f-e59b7f611ed5.png">
---
 .../public/components/shared/span_icon/get_span_icon.ts  | 2 ++
 .../public/components/shared/span_icon/icons/ldap.svg    | 9 +++++++++
 2 files changed, 11 insertions(+)
 create mode 100644 x-pack/plugins/apm/public/components/shared/span_icon/icons/ldap.svg

diff --git a/x-pack/plugins/apm/public/components/shared/span_icon/get_span_icon.ts b/x-pack/plugins/apm/public/components/shared/span_icon/get_span_icon.ts
index 96b1cd45fbdce0..5c719d51d457e6 100644
--- a/x-pack/plugins/apm/public/components/shared/span_icon/get_span_icon.ts
+++ b/x-pack/plugins/apm/public/components/shared/span_icon/get_span_icon.ts
@@ -33,6 +33,7 @@ import fileShareStorageIcon from './icons/file_share_storage.svg';
 import serviceBusIcon from './icons/service_bus.svg';
 import storageQueueIcon from './icons/storage_queue.svg';
 import tableStorageIcon from './icons/table_storage.svg';
+import ldapIcon from './icons/ldap.svg';
 
 const defaultSpanTypeIcons: { [key: string]: string } = {
   cache: databaseIcon,
@@ -64,6 +65,7 @@ export const spanTypeIcons: {
     graphql: graphqlIcon,
     grpc: grpcIcon,
     websocket: websocketIcon,
+    ldap: ldapIcon,
   },
   messaging: {
     azurequeue: storageQueueIcon,
diff --git a/x-pack/plugins/apm/public/components/shared/span_icon/icons/ldap.svg b/x-pack/plugins/apm/public/components/shared/span_icon/icons/ldap.svg
new file mode 100644
index 00000000000000..c77b4ccd670ab4
--- /dev/null
+++ b/x-pack/plugins/apm/public/components/shared/span_icon/icons/ldap.svg
@@ -0,0 +1,9 @@
+<svg width="500" height="500" xmlns="http://www.w3.org/2000/svg" data-name="Layer 1">
+
+ <title>unblock-user</title>
+ <g>
+  <title>Layer 1</title>
+  <text font-weight="bold" transform="matrix(1.42061 0 0 1.51886 -45.5306 -184.232)" stroke="null" xml:space="preserve" text-anchor="start" font-family="sans-serif" font-size="124" stroke-width="0" id="svg_4" y="429.5168" x="39.9989" fill="#000000">LDAP</text>
+  <path fill="#000000" stroke="null" id="svg_1" fill-rule="evenodd" d="m358.05907,188.98295a58.83094,59.83853 0 1 1 -58.83094,59.88982a58.80572,59.81288 0 0 1 58.83094,-59.88982zm-157.35321,-35.90825c-5.04337,-8.2589 -14.62578,-19.4674 -14.62578,-29.11133a15.28142,15.54314 0 0 1 10.28848,-14.15811c-0.47912,-8.18195 -0.80694,-16.4665 -0.80694,-24.67409c0,-4.87326 0,-9.77217 0.27739,-14.59414a31.89933,32.44566 0 0 1 1.61388,-7.30989a50.98849,51.86177 0 0 1 22.69517,-29.44476a65.38732,66.5072 0 0 1 12.43191,-6.13005c7.81723,-2.89831 4.0347,-15.38925 12.60843,-15.64574c20.17349,-0.51297 52.95541,17.3129 65.86644,31.47101a46.70163,47.50148 0 0 1 13.13798,31.83009l-0.80694,35.7287a11.52411,11.72148 0 0 1 8.42243,7.33554c2.72342,11.2598 -8.75025,25.28966 -14.09623,34.26673c-5.04337,8.2589 -23.7795,30.7785 -23.80472,31.03498a7.18681,7.30989 0 0 0 1.68953,4.1551a46.60076,47.39888 0 0 0 6.22856,7.02776a77.39055,78.716 0 0 0 -12.88582,89.41153l-181.93965,0c0,-81.38347 85.9895,-55.52954 115.21584,-96.43929c1.43736,-2.15449 2.11822,-3.30869 2.093,-4.25769c0,-0.51297 -21.66128,-27.49546 -23.60298,-30.6246l0,0.12824zm182.0153,89.00115a1.58866,1.61587 0 0 1 1.58866,1.61587l0,32.26612a1.58866,1.61587 0 0 1 -1.58866,1.59022l-49.3494,0a1.58866,1.61587 0 0 1 -1.58866,-1.59022l0,-32.39437a1.58866,1.61587 0 0 1 1.53823,-1.61587l5.32076,0l0,-13.59384a20.17349,20.519 0 0 1 5.95118,-14.56849l0,0a20.17349,20.519 0 0 1 28.64635,0l0,0a20.17349,20.519 0 0 1 6.10248,14.312l-7.89288,0a12.38148,12.59353 0 0 0 -21.15695,-8.77187l0,0a12.38148,12.59353 0 0 0 -3.7321,8.92576l0,13.69643l36.16098,0.12824zm-24.0821,16.90252l2.52169,11.74713l-6.8842,0l2.01735,-11.90102a4.66512,4.74502 0 1 1 2.34517,0l0,0.15389z" class="cls-1"/>
+ </g>
+</svg>
\ No newline at end of file

From badf9a808e3e3e0dab24847175ec249591d6fda9 Mon Sep 17 00:00:00 2001
From: Maja Grubic <maja.grubic@elastic.co>
Date: Tue, 24 Jan 2023 08:19:57 +0100
Subject: [PATCH 35/54] [Custom Branding] Replace EuiLoadingElastic with
 EuiLoadingSpinner (#149261)

## Summary

As part of the Custom Branding project, we need to replace
`EuiLoadingElastic` in places where it appears and replace it with a
plain `EuiLoadingSpinner`. This PR does so in saved objects table and
related modals and `share` plugin.


### Checklist

Delete any items that are not applicable to this PR.

- [X] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [X]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [X] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [X] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
~- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)~
~- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))~
- [ X This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
---
 .../saved_objects_table.test.tsx.snap          |  1 +
 .../components/delete_confirm_modal.test.tsx   | 17 ++++++++++++++++-
 .../components/delete_confirm_modal.tsx        |  5 ++++-
 .../objects_table/components/flyout.tsx        |  6 ++++--
 .../components/relationships.test.tsx          |  3 ++-
 .../objects_table/components/relationships.tsx |  6 ++++--
 .../objects_table/saved_objects_table.test.tsx |  2 ++
 .../objects_table/saved_objects_table.tsx      | 18 +++++++++++++++++-
 .../saved_objects_table_page.tsx               |  1 +
 .../saved_objects_management/tsconfig.json     |  2 ++
 .../url_service/redirect/components/page.tsx   |  7 +++++--
 .../redirect/components/spinner.tsx            | 12 +++++++++---
 .../url_service/redirect/redirect_manager.ts   |  6 +++++-
 src/plugins/share/tsconfig.json                |  1 +
 14 files changed, 73 insertions(+), 14 deletions(-)

diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap b/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap
index e0a7bada5c432d..1893231609eb96 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/__snapshots__/saved_objects_table.test.tsx.snap
@@ -47,6 +47,7 @@ exports[`SavedObjectsTable delete should show a confirm modal 1`] = `
       },
     ]
   }
+  showPlainSpinner={false}
 />
 `;
 
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.test.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.test.tsx
index 8bcc940514d629..8f3209c5fee1bc 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.test.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.test.tsx
@@ -41,7 +41,7 @@ describe('DeleteConfirmModal', () => {
     onCancel = jest.fn();
   });
 
-  it('displays a loader if `isDeleting` is true', () => {
+  it('displays a EuiLoadingElastic spinner if `isDeleting` is true', () => {
     const wrapper = mountWithIntl(
       <DeleteConfirmModal
         isDeleting={true}
@@ -55,6 +55,21 @@ describe('DeleteConfirmModal', () => {
     expect(wrapper.find('EuiModal')).toHaveLength(0);
   });
 
+  it('displays a EuiLoadingSpinner if `isDeleting` is true and `showPlainSpinner` is true', () => {
+    const wrapper = mountWithIntl(
+      <DeleteConfirmModal
+        isDeleting={true}
+        onConfirm={onConfirm}
+        onCancel={onCancel}
+        selectedObjects={[]}
+        allowedTypes={allowedTypes}
+        showPlainSpinner={true}
+      />
+    );
+    expect(wrapper.find('EuiLoadingElastic')).toHaveLength(0);
+    expect(wrapper.find('EuiLoadingSpinner')).toHaveLength(1);
+  });
+
   it('lists the objects to delete', () => {
     const objs = [createObject(), createObject(), createObject()];
     const wrapper = mountWithIntl(
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.tsx
index 784709451f8356..65e29fb1fd1949 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/components/delete_confirm_modal.tsx
@@ -24,6 +24,7 @@ import {
   EuiButton,
   EuiSpacer,
   EuiCallOut,
+  EuiLoadingSpinner,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
@@ -36,6 +37,7 @@ export interface DeleteConfirmModalProps {
   onCancel: () => void;
   selectedObjects: SavedObjectWithMetadata[];
   allowedTypes: SavedObjectManagementTypeInfo[];
+  showPlainSpinner?: boolean;
 }
 
 export const DeleteConfirmModal: FC<DeleteConfirmModalProps> = ({
@@ -44,6 +46,7 @@ export const DeleteConfirmModal: FC<DeleteConfirmModalProps> = ({
   onCancel,
   selectedObjects,
   allowedTypes,
+  showPlainSpinner,
 }) => {
   const undeletableObjects = useMemo(() => {
     return selectedObjects.filter((obj) => obj.meta.hiddenType);
@@ -64,7 +67,7 @@ export const DeleteConfirmModal: FC<DeleteConfirmModalProps> = ({
   if (isDeleting) {
     return (
       <EuiOverlayMask>
-        <EuiLoadingElastic size="xl" />
+        {showPlainSpinner ? <EuiLoadingSpinner size="xl" /> : <EuiLoadingElastic size="xl" />}
       </EuiOverlayMask>
     );
   }
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx
index 8e376fe7c7e6a4..8f0be4c8515f81 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx
@@ -28,6 +28,7 @@ import {
   EuiCallOut,
   EuiSpacer,
   EuiLink,
+  EuiLoadingSpinner,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
@@ -58,6 +59,7 @@ export interface FlyoutProps {
   basePath: IBasePath;
   search: ISearchStart;
   allowedTypes: SavedObjectManagementTypeInfo[];
+  showPlainSpinner?: boolean;
 }
 
 export interface FlyoutState {
@@ -413,7 +415,7 @@ export class Flyout extends Component<FlyoutProps, FlyoutState> {
   }
 
   renderBody() {
-    const { allowedTypes } = this.props;
+    const { allowedTypes, showPlainSpinner } = this.props;
     const {
       status,
       loadingMessage,
@@ -427,7 +429,7 @@ export class Flyout extends Component<FlyoutProps, FlyoutState> {
       return (
         <EuiFlexGroup justifyContent="spaceAround">
           <EuiFlexItem grow={false}>
-            <EuiLoadingElastic size="xl" />
+            {showPlainSpinner ? <EuiLoadingSpinner size="xl" /> : <EuiLoadingElastic size="xl" />}
             <EuiSpacer size="m" />
             <EuiText>
               <p>{loadingMessage}</p>
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/components/relationships.test.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/components/relationships.test.tsx
index adb920d3a6133b..bffd933ef2e00e 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/components/relationships.test.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/components/relationships.test.tsx
@@ -288,12 +288,13 @@ describe('Relationships', () => {
       },
       allowedTypes,
       close: jest.fn(),
+      showPlainSpinner: true,
     };
 
     const component = shallowWithI18nProvider(<Relationships {...props} />);
 
     // Make sure we are showing loading
-    expect(component.find('EuiLoadingElastic').length).toBe(1);
+    expect(component.find('EuiLoadingSpinner').length).toBe(1);
 
     // Ensure all promises resolve
     await new Promise((resolve) => process.nextTick(resolve));
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/components/relationships.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/components/relationships.tsx
index 75614ba83ec166..bb097f64c44381 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/components/relationships.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/components/relationships.tsx
@@ -20,6 +20,7 @@ import {
   EuiToolTip,
   EuiText,
   EuiSpacer,
+  EuiLoadingSpinner,
 } from '@elastic/eui';
 import { SearchFilterConfig } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
@@ -43,6 +44,7 @@ export interface RelationshipsProps {
   goInspectObject: (obj: SavedObjectWithMetadata) => void;
   canGoInApp: (obj: SavedObjectWithMetadata) => boolean;
   allowedTypes: SavedObjectManagementTypeInfo[];
+  showPlainSpinner?: boolean;
 }
 
 export interface RelationshipsState {
@@ -215,7 +217,7 @@ export class Relationships extends Component<RelationshipsProps, RelationshipsSt
   }
 
   renderRelationshipsTable() {
-    const { goInspectObject, basePath, savedObject, allowedTypes } = this.props;
+    const { goInspectObject, basePath, savedObject, allowedTypes, showPlainSpinner } = this.props;
     const { relations, isLoading, error } = this.state;
 
     if (error) {
@@ -223,7 +225,7 @@ export class Relationships extends Component<RelationshipsProps, RelationshipsSt
     }
 
     if (isLoading) {
-      return <EuiLoadingElastic size="xl" />;
+      return showPlainSpinner ? <EuiLoadingSpinner size="xl" /> : <EuiLoadingElastic size="xl" />;
     }
 
     const columns = [
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.test.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.test.tsx
index e08d0cde6c7cd2..69ced5010c560c 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.test.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.test.tsx
@@ -41,6 +41,7 @@ import {
 } from './saved_objects_table';
 import { Flyout, Relationships } from './components';
 import { SavedObjectWithMetadata } from '../../types';
+import { customBrandingServiceMock } from '@kbn/core-custom-branding-browser-mocks';
 
 const convertType = (type: string): SavedObjectManagementTypeInfo => ({
   name: type,
@@ -141,6 +142,7 @@ describe('SavedObjectsTable', () => {
       goInspectObject: () => {},
       canGoInApp: () => true,
       search,
+      customBranding: customBrandingServiceMock.createStartContract(),
     };
 
     findObjectsMock.mockImplementation(() => ({
diff --git a/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx b/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx
index 0ecd3e0d78a069..1762ccafe698e1 100644
--- a/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/objects_table/saved_objects_table.tsx
@@ -18,6 +18,8 @@ import { RedirectAppLinks } from '@kbn/kibana-react-plugin/public';
 import { SavedObjectsTaggingApi } from '@kbn/saved-objects-tagging-oss-plugin/public';
 import { DataViewsContract } from '@kbn/data-views-plugin/public';
 import { DataPublicPluginStart } from '@kbn/data-plugin/public';
+import { CustomBrandingStart } from '@kbn/core-custom-branding-browser';
+import { Subscription } from 'rxjs';
 import type { SavedObjectManagementTypeInfo } from '../../../common/types';
 import {
   parseQuery,
@@ -66,6 +68,7 @@ export interface SavedObjectsTableProps {
   goInspectObject: (obj: SavedObjectWithMetadata) => void;
   canGoInApp: (obj: SavedObjectWithMetadata) => boolean;
   initialQuery?: Query;
+  customBranding: CustomBrandingStart;
 }
 
 export interface SavedObjectsTableState {
@@ -88,6 +91,7 @@ export interface SavedObjectsTableState {
   exportAllOptions: ExportAllOption[];
   exportAllSelectedOptions: Record<string, boolean>;
   isIncludeReferencesDeepChecked: boolean;
+  hasCustomBranding: boolean;
 }
 
 const unableFindSavedObjectsNotificationMessage = i18n.translate(
@@ -101,6 +105,7 @@ const unableFindSavedObjectNotificationMessage = i18n.translate(
 
 export class SavedObjectsTable extends Component<SavedObjectsTableProps, SavedObjectsTableState> {
   private _isMounted = false;
+  private hasCustomBrandingSubscription?: Subscription;
 
   constructor(props: SavedObjectsTableProps) {
     super(props);
@@ -131,6 +136,7 @@ export class SavedObjectsTable extends Component<SavedObjectsTableProps, SavedOb
       exportAllOptions: [],
       exportAllSelectedOptions: {},
       isIncludeReferencesDeepChecked: true,
+      hasCustomBranding: false,
     };
   }
 
@@ -138,12 +144,18 @@ export class SavedObjectsTable extends Component<SavedObjectsTableProps, SavedOb
     this._isMounted = true;
     this.fetchAllSavedObjects();
     this.fetchCounts();
+    this.hasCustomBrandingSubscription = this.props.customBranding.hasCustomBranding$.subscribe(
+      (next) => {
+        this.setState({ ...this.state, hasCustomBranding: next });
+      }
+    );
   }
 
   componentWillUnmount() {
     this._isMounted = false;
     this.debouncedFindObjects.cancel();
     this.debouncedBulkGetObjects.cancel();
+    this.hasCustomBrandingSubscription?.unsubscribe();
   }
 
   fetchCounts = async () => {
@@ -574,6 +586,7 @@ export class SavedObjectsTable extends Component<SavedObjectsTableProps, SavedOb
         basePath={this.props.http.basePath}
         search={this.props.search}
         allowedTypes={this.props.allowedTypes}
+        showPlainSpinner={this.state.hasCustomBranding}
       />
     );
   }
@@ -592,12 +605,14 @@ export class SavedObjectsTable extends Component<SavedObjectsTableProps, SavedOb
         goInspectObject={this.props.goInspectObject}
         canGoInApp={this.props.canGoInApp}
         allowedTypes={this.props.allowedTypes}
+        showPlainSpinner={this.state.hasCustomBranding}
       />
     );
   }
 
   renderDeleteConfirmModal() {
-    const { isShowingDeleteConfirmModal, isDeleting, selectedSavedObjects } = this.state;
+    const { isShowingDeleteConfirmModal, isDeleting, selectedSavedObjects, hasCustomBranding } =
+      this.state;
     const { allowedTypes } = this.props;
 
     if (!isShowingDeleteConfirmModal) {
@@ -615,6 +630,7 @@ export class SavedObjectsTable extends Component<SavedObjectsTableProps, SavedOb
         }}
         selectedObjects={selectedSavedObjects}
         allowedTypes={allowedTypes}
+        showPlainSpinner={hasCustomBranding}
       />
     );
   }
diff --git a/src/plugins/saved_objects_management/public/management_section/saved_objects_table_page.tsx b/src/plugins/saved_objects_management/public/management_section/saved_objects_table_page.tsx
index ec083bf2f5c00d..ef5b8a30d91d92 100644
--- a/src/plugins/saved_objects_management/public/management_section/saved_objects_table_page.tsx
+++ b/src/plugins/saved_objects_management/public/management_section/saved_objects_table_page.tsx
@@ -102,6 +102,7 @@ const SavedObjectsTablePage = ({
           if (!inAppUrl.uiCapabilitiesPath) return true;
           return Boolean(get(capabilities, inAppUrl.uiCapabilitiesPath));
         }}
+        customBranding={coreStart.customBranding}
       />
     </ContextWrapper>
   );
diff --git a/src/plugins/saved_objects_management/tsconfig.json b/src/plugins/saved_objects_management/tsconfig.json
index aa1449d4a9c2e0..98dcb8c303170d 100644
--- a/src/plugins/saved_objects_management/tsconfig.json
+++ b/src/plugins/saved_objects_management/tsconfig.json
@@ -25,6 +25,8 @@
     "@kbn/core-saved-objects-common",
     "@kbn/monaco",
     "@kbn/config-schema",
+    "@kbn/core-custom-branding-browser-mocks",
+    "@kbn/core-custom-branding-browser",
   ],
   "exclude": [
     "target/**/*",
diff --git a/src/plugins/share/public/url_service/redirect/components/page.tsx b/src/plugins/share/public/url_service/redirect/components/page.tsx
index 504e5955faca0b..38aeafa5920d59 100644
--- a/src/plugins/share/public/url_service/redirect/components/page.tsx
+++ b/src/plugins/share/public/url_service/redirect/components/page.tsx
@@ -11,6 +11,7 @@ import useObservable from 'react-use/lib/useObservable';
 import { EuiPageTemplate_Deprecated as EuiPageTemplate } from '@elastic/eui';
 import { ThemeServiceSetup } from '@kbn/core/public';
 import { KibanaThemeProvider } from '@kbn/kibana-react-plugin/public';
+import { CustomBrandingStart } from '@kbn/core-custom-branding-browser';
 import { Error } from './error';
 import { RedirectManager } from '../redirect_manager';
 import { Spinner } from './spinner';
@@ -18,10 +19,12 @@ import { Spinner } from './spinner';
 export interface PageProps {
   manager: Pick<RedirectManager, 'error$'>;
   theme: ThemeServiceSetup;
+  customBranding: CustomBrandingStart;
 }
 
-export const Page: React.FC<PageProps> = ({ manager, theme }) => {
+export const Page: React.FC<PageProps> = ({ manager, theme, customBranding }) => {
   const error = useObservable(manager.error$);
+  const hasCustomBranding = useObservable(customBranding.hasCustomBranding$);
 
   if (error) {
     return (
@@ -46,7 +49,7 @@ export const Page: React.FC<PageProps> = ({ manager, theme }) => {
           color: 'primary',
         }}
       >
-        <Spinner />
+        <Spinner showPlainSpinner={Boolean(hasCustomBranding)} />
       </EuiPageTemplate>
     </KibanaThemeProvider>
   );
diff --git a/src/plugins/share/public/url_service/redirect/components/spinner.tsx b/src/plugins/share/public/url_service/redirect/components/spinner.tsx
index a70ae5eb096aff..61b09069f09518 100644
--- a/src/plugins/share/public/url_service/redirect/components/spinner.tsx
+++ b/src/plugins/share/public/url_service/redirect/components/spinner.tsx
@@ -7,7 +7,13 @@
  */
 
 import * as React from 'react';
-import { EuiFlexGroup, EuiFlexItem, EuiLoadingElastic, EuiText } from '@elastic/eui';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiLoadingElastic,
+  EuiLoadingSpinner,
+  EuiText,
+} from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
 const text = i18n.translate('share.urlService.redirect.components.Spinner.label', {
@@ -15,13 +21,13 @@ const text = i18n.translate('share.urlService.redirect.components.Spinner.label'
   description: 'Redirect endpoint spinner label.',
 });
 
-export const Spinner: React.FC = () => {
+export const Spinner: React.FC<{ showPlainSpinner: boolean }> = ({ showPlainSpinner }) => {
   return (
     <EuiFlexGroup justifyContent="spaceAround" alignItems="center">
       <EuiFlexItem grow={false}>
         <EuiFlexGroup justifyContent="spaceAround" alignItems="center">
           <EuiFlexItem grow={false}>
-            <EuiLoadingElastic size="xxl" />
+            {showPlainSpinner ? <EuiLoadingSpinner size="xxl" /> : <EuiLoadingElastic size="xxl" />}
           </EuiFlexItem>
           <EuiFlexItem grow={false}>
             <EuiText color="subdued" size={'m'}>
diff --git a/src/plugins/share/public/url_service/redirect/redirect_manager.ts b/src/plugins/share/public/url_service/redirect/redirect_manager.ts
index 1bcf2eeea34ddb..330ded65a5b820 100644
--- a/src/plugins/share/public/url_service/redirect/redirect_manager.ts
+++ b/src/plugins/share/public/url_service/redirect/redirect_manager.ts
@@ -34,7 +34,11 @@ export class RedirectManager {
       chromeless: true,
       mount: async (params) => {
         const { render } = await import('./render');
-        const unmount = render(params.element, { manager: this, theme: core.theme });
+        const unmount = render(params.element, {
+          manager: this,
+          theme: core.theme,
+          customBranding: core.customBranding,
+        });
         this.onMount(params.history.location);
         return () => {
           unmount();
diff --git a/src/plugins/share/tsconfig.json b/src/plugins/share/tsconfig.json
index f0d79515d0dcf0..914c4661d0eade 100644
--- a/src/plugins/share/tsconfig.json
+++ b/src/plugins/share/tsconfig.json
@@ -12,6 +12,7 @@
     "@kbn/i18n",
     "@kbn/i18n-react",
     "@kbn/config-schema",
+    "@kbn/core-custom-branding-browser",
   ],
   "exclude": [
     "target/**/*",

From afb84dcbcd99c6d754b5e1ff4691adc7bed6a90e Mon Sep 17 00:00:00 2001
From: James Gowdy <jgowdy@elastic.co>
Date: Tue, 24 Jan 2023 07:58:42 +0000
Subject: [PATCH 36/54] [ML] Adding ML execution context to es requests
 (#148746)

Adds the page path as the ID to our existing execution context and adds
an additional context entry to every ml kibana endpoint.
In the search slow log, the id for each slow search from ML will look
like this:


`"a90d5297-fd77-4ea0-ac0d-c302963d7e75;kibana:application:ml:%2Fjobs%2Fnew_job%2Fsingle_metric;application:ml:%2Fapi%2Fml%2Fjobs%2Fnew_job_line_chart`

Separating by semicolon:
`a90d5297-fd77-4ea0-ac0d-c302963d7e75` -> kibana ID

`kibana:application:ml:%2Fjobs%2Fnew_job%2Fsingle_metric` -> default
context items added on the client side to show the source page.

`application:ml:%2Fapi%2Fml%2Fjobs%2Fnew_job_line_chart` -> new items
added by the server to show the source endpoint path.

Note, the paths have been encoded to replace the forward slashes.

Part of https://github.com/elastic/kibana/issues/147378
---
 .../application/routing/use_active_route.tsx  |  1 +
 x-pack/plugins/ml/server/lib/route_guard.ts   | 57 +++++++++++++------
 x-pack/plugins/ml/server/plugin.ts            |  3 +-
 3 files changed, 44 insertions(+), 17 deletions(-)

diff --git a/x-pack/plugins/ml/public/application/routing/use_active_route.tsx b/x-pack/plugins/ml/public/application/routing/use_active_route.tsx
index cf5f43843dbe29..d3dd543f3ecdb7 100644
--- a/x-pack/plugins/ml/public/application/routing/use_active_route.tsx
+++ b/x-pack/plugins/ml/public/application/routing/use_active_route.tsx
@@ -96,6 +96,7 @@ export const useActiveRoute = (routesList: MlRoute[]): MlRoute => {
     name: PLUGIN_ID,
     type: 'application',
     page: activeRoute?.path ?? '/overview',
+    id: activeRoute?.path,
   });
 
   return activeRoute ?? routesMap['/overview'];
diff --git a/x-pack/plugins/ml/server/lib/route_guard.ts b/x-pack/plugins/ml/server/lib/route_guard.ts
index fa3fb88a109bbe..734ea877ba1850 100644
--- a/x-pack/plugins/ml/server/lib/route_guard.ts
+++ b/x-pack/plugins/ml/server/lib/route_guard.ts
@@ -12,6 +12,8 @@ import type {
   IScopedClusterClient,
   RequestHandler,
   SavedObjectsClientContract,
+  CoreSetup,
+  CoreStart,
 } from '@kbn/core/server';
 import type { SpacesPluginSetup } from '@kbn/spaces-plugin/server';
 import type { SecurityPluginSetup } from '@kbn/security-plugin/server';
@@ -19,6 +21,7 @@ import type { SecurityPluginSetup } from '@kbn/security-plugin/server';
 import type { AlertingApiRequestHandlerContext } from '@kbn/alerting-plugin/server';
 import type { PluginStart as DataViewsPluginStart } from '@kbn/data-views-plugin/server';
 import type { DataViewsService } from '@kbn/data-views-plugin/common';
+import { PLUGIN_ID } from '../../common/constants/app';
 import { mlSavedObjectServiceFactory, MLSavedObjectService } from '../saved_objects';
 import type { MlLicense } from '../../common/license';
 
@@ -51,6 +54,7 @@ export class RouteGuard {
   private _authorization: SecurityPluginSetup['authz'] | undefined;
   private _isMlReady: () => Promise<void>;
   private _getDataViews: GetDataViews;
+  private _getStartServices: CoreSetup['getStartServices'];
 
   constructor(
     mlLicense: MlLicense,
@@ -59,7 +63,8 @@ export class RouteGuard {
     spacesPlugin: SpacesPluginSetup | undefined,
     authorization: SecurityPluginSetup['authz'] | undefined,
     isMlReady: () => Promise<void>,
-    getDataViews: GetDataViews
+    getDataViews: GetDataViews,
+    getStartServices: CoreSetup['getStartServices']
   ) {
     this._mlLicense = mlLicense;
     this._getMlSavedObjectClient = getSavedObject;
@@ -68,6 +73,7 @@ export class RouteGuard {
     this._authorization = authorization;
     this._isMlReady = isMlReady;
     this._getDataViews = getDataViews;
+    this._getStartServices = getStartServices;
   }
 
   public fullLicenseAPIGuard<P, Q, B>(handler: Handler<P, Q, B>) {
@@ -88,8 +94,11 @@ export class RouteGuard {
         return response.forbidden();
       }
 
-      const { elasticsearch, savedObjects } = await context.core;
-      const client = elasticsearch.client;
+      const {
+        elasticsearch: { client },
+        savedObjects: { client: savedObjectClient },
+      } = await context.core;
+
       const mlSavedObjectClient = this._getMlSavedObjectClient(request);
       const internalSavedObjectsClient = this._getInternalSavedObjectClient();
       if (mlSavedObjectClient === null || internalSavedObjectsClient === null) {
@@ -107,20 +116,36 @@ export class RouteGuard {
         this._isMlReady
       );
 
-      return handler({
-        client,
-        request,
-        response,
-        context,
-        mlSavedObjectService,
-        mlClient: getMlClient(client, mlSavedObjectService),
-        getDataViewsService: getDataViewsServiceFactory(
-          this._getDataViews,
-          savedObjects.client,
+      const [coreStart] = await this._getStartServices();
+      const executionContext = await createExecutionContext(coreStart, request.route.path);
+
+      return await coreStart.executionContext.withContext(executionContext, () =>
+        handler({
           client,
-          request
-        ),
-      });
+          request,
+          response,
+          context,
+          mlSavedObjectService,
+          mlClient: getMlClient(client, mlSavedObjectService),
+          getDataViewsService: getDataViewsServiceFactory(
+            this._getDataViews,
+            savedObjectClient,
+            client,
+            request
+          ),
+        })
+      );
     };
   }
 }
+
+async function createExecutionContext(coreStart: CoreStart, id?: string) {
+  const labels = coreStart.executionContext.getAsLabels();
+  const page = labels.page as string;
+  return {
+    type: 'application',
+    name: PLUGIN_ID,
+    id: id ?? page,
+    page,
+  };
+}
diff --git a/x-pack/plugins/ml/server/plugin.ts b/x-pack/plugins/ml/server/plugin.ts
index 34a578d909f64b..fc12a261031ef4 100644
--- a/x-pack/plugins/ml/server/plugin.ts
+++ b/x-pack/plugins/ml/server/plugin.ts
@@ -198,7 +198,8 @@ export class MlServerPlugin
         plugins.spaces,
         plugins.security?.authz,
         () => this.isMlReady,
-        () => this.dataViews
+        () => this.dataViews,
+        coreSetup.getStartServices
       ),
       mlLicense: this.mlLicense,
     };

From 611e5af179a4c0ae3ff4094d2a3e0bf315cbbe72 Mon Sep 17 00:00:00 2001
From: Julian Gernun <17549662+jcger@users.noreply.github.com>
Date: Tue, 24 Jan 2023 09:04:00 +0100
Subject: [PATCH 37/54] renderCustomActionsRow with named params instead of
 args (#149304)

## Summary

Closes https://github.com/elastic/kibana/issues/149303

## QA

Run the alerts table and check that the actions cell is working.


https://user-images.githubusercontent.com/17549662/214009339-afc1fe7f-fb2a-4461-aec9-70a2335a875b.mov
---
 .../containers/alerts_table/get_row_actions.tsx    |  7 ++-----
 .../sections/alerts_table/alerts_table.test.tsx    |  4 ++--
 .../sections/alerts_table/alerts_table.tsx         | 12 ++++++------
 x-pack/plugins/triggers_actions_ui/public/types.ts | 14 ++++++++------
 4 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/x-pack/plugins/observability/public/pages/alerts/containers/alerts_table/get_row_actions.tsx b/x-pack/plugins/observability/public/pages/alerts/containers/alerts_table/get_row_actions.tsx
index 74a5e7ac7ec115..419743228a8a47 100644
--- a/x-pack/plugins/observability/public/pages/alerts/containers/alerts_table/get_row_actions.tsx
+++ b/x-pack/plugins/observability/public/pages/alerts/containers/alerts_table/get_row_actions.tsx
@@ -6,6 +6,7 @@
  */
 import React from 'react';
 import { EcsFieldsResponse } from '@kbn/rule-registry-plugin/common/search_strategy';
+import { RenderCustomActionsRowArgs } from '@kbn/triggers-actions-ui-plugin/public/types';
 import { ObservabilityRuleTypeRegistry } from '../../../../rules/create_observability_rule_type_registry';
 import { ObservabilityActions } from '../../components/observability_actions';
 import type { ObservabilityActionsProps } from '../../components/observability_actions';
@@ -22,11 +23,7 @@ export const getRowActions = (
   config: ConfigSchema
 ) => {
   return () => ({
-    renderCustomActionsRow: (
-      alert: EcsFieldsResponse,
-      setFlyoutAlert: (data: unknown, id?: string) => void,
-      id?: string
-    ) => {
+    renderCustomActionsRow: ({ alert, setFlyoutAlert, id }: RenderCustomActionsRowArgs) => {
       return (
         <ObservabilityActions
           data={buildData(alert)}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.test.tsx
index d283526c9b55b3..6b0d289050f518 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.test.tsx
@@ -322,7 +322,7 @@ describe('AlertsTable', () => {
           fireEvent.click((await screen.findAllByTestId('testActionColumn'))[0]);
 
           // the callback given to our clients to run when they want to update the loading state
-          mockedFn.mock.calls[0][3](true);
+          mockedFn.mock.calls[0][0].setIsActionLoading(true);
 
           expect(await screen.findAllByTestId('row-loader')).toHaveLength(1);
           const selectedOptions = await screen.findAllByTestId('dataGridRowCell');
@@ -351,7 +351,7 @@ describe('AlertsTable', () => {
           fireEvent.click((await screen.findAllByTestId('testActionColumn'))[0]);
 
           // the callback given to our clients to run when they want to update the loading state
-          mockedFn.mock.calls[0][3](false);
+          mockedFn.mock.calls[0][0].setIsActionLoading(false);
 
           expect(screen.queryByTestId('row-loader')).not.toBeInTheDocument();
         });
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx
index 288ca1f6259547..22b3d4f87008e9 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_table/alerts_table.tsx
@@ -173,12 +173,12 @@ const AlertsTable: React.FunctionComponent<AlertsTableProps> = (props: AlertsTab
                 )}
                 {renderCustomActionsRow &&
                   alerts[visibleRowIndex] &&
-                  renderCustomActionsRow(
-                    alerts[visibleRowIndex],
-                    handleFlyoutAlert,
-                    props.id,
-                    getSetIsActionLoadingCallback(visibleRowIndex)
-                  )}
+                  renderCustomActionsRow({
+                    alert: alerts[visibleRowIndex],
+                    setFlyoutAlert: handleFlyoutAlert,
+                    id: props.id,
+                    setIsActionLoading: getSetIsActionLoadingCallback(visibleRowIndex),
+                  })}
               </EuiFlexGroup>
             );
           },
diff --git a/x-pack/plugins/triggers_actions_ui/public/types.ts b/x-pack/plugins/triggers_actions_ui/public/types.ts
index d35db04f58b886..a9ccf210abe385 100644
--- a/x-pack/plugins/triggers_actions_ui/public/types.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/types.ts
@@ -518,13 +518,15 @@ export interface BulkActionsConfig {
   ) => void;
 }
 
+export interface RenderCustomActionsRowArgs {
+  alert: EcsFieldsResponse;
+  setFlyoutAlert: (data: unknown) => void;
+  id?: string;
+  setIsActionLoading?: (isLoading: boolean) => void;
+}
+
 export type UseActionsColumnRegistry = () => {
-  renderCustomActionsRow: (
-    alert: EcsFieldsResponse,
-    setFlyoutAlert: (data: unknown) => void,
-    id?: string,
-    setIsActionLoading?: (isLoading: boolean) => void
-  ) => JSX.Element;
+  renderCustomActionsRow: (args: RenderCustomActionsRowArgs) => JSX.Element;
   width?: number;
 };
 

From 95c2493e77abc47f93c639e5e17fc2d5833ff6dc Mon Sep 17 00:00:00 2001
From: LEE SEUNGHYO <64775829+dawn023349@users.noreply.github.com>
Date: Tue, 24 Jan 2023 17:29:11 +0900
Subject: [PATCH 38/54] [Dashboard] Fix Phrase_filter query for scripted fields
 (#148942) (#148943)

- ISSUE [Dashboard] Visualize Library doesn't work filter on scripted
fields of Array Type. #148942

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Lukas Olson <lukas@elastic.co>
---
 .../src/filters/build_filters/phrase_filter.test.ts             | 2 +-
 .../kbn-es-query/src/filters/build_filters/phrase_filter.ts     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/kbn-es-query/src/filters/build_filters/phrase_filter.test.ts b/packages/kbn-es-query/src/filters/build_filters/phrase_filter.test.ts
index 1088ba196840c2..f2fc685b2e1806 100644
--- a/packages/kbn-es-query/src/filters/build_filters/phrase_filter.test.ts
+++ b/packages/kbn-es-query/src/filters/build_filters/phrase_filter.test.ts
@@ -134,7 +134,7 @@ describe('buildInlineScriptForPhraseFilter', () => {
     };
 
     const expected =
-      `boolean compare(Supplier s, def v) {return s.get() == v;}` +
+      `boolean compare(Supplier s, def v) {if(s.get() instanceof List){List list = s.get(); for(def k : list){if(k==v){return true;}}return false;}else{return s.get() == v;}}` +
       `compare(() -> { return foo; }, params.value);`;
 
     expect(buildInlineScriptForPhraseFilter(field)).toBe(expected);
diff --git a/packages/kbn-es-query/src/filters/build_filters/phrase_filter.ts b/packages/kbn-es-query/src/filters/build_filters/phrase_filter.ts
index 3bbf94cd0722a2..4adc8fdc0fdd43 100644
--- a/packages/kbn-es-query/src/filters/build_filters/phrase_filter.ts
+++ b/packages/kbn-es-query/src/filters/build_filters/phrase_filter.ts
@@ -148,7 +148,7 @@ export const buildInlineScriptForPhraseFilter = (scriptedField: DataViewFieldBas
   // We must wrap painless scripts in a lambda in case they're more than a simple expression
   if (scriptedField.lang === 'painless') {
     return (
-      `boolean compare(Supplier s, def v) {return s.get() == v;}` +
+      `boolean compare(Supplier s, def v) {if(s.get() instanceof List){List list = s.get(); for(def k : list){if(k==v){return true;}}return false;}else{return s.get() == v;}}` +
       `compare(() -> { ${scriptedField.script} }, params.value);`
     );
   } else {

From 199f115916b6dd9d47055001d3414f24fdb19fa9 Mon Sep 17 00:00:00 2001
From: Katerina Patticha <aikaterini.patticha@elastic.co>
Date: Tue, 24 Jan 2023 09:30:43 +0100
Subject: [PATCH 39/54] [APM] Fix mobile indices (#149230)

## Summary

Refactor mobile endpoints and fix indices
- rename `getSessionsChart` to `getMobileSessions`
- rename `getHttpRequestsChart` to `getMobileHttpRequests`
- split queries for `mobile_stats` instead of queries all indices.
Extend `getMobileSessions` and `getMobileHttpRequests` so they can be
used in `mobile_stats`
- remove the metrics 'crashCount` and `maxLoadTime` since they are not
captured yet

related: https://github.com/elastic/kibana/issues/146615

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../app/mobile/charts/http_requests_chart.tsx |   8 +-
 .../app/mobile/charts/sessions_chart.tsx      |   8 +-
 .../mobile/service_overview/stats/index.tsx   |  16 +-
 .../routes/mobile/get_mobile_filters.ts       |   7 +-
 ...s_chart.ts => get_mobile_http_requests.ts} |  47 +++--
 ...ssions_chart.ts => get_mobile_sessions.ts} |  53 +++--
 .../server/routes/mobile/get_mobile_stats.ts  | 199 ++++++++----------
 .../plugins/apm/server/routes/mobile/route.ts |  16 +-
 ...> mobile_http_requests_timeseries.spec.ts} |  34 +--
 ....ts => mobile_sessions_timeseries.spec.ts} |  58 ++---
 .../tests/mobile/mobile_stats.spec.ts         |  74 ++-----
 11 files changed, 229 insertions(+), 291 deletions(-)
 rename x-pack/plugins/apm/server/routes/mobile/{get_http_requests_chart.ts => get_mobile_http_requests.ts} (78%)
 rename x-pack/plugins/apm/server/routes/mobile/{get_sessions_chart.ts => get_mobile_sessions.ts} (77%)
 rename x-pack/test/apm_api_integration/tests/mobile/{mobile_http_requests_chart.spec.ts => mobile_http_requests_timeseries.spec.ts} (78%)
 rename x-pack/test/apm_api_integration/tests/mobile/{mobile_sessions_chart.spec.ts => mobile_sessions_timeseries.spec.ts} (71%)

diff --git a/x-pack/plugins/apm/public/components/app/mobile/charts/http_requests_chart.tsx b/x-pack/plugins/apm/public/components/app/mobile/charts/http_requests_chart.tsx
index 0b530a6cc4e2c6..e625c94a9d167b 100644
--- a/x-pack/plugins/apm/public/components/app/mobile/charts/http_requests_chart.tsx
+++ b/x-pack/plugins/apm/public/components/app/mobile/charts/http_requests_chart.tsx
@@ -23,8 +23,8 @@ import {
 import { usePreviousPeriodLabel } from '../../../../hooks/use_previous_period_text';
 
 const INITIAL_STATE = {
-  currentPeriod: [],
-  previousPeriod: [],
+  currentPeriod: { timeseries: [] },
+  previousPeriod: { timeseries: [] },
 };
 
 export function HttpRequestsChart({
@@ -89,7 +89,7 @@ export function HttpRequestsChart({
 
   const timeseries = [
     {
-      data: data.currentPeriod,
+      data: data.currentPeriod.timeseries,
       type: 'linemark',
       color: currentPeriodColor,
       title: i18n.translate('xpack.apm.transactions.httpRequestsTitle', {
@@ -99,7 +99,7 @@ export function HttpRequestsChart({
     ...(comparisonEnabled
       ? [
           {
-            data: data.previousPeriod,
+            data: data.previousPeriod.timeseries,
             type: 'area',
             color: previousPeriodColor,
             title: previousPeriodLabel,
diff --git a/x-pack/plugins/apm/public/components/app/mobile/charts/sessions_chart.tsx b/x-pack/plugins/apm/public/components/app/mobile/charts/sessions_chart.tsx
index 8c0b806cce6be4..cfbc9864e46120 100644
--- a/x-pack/plugins/apm/public/components/app/mobile/charts/sessions_chart.tsx
+++ b/x-pack/plugins/apm/public/components/app/mobile/charts/sessions_chart.tsx
@@ -24,8 +24,8 @@ import {
 import { usePreviousPeriodLabel } from '../../../../hooks/use_previous_period_text';
 
 const INITIAL_STATE = {
-  currentPeriod: [],
-  previousPeriod: [],
+  currentPeriod: { timeseries: [] },
+  previousPeriod: { timeseries: [] },
 };
 
 type SessionsChart =
@@ -95,7 +95,7 @@ export function SessionsChart({
 
   const timeseries = [
     {
-      data: data.currentPeriod,
+      data: data.currentPeriod.timeseries,
       type: 'linemark',
       color: currentPeriodColor,
       title: i18n.translate('xpack.apm.transactions.sessionsChartTitle', {
@@ -105,7 +105,7 @@ export function SessionsChart({
     ...(comparisonEnabled
       ? [
           {
-            data: data.previousPeriod,
+            data: data.previousPeriod.timeseries,
             type: 'area',
             color: previousPeriodColor,
             title: previousPeriodLabel,
diff --git a/x-pack/plugins/apm/public/components/app/mobile/service_overview/stats/index.tsx b/x-pack/plugins/apm/public/components/app/mobile/service_overview/stats/index.tsx
index 744cfb13f3c75a..d94e988ba6d71a 100644
--- a/x-pack/plugins/apm/public/components/app/mobile/service_overview/stats/index.tsx
+++ b/x-pack/plugins/apm/public/components/app/mobile/service_overview/stats/index.tsx
@@ -74,9 +74,9 @@ export function MobileStats({
         defaultMessage: 'Crash Rate',
       }),
       icon: getIcon('bug'),
-      value: data?.crashCount?.value ?? NaN,
+      value: 'N/A',
       valueFormatter: (value: number) => valueFormatter(value, 'cpm'),
-      trend: data?.maxLoadTime?.timeseries,
+      trend: [],
       trendShape: MetricTrendShape.Area,
     },
     {
@@ -85,9 +85,9 @@ export function MobileStats({
         defaultMessage: 'Slowest App load time',
       }),
       icon: getIcon('visGauge'),
-      value: data?.maxLoadTime?.value ?? NaN,
+      value: 'N/A',
       valueFormatter: (value: number) => valueFormatter(value, 's'),
-      trend: data?.maxLoadTime.timeseries,
+      trend: [],
       trendShape: MetricTrendShape.Area,
     },
     {
@@ -96,9 +96,9 @@ export function MobileStats({
         defaultMessage: 'Sessions',
       }),
       icon: getIcon('timeslider'),
-      value: data?.sessions?.value ?? NaN,
+      value: data?.currentPeriod?.sessions?.value ?? NaN,
       valueFormatter: (value: number) => valueFormatter(value),
-      trend: data?.sessions.timeseries,
+      trend: data?.currentPeriod?.sessions?.timeseries,
       trendShape: MetricTrendShape.Area,
     },
     {
@@ -107,9 +107,9 @@ export function MobileStats({
         defaultMessage: 'HTTP requests',
       }),
       icon: getIcon('kubernetesPod'),
-      value: data?.requests?.value ?? NaN,
+      value: data?.currentPeriod?.requests?.value ?? NaN,
       valueFormatter: (value: number) => valueFormatter(value),
-      trend: data?.requests.timeseries,
+      trend: data?.currentPeriod?.requests?.timeseries ?? [],
       trendShape: MetricTrendShape.Area,
     },
   ];
diff --git a/x-pack/plugins/apm/server/routes/mobile/get_mobile_filters.ts b/x-pack/plugins/apm/server/routes/mobile/get_mobile_filters.ts
index cc648513a896a6..ff6292eddb27a6 100644
--- a/x-pack/plugins/apm/server/routes/mobile/get_mobile_filters.ts
+++ b/x-pack/plugins/apm/server/routes/mobile/get_mobile_filters.ts
@@ -52,12 +52,7 @@ export async function getMobileFilters({
 }): Promise<MobileFilters> {
   const response = await apmEventClient.search('get_mobile_filters', {
     apm: {
-      events: [
-        ProcessorEvent.error,
-        ProcessorEvent.metric,
-        ProcessorEvent.transaction,
-        ProcessorEvent.span,
-      ],
+      events: [ProcessorEvent.transaction],
     },
     body: {
       track_total_hits: false,
diff --git a/x-pack/plugins/apm/server/routes/mobile/get_http_requests_chart.ts b/x-pack/plugins/apm/server/routes/mobile/get_mobile_http_requests.ts
similarity index 78%
rename from x-pack/plugins/apm/server/routes/mobile/get_http_requests_chart.ts
rename to x-pack/plugins/apm/server/routes/mobile/get_mobile_http_requests.ts
index e1e9ef59c94e83..d2c7abe691d7a5 100644
--- a/x-pack/plugins/apm/server/routes/mobile/get_http_requests_chart.ts
+++ b/x-pack/plugins/apm/server/routes/mobile/get_mobile_http_requests.ts
@@ -15,6 +15,7 @@ import {
   SERVICE_NAME,
   TRANSACTION_NAME,
   SERVICE_TARGET_TYPE,
+  METRICSET_NAME,
 } from '../../../common/es_fields/apm';
 import { environmentQuery } from '../../../common/utils/environment_query';
 import { getOffsetInMs } from '../../../common/utils/get_offset_in_ms';
@@ -22,10 +23,11 @@ import { offsetPreviousPeriodCoordinates } from '../../../common/utils/offset_pr
 import { APMEventClient } from '../../lib/helpers/create_es_client/create_apm_event_client';
 import { getBucketSize } from '../../lib/helpers/get_bucket_size';
 import { Coordinate } from '../../../typings/timeseries';
+import { Maybe } from '../../../typings/common';
 
 export interface HttpRequestsTimeseries {
-  currentPeriod: Coordinate[];
-  previousPeriod: Coordinate[];
+  currentPeriod: { timeseries: Coordinate[]; value: Maybe<number> };
+  previousPeriod: { timeseries: Coordinate[]; value: Maybe<number> };
 }
 interface Props {
   apmEventClient: APMEventClient;
@@ -60,6 +62,12 @@ async function getHttpRequestsTimeseries({
     minBucketSize: 60,
   });
 
+  const aggs = {
+    requests: {
+      filter: { term: { [SERVICE_TARGET_TYPE]: 'http' } },
+    },
+  };
+
   const response = await apmEventClient.search('get_http_requests_chart', {
     apm: { events: [ProcessorEvent.metric] },
     body: {
@@ -69,6 +77,7 @@ async function getHttpRequestsTimeseries({
         bool: {
           filter: [
             { exists: { field: SERVICE_TARGET_TYPE } },
+            ...termQuery(METRICSET_NAME, 'service_destination'),
             ...termQuery(SERVICE_NAME, serviceName),
             ...termQuery(TRANSACTION_NAME, transactionName),
             ...rangeQuery(startWithOffset, endWithOffset),
@@ -85,27 +94,28 @@ async function getHttpRequestsTimeseries({
             min_doc_count: 0,
             extended_bounds: { min: startWithOffset, max: endWithOffset },
           },
-          aggs: {
-            requests: {
-              filter: { term: { [SERVICE_TARGET_TYPE]: 'http' } },
-            },
-          },
+          aggs,
         },
+        ...aggs,
       },
     },
   });
 
-  return (
+  const timeseries =
     response?.aggregations?.timeseries.buckets.map((bucket) => {
       return {
         x: bucket.key,
-        y: bucket.doc_count ?? 0,
+        y: bucket.requests.doc_count,
       };
-    }) ?? []
-  );
+    }) ?? [];
+
+  return {
+    timeseries,
+    value: response.aggregations?.requests?.doc_count,
+  };
 }
 
-export async function getHttpRequestsChart({
+export async function getMobileHttpRequests({
   kuery,
   apmEventClient,
   serviceName,
@@ -136,7 +146,7 @@ export async function getHttpRequestsChart({
         end,
         offset,
       })
-    : [];
+    : { timeseries: [], value: null };
 
   const [currentPeriod, previousPeriod] = await Promise.all([
     currentPeriodPromise,
@@ -145,9 +155,12 @@ export async function getHttpRequestsChart({
 
   return {
     currentPeriod,
-    previousPeriod: offsetPreviousPeriodCoordinates({
-      currentPeriodTimeseries: currentPeriod,
-      previousPeriodTimeseries: previousPeriod,
-    }),
+    previousPeriod: {
+      timeseries: offsetPreviousPeriodCoordinates({
+        currentPeriodTimeseries: currentPeriod.timeseries,
+        previousPeriodTimeseries: previousPeriod.timeseries,
+      }),
+      value: previousPeriod?.value,
+    },
   };
 }
diff --git a/x-pack/plugins/apm/server/routes/mobile/get_sessions_chart.ts b/x-pack/plugins/apm/server/routes/mobile/get_mobile_sessions.ts
similarity index 77%
rename from x-pack/plugins/apm/server/routes/mobile/get_sessions_chart.ts
rename to x-pack/plugins/apm/server/routes/mobile/get_mobile_sessions.ts
index 874743af633421..3414a91b00c2f3 100644
--- a/x-pack/plugins/apm/server/routes/mobile/get_sessions_chart.ts
+++ b/x-pack/plugins/apm/server/routes/mobile/get_mobile_sessions.ts
@@ -22,10 +22,11 @@ import { getOffsetInMs } from '../../../common/utils/get_offset_in_ms';
 import { APMEventClient } from '../../lib/helpers/create_es_client/create_apm_event_client';
 import { getBucketSize } from '../../lib/helpers/get_bucket_size';
 import { Coordinate } from '../../../typings/timeseries';
+import { Maybe } from '../../../typings/common';
 
 export interface SessionsTimeseries {
-  currentPeriod: Coordinate[];
-  previousPeriod: Coordinate[];
+  currentPeriod: { timeseries: Coordinate[]; value: Maybe<number> };
+  previousPeriod: { timeseries: Coordinate[]; value: Maybe<number> };
 }
 
 interface Props {
@@ -61,13 +62,15 @@ async function getSessionTimeseries({
     minBucketSize: 60,
   });
 
-  const response = await apmEventClient.search('get_sessions_chart', {
+  const aggs = {
+    sessions: {
+      cardinality: { field: SESSION_ID },
+    },
+  };
+
+  const response = await apmEventClient.search('get_mobile_sessions', {
     apm: {
-      events: [
-        ProcessorEvent.transaction,
-        ProcessorEvent.error,
-        ProcessorEvent.span,
-      ],
+      events: [ProcessorEvent.transaction],
     },
     body: {
       track_total_hits: false,
@@ -92,27 +95,28 @@ async function getSessionTimeseries({
             min_doc_count: 0,
             extended_bounds: { min: startWithOffset, max: endWithOffset },
           },
-          aggs: {
-            sessions: {
-              cardinality: { field: SESSION_ID },
-            },
-          },
+          aggs,
         },
+        ...aggs,
       },
     },
   });
 
-  return (
+  const timeseries =
     response?.aggregations?.timeseries.buckets.map((bucket) => {
       return {
         x: bucket.key,
-        y: bucket.doc_count ?? 0,
+        y: bucket.sessions.value,
       };
-    }) ?? []
-  );
+    }) ?? [];
+
+  return {
+    timeseries,
+    value: response.aggregations?.sessions?.value,
+  };
 }
 
-export async function getSessionsChart({
+export async function getMobileSessions({
   kuery,
   apmEventClient,
   serviceName,
@@ -143,7 +147,7 @@ export async function getSessionsChart({
         end,
         offset,
       })
-    : [];
+    : { timeseries: [], value: null };
 
   const [currentPeriod, previousPeriod] = await Promise.all([
     currentPeriodPromise,
@@ -152,9 +156,12 @@ export async function getSessionsChart({
 
   return {
     currentPeriod,
-    previousPeriod: offsetPreviousPeriodCoordinates({
-      currentPeriodTimeseries: currentPeriod,
-      previousPeriodTimeseries: previousPeriod,
-    }),
+    previousPeriod: {
+      timeseries: offsetPreviousPeriodCoordinates({
+        currentPeriodTimeseries: currentPeriod.timeseries,
+        previousPeriodTimeseries: previousPeriod.timeseries,
+      }),
+      value: previousPeriod?.value,
+    },
   };
 }
diff --git a/x-pack/plugins/apm/server/routes/mobile/get_mobile_stats.ts b/x-pack/plugins/apm/server/routes/mobile/get_mobile_stats.ts
index e37f4ec9616c85..70d51360ff89d3 100644
--- a/x-pack/plugins/apm/server/routes/mobile/get_mobile_stats.ts
+++ b/x-pack/plugins/apm/server/routes/mobile/get_mobile_stats.ts
@@ -5,140 +5,117 @@
  * 2.0.
  */
 
-import {
-  termQuery,
-  kqlQuery,
-  rangeQuery,
-} from '@kbn/observability-plugin/server';
-import { ProcessorEvent } from '@kbn/observability-plugin/common';
-import {
-  SERVICE_NAME,
-  SESSION_ID,
-  SERVICE_TARGET_TYPE,
-  APP_LAUNCH_TIME,
-  EVENT_NAME,
-} from '../../../common/es_fields/apm';
-import { environmentQuery } from '../../../common/utils/environment_query';
 import { APMEventClient } from '../../lib/helpers/create_es_client/create_apm_event_client';
-import { getBucketSize } from '../../lib/helpers/get_bucket_size';
+import { getOffsetInMs } from '../../../common/utils/get_offset_in_ms';
+import { getMobileSessions } from './get_mobile_sessions';
+import { getMobileHttpRequests } from './get_mobile_http_requests';
+import { Maybe } from '../../../typings/common';
 
-type Timeseries = Array<{ x: number; y: number }>;
-export interface MobileStats {
-  sessions: { value?: number; timeseries: Timeseries };
-  requests: { value?: number | null; timeseries: Timeseries };
-  maxLoadTime: { value?: number | null; timeseries: Timeseries };
-  crashCount: { value?: number | null; timeseries: Timeseries };
+export interface Timeseries {
+  x: number;
+  y: number;
+}
+interface MobileStats {
+  sessions: { timeseries: Timeseries[]; value: Maybe<number> };
+  requests: { timeseries: Timeseries[]; value: Maybe<number> };
 }
 
-export async function getMobileStats({
-  kuery,
-  apmEventClient,
-  serviceName,
-  transactionType,
-  environment,
-  start,
-  end,
-}: {
+export interface MobilePeriodStats {
+  currentPeriod: MobileStats;
+  previousPeriod: MobileStats;
+}
+
+interface Props {
   kuery: string;
   apmEventClient: APMEventClient;
   serviceName: string;
-  transactionType?: string;
   environment: string;
   start: number;
   end: number;
-}): Promise<MobileStats> {
-  const { intervalString } = getBucketSize({
+  offset?: string;
+}
+
+async function getMobileStats({
+  kuery,
+  apmEventClient,
+  serviceName,
+  environment,
+  start,
+  end,
+  offset,
+}: Props): Promise<MobileStats> {
+  const { startWithOffset, endWithOffset } = getOffsetInMs({
     start,
     end,
-    minBucketSize: 60,
+    offset,
   });
 
-  const aggs = {
+  const commonProps = {
+    kuery,
+    apmEventClient,
+    serviceName,
+    environment,
+    start: startWithOffset,
+    end: endWithOffset,
+    offset,
+  };
+
+  const [sessions, httpRequests] = await Promise.all([
+    getMobileSessions({ ...commonProps }),
+    getMobileHttpRequests({ ...commonProps }),
+  ]);
+
+  return {
     sessions: {
-      cardinality: { field: SESSION_ID },
+      value: sessions.currentPeriod.value,
+      timeseries: sessions.currentPeriod.timeseries as Timeseries[],
     },
     requests: {
-      filter: { term: { [SERVICE_TARGET_TYPE]: 'http' } },
-    },
-    maxLoadTime: {
-      max: { field: APP_LAUNCH_TIME },
-    },
-    crashCount: {
-      filter: { term: { [EVENT_NAME]: 'crash' } },
+      value: httpRequests.currentPeriod.value,
+      timeseries: httpRequests.currentPeriod.timeseries as Timeseries[],
     },
   };
+}
 
-  const response = await apmEventClient.search('get_mobile_stats', {
-    apm: {
-      events: [
-        ProcessorEvent.error,
-        ProcessorEvent.metric,
-        ProcessorEvent.transaction,
-        ProcessorEvent.span,
-      ],
-    },
-    body: {
-      track_total_hits: false,
-      size: 0,
-      query: {
-        bool: {
-          filter: [
-            ...termQuery(SERVICE_NAME, serviceName),
-            ...rangeQuery(start, end),
-            ...environmentQuery(environment),
-            ...kqlQuery(kuery),
-          ],
-        },
-      },
-      aggs: {
-        timeseries: {
-          date_histogram: {
-            field: '@timestamp',
-            fixed_interval: intervalString,
-            min_doc_count: 0,
-          },
-          aggs,
-        },
-        ...aggs,
-      },
-    },
+export async function getMobileStatsPeriods({
+  kuery,
+  apmEventClient,
+  serviceName,
+  environment,
+  start,
+  end,
+  offset,
+}: Props): Promise<MobilePeriodStats> {
+  const commonProps = {
+    kuery,
+    apmEventClient,
+    serviceName,
+    environment,
+    start,
+    end,
+  };
+
+  const currentPeriodPromise = getMobileStats({
+    ...commonProps,
   });
 
-  const durationAsMinutes = (end - start) / 1000 / 60;
+  const previousPeriodPromise = offset
+    ? getMobileStats({
+        ...commonProps,
+        offset,
+      })
+    : {
+        sessions: { timeseries: [], value: null },
+        requests: { timeseries: [], value: null },
+      };
+
+  const [currentPeriod, previousPeriod] = await Promise.all([
+    currentPeriodPromise,
+    previousPeriodPromise,
+  ]);
 
   return {
-    sessions: {
-      value: response.aggregations?.sessions?.value,
-      timeseries:
-        response.aggregations?.timeseries?.buckets.map((bucket) => ({
-          x: bucket.key,
-          y: bucket.sessions.value ?? 0,
-        })) ?? [],
-    },
-    requests: {
-      value: response.aggregations?.requests?.doc_count,
-      timeseries:
-        response.aggregations?.timeseries?.buckets.map((bucket) => ({
-          x: bucket.key,
-          y: bucket.requests.doc_count ?? 0,
-        })) ?? [],
-    },
-    maxLoadTime: {
-      value: response.aggregations?.maxLoadTime?.value,
-      timeseries:
-        response.aggregations?.timeseries?.buckets.map((bucket) => ({
-          x: bucket.key,
-          y: bucket.maxLoadTime?.value ?? 0,
-        })) ?? [],
-    },
-    crashCount: {
-      value:
-        response.aggregations?.crashCount?.doc_count ?? 0 / durationAsMinutes,
-      timeseries:
-        response.aggregations?.timeseries?.buckets.map((bucket) => ({
-          x: bucket.key,
-          y: bucket.crashCount.doc_count ?? 0,
-        })) ?? [],
-    },
+    currentPeriod,
+    previousPeriod,
   };
 }
diff --git a/x-pack/plugins/apm/server/routes/mobile/route.ts b/x-pack/plugins/apm/server/routes/mobile/route.ts
index e18e7cae75c877..e8fe0515f11c8e 100644
--- a/x-pack/plugins/apm/server/routes/mobile/route.ts
+++ b/x-pack/plugins/apm/server/routes/mobile/route.ts
@@ -11,12 +11,12 @@ import { createApmServerRoute } from '../apm_routes/create_apm_server_route';
 import { environmentRt, kueryRt, rangeRt } from '../default_api_types';
 import { offsetRt } from '../../../common/comparison_rt';
 import {
-  getHttpRequestsChart,
+  getMobileHttpRequests,
   HttpRequestsTimeseries,
-} from './get_http_requests_chart';
+} from './get_mobile_http_requests';
 import { getMobileFilters } from './get_mobile_filters';
-import { getSessionsChart, SessionsTimeseries } from './get_sessions_chart';
-import { getMobileStats, MobileStats } from './get_mobile_stats';
+import { getMobileSessions, SessionsTimeseries } from './get_mobile_sessions';
+import { getMobileStatsPeriods, MobilePeriodStats } from './get_mobile_stats';
 
 const mobileFiltersRoute = createApmServerRoute({
   endpoint: 'GET /internal/apm/services/{serviceName}/mobile/filters',
@@ -73,13 +73,13 @@ const mobileStatsRoute = createApmServerRoute({
     ]),
   }),
   options: { tags: ['access:apm'] },
-  handler: async (resources): Promise<MobileStats> => {
+  handler: async (resources): Promise<MobilePeriodStats> => {
     const apmEventClient = await getApmEventClient(resources);
     const { params } = resources;
     const { serviceName } = params.path;
     const { kuery, environment, start, end } = params.query;
 
-    const stats = await getMobileStats({
+    const stats = await getMobileStatsPeriods({
       kuery,
       environment,
       start,
@@ -118,7 +118,7 @@ const sessionsChartRoute = createApmServerRoute({
     const { kuery, environment, start, end, transactionName, offset } =
       params.query;
 
-    const { currentPeriod, previousPeriod } = await getSessionsChart({
+    const { currentPeriod, previousPeriod } = await getMobileSessions({
       kuery,
       environment,
       transactionName,
@@ -159,7 +159,7 @@ const httpRequestsChartRoute = createApmServerRoute({
     const { kuery, environment, start, end, transactionName, offset } =
       params.query;
 
-    const { currentPeriod, previousPeriod } = await getHttpRequestsChart({
+    const { currentPeriod, previousPeriod } = await getMobileHttpRequests({
       kuery,
       environment,
       transactionName,
diff --git a/x-pack/test/apm_api_integration/tests/mobile/mobile_http_requests_chart.spec.ts b/x-pack/test/apm_api_integration/tests/mobile/mobile_http_requests_timeseries.spec.ts
similarity index 78%
rename from x-pack/test/apm_api_integration/tests/mobile/mobile_http_requests_chart.spec.ts
rename to x-pack/test/apm_api_integration/tests/mobile/mobile_http_requests_timeseries.spec.ts
index 33467b486704f8..451a3d803d8c6f 100644
--- a/x-pack/test/apm_api_integration/tests/mobile/mobile_http_requests_chart.spec.ts
+++ b/x-pack/test/apm_api_integration/tests/mobile/mobile_http_requests_timeseries.spec.ts
@@ -51,8 +51,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     describe('when no data', () => {
       it('handles empty state', async () => {
         const response = await getHttpRequestsChart({ serviceName: 'foo' });
-        expect(response.body.currentPeriod).to.eql([]);
-        expect(response.body.previousPeriod).to.eql([]);
+        expect(response.body.currentPeriod.timeseries).to.eql([]);
+        expect(response.body.previousPeriod.timeseries).to.eql([]);
         expect(response.status).to.be(200);
       });
     });
@@ -75,11 +75,9 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
         expect(response.status).to.be(200);
         expect(
-          response.body.currentPeriod.some(
-            (item: { x: number; y?: number | null }) => item.y === 0 && item.x
-          )
+          response.body.currentPeriod.timeseries.some((item) => item.y === 0 && item.x)
         ).to.eql(true);
-        expect(response.body.previousPeriod[0].y).to.eql(0);
+        expect(response.body.previousPeriod.timeseries[0].y).to.eql(0);
       });
 
       it('returns only current period timeseries when offset is not available', async () => {
@@ -87,13 +85,11 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
         expect(response.status).to.be(200);
         expect(
-          response.body.currentPeriod.some(
-            (item: { x: number; y?: number | null }) => item.y === 0 && item.x
-          )
+          response.body.currentPeriod.timeseries.some((item) => item.y === 0 && item.x)
         ).to.eql(true);
 
-        expect(response.body.currentPeriod[0].y).to.eql(0);
-        expect(response.body.previousPeriod).to.eql([]);
+        expect(response.body.currentPeriod.timeseries[0].y).to.eql(0);
+        expect(response.body.previousPeriod.timeseries).to.eql([]);
       });
     });
 
@@ -106,16 +102,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         });
 
         expect(response.status).to.be(200);
-        expect(
-          response.body.currentPeriod.every(
-            (item: { x: number; y?: number | null }) => item.y === 0
-          )
-        ).to.eql(true);
-        expect(
-          response.body.previousPeriod.every(
-            (item: { x: number; y?: number | null }) => item.y === 0
-          )
-        ).to.eql(true);
+        expect(response.body.currentPeriod.timeseries.every((item) => item.y === 0)).to.eql(true);
+        expect(response.body.previousPeriod.timeseries.every((item) => item.y === 0)).to.eql(true);
       });
 
       it('returns the correct values when filter is applied', async () => {
@@ -133,8 +121,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
 
         expect(response.status).to.be(200);
         expect(ntcCell.status).to.be(200);
-        expect(response.body.currentPeriod[0].y).to.eql(0);
-        expect(ntcCell.body.currentPeriod[0].y).to.eql(0);
+        expect(response.body.currentPeriod.timeseries[0].y).to.eql(0);
+        expect(ntcCell.body.currentPeriod.timeseries[0].y).to.eql(0);
       });
     });
   });
diff --git a/x-pack/test/apm_api_integration/tests/mobile/mobile_sessions_chart.spec.ts b/x-pack/test/apm_api_integration/tests/mobile/mobile_sessions_timeseries.spec.ts
similarity index 71%
rename from x-pack/test/apm_api_integration/tests/mobile/mobile_sessions_chart.spec.ts
rename to x-pack/test/apm_api_integration/tests/mobile/mobile_sessions_timeseries.spec.ts
index fe3c9863af8d59..aeb6122cd7d165 100644
--- a/x-pack/test/apm_api_integration/tests/mobile/mobile_sessions_chart.spec.ts
+++ b/x-pack/test/apm_api_integration/tests/mobile/mobile_sessions_timeseries.spec.ts
@@ -51,8 +51,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     describe('when no data', () => {
       it('handles empty state', async () => {
         const response = await getSessionsChart({ serviceName: 'foo' });
-        expect(response.body.currentPeriod).to.eql([]);
-        expect(response.body.previousPeriod).to.eql([]);
+        expect(response.body.currentPeriod.timeseries).to.eql([]);
+        expect(response.body.previousPeriod.timeseries).to.eql([]);
         expect(response.status).to.be(200);
       });
     });
@@ -74,28 +74,24 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         const response = await getSessionsChart({ serviceName: 'synth-android', offset: '1d' });
 
         expect(response.status).to.be(200);
-        expect(
-          response.body.currentPeriod.some(
-            (item: { x: number; y?: number | null }) => item.x && item.y
-          )
-        ).to.eql(true);
-
-        expect(response.body.currentPeriod[0].y).to.eql(8);
-        expect(response.body.previousPeriod[0].y).to.eql(0);
+        expect(response.body.currentPeriod.timeseries.some((item) => item.x && item.y)).to.eql(
+          true
+        );
+
+        expect(response.body.currentPeriod.timeseries[0].y).to.eql(2);
+        expect(response.body.previousPeriod.timeseries[0].y).to.eql(0);
       });
 
       it('returns only current period timeseries when offset is not available', async () => {
         const response = await getSessionsChart({ serviceName: 'synth-android' });
 
         expect(response.status).to.be(200);
-        expect(
-          response.body.currentPeriod.some(
-            (item: { x: number; y?: number | null }) => item.x && item.y
-          )
-        ).to.eql(true);
-
-        expect(response.body.currentPeriod[0].y).to.eql(8);
-        expect(response.body.previousPeriod).to.eql([]);
+        expect(response.body.currentPeriod.timeseries.some((item) => item.x && item.y)).to.eql(
+          true
+        );
+
+        expect(response.body.currentPeriod.timeseries[0].y).to.eql(2);
+        expect(response.body.previousPeriod.timeseries).to.eql([]);
       });
     });
 
@@ -107,16 +103,8 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           kuery: `app.version:"none"`,
         });
 
-        expect(
-          response.body.currentPeriod.every(
-            (item: { x: number; y?: number | null }) => item.y === 0
-          )
-        ).to.eql(true);
-        expect(
-          response.body.previousPeriod.every(
-            (item: { x: number; y?: number | null }) => item.y === 0
-          )
-        ).to.eql(true);
+        expect(response.body.currentPeriod.timeseries.every((item) => item.y === 0)).to.eql(true);
+        expect(response.body.previousPeriod.timeseries.every((item) => item.y === 0)).to.eql(true);
       });
 
       it('returns the correct values filter is applied', async () => {
@@ -127,14 +115,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
         });
 
         expect(response.status).to.be(200);
-        expect(
-          response.body.currentPeriod.some(
-            (item: { x: number; y?: number | null }) => item.x && item.y
-          )
-        ).to.eql(true);
-
-        expect(response.body.currentPeriod[0].y).to.eql(2);
-        expect(response.body.previousPeriod).to.eql([]);
+        expect(response.body.currentPeriod.timeseries.some((item) => item.x && item.y)).to.eql(
+          true
+        );
+
+        expect(response.body.currentPeriod.timeseries[0].y).to.eql(2);
+        expect(response.body.previousPeriod.timeseries).to.eql([]);
       });
     });
   });
diff --git a/x-pack/test/apm_api_integration/tests/mobile/mobile_stats.spec.ts b/x-pack/test/apm_api_integration/tests/mobile/mobile_stats.spec.ts
index 32ff956a70007c..77508a34d7dddf 100644
--- a/x-pack/test/apm_api_integration/tests/mobile/mobile_stats.spec.ts
+++ b/x-pack/test/apm_api_integration/tests/mobile/mobile_stats.spec.ts
@@ -54,21 +54,12 @@ export default function ApiTest({ getService }: FtrProviderContext) {
     describe('when no data', () => {
       it('handles empty state', async () => {
         const response = await getMobileStats({ serviceName: 'foo' });
-        expect(response).to.eql({
-          sessions: {
-            timeseries: [],
-          },
-          requests: {
-            timeseries: [],
-          },
-          maxLoadTime: {
-            timeseries: [],
-          },
-          crashCount: {
-            value: 0,
-            timeseries: [],
-          },
-        });
+        expect(response.currentPeriod.sessions.timeseries.every((item) => item.y === 0)).to.eql(
+          true
+        );
+        expect(response.currentPeriod.requests.timeseries.every((item) => item.y === 0)).to.eql(
+          true
+        );
       });
     });
   });
@@ -95,19 +86,13 @@ export default function ApiTest({ getService }: FtrProviderContext) {
       });
 
       it('returns same sessions', () => {
-        const { value, timeseries } = response.sessions;
-        const timeseriesTotal = sumBy(timeseries, 'y');
-        expect(value).to.be(timeseriesTotal);
-      });
-
-      it('returns same crashCount', () => {
-        const { value, timeseries } = response.crashCount;
+        const { value, timeseries } = response.currentPeriod.sessions;
         const timeseriesTotal = sumBy(timeseries, 'y');
         expect(value).to.be(timeseriesTotal);
       });
 
       it('returns same requests', () => {
-        const { value, timeseries } = response.requests;
+        const { value, timeseries } = response.currentPeriod.requests;
         const timeseriesTotal = sumBy(timeseries, 'y');
         expect(value).to.be(timeseriesTotal);
       });
@@ -121,49 +106,36 @@ export default function ApiTest({ getService }: FtrProviderContext) {
           kuery: `app.version:"none"`,
         });
 
-        expect(response).to.eql({
-          sessions: {
-            value: 0,
-            timeseries: [],
-          },
-          requests: {
-            value: 0,
-            timeseries: [],
-          },
-          maxLoadTime: {
-            value: null,
-            timeseries: [],
-          },
-          crashCount: {
-            value: 0,
-            timeseries: [],
-          },
-        });
+        expect(response.currentPeriod.sessions.value).to.eql(0);
+        expect(response.currentPeriod.requests.value).to.eql(0);
+
+        expect(response.currentPeriod.sessions.timeseries.every((item) => item.y === 0)).to.eql(
+          true
+        );
+        expect(response.currentPeriod.requests.timeseries.every((item) => item.y === 0)).to.eql(
+          true
+        );
       });
 
       it('returns the correct values when single filter is applied', async () => {
         const response = await getMobileStats({
           serviceName: 'synth-android',
           environment: 'production',
-          kuery: `network.connection.type:"wifi"`,
+          kuery: `service.version:"1.0"`,
         });
 
-        expect(response.sessions.value).to.eql(3);
-        expect(response.requests.value).to.eql(0);
-        expect(response.crashCount.value).to.eql(0);
-        expect(response.maxLoadTime.value).to.eql(null);
+        expect(response.currentPeriod.sessions.value).to.eql(6);
+        expect(response.currentPeriod.requests.value).to.eql(0);
       });
 
       it('returns the correct values when multiple filters are applied', async () => {
         const response = await getMobileStats({
           serviceName: 'synth-android',
-          kuery: `app.version:"1.0" and environment: "production"`,
+          kuery: `service.version:"1.0" and service.environment: "production"`,
         });
 
-        expect(response.sessions.value).to.eql(0);
-        expect(response.requests.value).to.eql(0);
-        expect(response.crashCount.value).to.eql(0);
-        expect(response.maxLoadTime.value).to.eql(null);
+        expect(response.currentPeriod.sessions.value).to.eql(6);
+        expect(response.currentPeriod.requests.value).to.eql(0);
       });
     });
   });

From d68e9c7e0734d65594496c43027e83841e572ed9 Mon Sep 17 00:00:00 2001
From: Elena Stoeva <59341489+ElenaStoeva@users.noreply.github.com>
Date: Tue, 24 Jan 2023 09:21:34 +0000
Subject: [PATCH 40/54] Fix a11y issue with dev tool tabs (#149349)

Fixes https://github.com/elastic/kibana/issues/148538

## Summary

This PR fixes the a11y issue with the Beta badge used in the Dev Tools
tabs.

The proposed solution in the GH issue (moving `EuiBetaBadge` outside of
the `EuiTab` component) didn't work well as it introduced another a11y
issue - `EuiTabs` would contain an `EuiBetaBadge` component which is not
its direct child (it needs to wrap `EuiTab` components only). Also, this
solution caused some styling issues.

Removing the `tooltipContent` prop from `EuiBetaBadge` resolves the a11y
issue without introducing other a11y issues. Also, the `Beta` text is
still announced by screen readers as part of the `Painless Lab` tab
(tested on Mac's VoiceOver and the Screen Reader Chrome extension) and
the design is not changed.

<img width="1828" alt="Screenshot 2023-01-23 at 16 17 55"
src="https://user-images.githubusercontent.com/59341489/214102739-bf0783e3-755a-474d-8978-17fb4b7d0fbd.png">



### Checklist

- [X] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [X] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [X] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
---
 src/plugins/dev_tools/public/application.tsx        | 3 ---
 x-pack/plugins/translations/translations/fr-FR.json | 1 -
 x-pack/plugins/translations/translations/ja-JP.json | 1 -
 x-pack/plugins/translations/translations/zh-CN.json | 1 -
 4 files changed, 6 deletions(-)

diff --git a/src/plugins/dev_tools/public/application.tsx b/src/plugins/dev_tools/public/application.tsx
index 1a1d7ca9fb430c..0499c4ab5ccb1c 100644
--- a/src/plugins/dev_tools/public/application.tsx
+++ b/src/plugins/dev_tools/public/application.tsx
@@ -108,9 +108,6 @@ function DevToolsWrapper({
                     label={i18n.translate('devTools.badge.betaLabel', {
                       defaultMessage: 'Beta',
                     })}
-                    tooltipContent={i18n.translate('devTools.badge.betaTooltipText', {
-                      defaultMessage: 'This feature might change drastically in future releases',
-                    })}
                   />
                 )}
               </span>
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index 2aae3ce7817d0e..ae0994252e749b 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -36206,7 +36206,6 @@
     "cases.components.status.inProgress": "En cours",
     "cases.components.status.open": "Ouvrir",
     "devTools.badge.betaLabel": "Bêta",
-    "devTools.badge.betaTooltipText": "Cette fonctionnalité pourra considérablement changer dans les futures versions",
     "devTools.badge.readOnly.text": "Lecture seule",
     "devTools.badge.readOnly.tooltip": "Enregistrement impossible",
     "devTools.breadcrumb.homeLabel": "Outils de développement",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 22956f832c5bc4..1082e2930effbd 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -36175,7 +36175,6 @@
     "cases.components.status.inProgress": "進行中",
     "cases.components.status.open": "開く",
     "devTools.badge.betaLabel": "ベータ",
-    "devTools.badge.betaTooltipText": "この機能は将来のリリースで大幅に変更される可能性があります",
     "devTools.badge.readOnly.text": "読み取り専用",
     "devTools.badge.readOnly.tooltip": "を保存できませんでした",
     "devTools.breadcrumb.homeLabel": "開発ツール",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 565b78843a818b..9a3d2c6a2b0b51 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -36211,7 +36211,6 @@
     "cases.components.status.inProgress": "进行中",
     "cases.components.status.open": "打开",
     "devTools.badge.betaLabel": "公测版",
-    "devTools.badge.betaTooltipText": "此功能在未来的版本中可能会变化很大",
     "devTools.badge.readOnly.text": "只读",
     "devTools.badge.readOnly.tooltip": "无法保存",
     "devTools.breadcrumb.homeLabel": "开发工具",

From ca815a7f5bba7b6444cee93f5cbe2e7d3d288cc6 Mon Sep 17 00:00:00 2001
From: claracruz <clara.udofa@elastic.co>
Date: Tue, 24 Jan 2023 09:30:19 +0000
Subject: [PATCH 41/54] 148790 - Fix scroll style for setup guide flyout
 (#149242)

Fixes #148790
---
 .../guided_onboarding/public/components/guide_panel.styles.ts   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/plugins/guided_onboarding/public/components/guide_panel.styles.ts b/src/plugins/guided_onboarding/public/components/guide_panel.styles.ts
index 46ad2de0906fc8..4768d4112bceac 100644
--- a/src/plugins/guided_onboarding/public/components/guide_panel.styles.ts
+++ b/src/plugins/guided_onboarding/public/components/guide_panel.styles.ts
@@ -36,7 +36,7 @@ export const getGuidePanelStyles = (euiTheme: EuiThemeComputed) => ({
       }
     `,
     flyoutBody: css`
-      overflow: scroll;
+      overflow: auto;
       .euiFlyoutBody__overflowContent {
         width: 480px;
         padding-top: 10px;

From ccecb2581ed167d59fdd4accde0d30927ca8f79f Mon Sep 17 00:00:00 2001
From: Julia Bardi <90178898+juliaElastic@users.noreply.github.com>
Date: Tue, 24 Jan 2023 11:08:09 +0100
Subject: [PATCH 42/54] [Fleet] added back batch exec for update tags (#148618)

## Summary

Closes https://github.com/elastic/kibana/issues/148233

Fixing issue of bulk update tags not working with the new agent status
runtime field.
Refactored update tags to use batching again, resolving 10k agent ids at
a time and `updateByQuery` on batches.
Works locally with dummy agents, has to be tested on cloud with horde to
simulate conflicts.


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../fleet/server/routes/agent/handlers.ts     |   2 +-
 .../server/services/agents/action_runner.ts   |  24 ++-
 .../services/agents/bulk_action_types.ts      |  14 ++
 .../services/agents/bulk_actions_resolver.ts  |  24 +--
 .../services/agents/reassign_action_runner.ts |   2 +-
 .../request_diagnostics_action_runner.ts      |   2 +-
 .../server/services/agents/retry_helper.ts    |  30 ++++
 .../services/agents/unenroll_action_runner.ts |   2 +-
 .../services/agents/update_agent_tags.test.ts | 167 +++++++-----------
 .../services/agents/update_agent_tags.ts      |  33 +++-
 .../agents/update_agent_tags_action_runner.ts |  83 +++------
 .../services/agents/upgrade_action_runner.ts  |   2 +-
 12 files changed, 184 insertions(+), 201 deletions(-)
 create mode 100644 x-pack/plugins/fleet/server/services/agents/bulk_action_types.ts
 create mode 100644 x-pack/plugins/fleet/server/services/agents/retry_helper.ts

diff --git a/x-pack/plugins/fleet/server/routes/agent/handlers.ts b/x-pack/plugins/fleet/server/routes/agent/handlers.ts
index 696e05e9c18bbb..bb43d32b6cfaf4 100644
--- a/x-pack/plugins/fleet/server/routes/agent/handlers.ts
+++ b/x-pack/plugins/fleet/server/routes/agent/handlers.ts
@@ -186,7 +186,7 @@ export const getAgentsHandler: RequestHandler<
       kuery: request.query.kuery,
       sortField: request.query.sortField,
       sortOrder: request.query.sortOrder,
-      getTotalInactive: true,
+      getTotalInactive: request.query.showInactive,
     });
 
     const { total, page, perPage, totalInactive = 0 } = agentRes;
diff --git a/x-pack/plugins/fleet/server/services/agents/action_runner.ts b/x-pack/plugins/fleet/server/services/agents/action_runner.ts
index cba8f677c8b0fe..ce338b3d637f3c 100644
--- a/x-pack/plugins/fleet/server/services/agents/action_runner.ts
+++ b/x-pack/plugins/fleet/server/services/agents/action_runner.ts
@@ -6,7 +6,6 @@
  */
 
 import { v4 as uuidv4 } from 'uuid';
-import type { SortResults } from '@elastic/elasticsearch/lib/api/types';
 import type { ElasticsearchClient, SavedObjectsClientContract } from '@kbn/core/server';
 import { withSpan } from '@kbn/apm-utils';
 
@@ -21,8 +20,8 @@ import { SO_SEARCH_LIMIT } from '../../../common/constants';
 import { getAgentActions } from './actions';
 import { closePointInTime, getAgentsByKuery } from './crud';
 import type { BulkActionsResolver } from './bulk_actions_resolver';
-
-export const MAX_RETRY_COUNT = 5;
+import type { RetryParams } from './retry_helper';
+import { getRetryParams, MAX_RETRY_COUNT } from './retry_helper';
 
 export interface ActionParams {
   kuery: string;
@@ -34,13 +33,6 @@ export interface ActionParams {
   [key: string]: any;
 }
 
-export interface RetryParams {
-  pitId: string;
-  searchAfter?: SortResults;
-  retryCount?: number;
-  taskId?: string;
-}
-
 export abstract class ActionRunner {
   protected esClient: ElasticsearchClient;
   protected soClient: SavedObjectsClientContract;
@@ -79,7 +71,9 @@ export abstract class ActionRunner {
     appContextService
       .getLogger()
       .info(
-        `Running action asynchronously, actionId: ${this.actionParams.actionId}, total agents: ${this.actionParams.total}`
+        `Running action asynchronously, actionId: ${this.actionParams.actionId}${
+          this.actionParams.total ? ', total agents:' + this.actionParams.total : ''
+        }`
       );
 
     if (!this.bulkActionsResolver) {
@@ -153,10 +147,12 @@ export abstract class ActionRunner {
       this.actionParams.actionId!,
       this.getTaskType() + ':check'
     );
+    const retryParams: RetryParams = getRetryParams(this.getTaskType(), this.retryParams);
+
     return await this.bulkActionsResolver!.run(
       this.actionParams,
       {
-        ...this.retryParams,
+        ...retryParams,
         retryCount: 1,
       },
       this.getTaskType(),
@@ -233,7 +229,9 @@ export abstract class ActionRunner {
       }
     }
 
-    await closePointInTime(this.esClient, pitId!);
+    if (pitId) {
+      await closePointInTime(this.esClient, pitId!);
+    }
 
     appContextService
       .getLogger()
diff --git a/x-pack/plugins/fleet/server/services/agents/bulk_action_types.ts b/x-pack/plugins/fleet/server/services/agents/bulk_action_types.ts
new file mode 100644
index 00000000000000..44ab84e0bc72d9
--- /dev/null
+++ b/x-pack/plugins/fleet/server/services/agents/bulk_action_types.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export enum BulkActionTaskType {
+  REASSIGN_RETRY = 'fleet:reassign_action:retry',
+  UNENROLL_RETRY = 'fleet:unenroll_action:retry',
+  UPGRADE_RETRY = 'fleet:upgrade_action:retry',
+  UPDATE_AGENT_TAGS_RETRY = 'fleet:update_agent_tags:retry',
+  REQUEST_DIAGNOSTICS_RETRY = 'fleet:request_diagnostics:retry',
+}
diff --git a/x-pack/plugins/fleet/server/services/agents/bulk_actions_resolver.ts b/x-pack/plugins/fleet/server/services/agents/bulk_actions_resolver.ts
index b6ec1d082b39a0..b68bae611252a2 100644
--- a/x-pack/plugins/fleet/server/services/agents/bulk_actions_resolver.ts
+++ b/x-pack/plugins/fleet/server/services/agents/bulk_actions_resolver.ts
@@ -19,16 +19,11 @@ import { ReassignActionRunner } from './reassign_action_runner';
 import { UpgradeActionRunner } from './upgrade_action_runner';
 import { UpdateAgentTagsActionRunner } from './update_agent_tags_action_runner';
 import { UnenrollActionRunner } from './unenroll_action_runner';
-import type { ActionParams, RetryParams } from './action_runner';
+import type { ActionParams } from './action_runner';
 import { RequestDiagnosticsActionRunner } from './request_diagnostics_action_runner';
-
-export enum BulkActionTaskType {
-  REASSIGN_RETRY = 'fleet:reassign_action:retry',
-  UNENROLL_RETRY = 'fleet:unenroll_action:retry',
-  UPGRADE_RETRY = 'fleet:upgrade_action:retry',
-  UPDATE_AGENT_TAGS_RETRY = 'fleet:update_agent_tags:retry',
-  REQUEST_DIAGNOSTICS_RETRY = 'fleet:request_diagnostics:retry',
-}
+import type { RetryParams } from './retry_helper';
+import { getRetryParams } from './retry_helper';
+import { BulkActionTaskType } from './bulk_action_types';
 
 /**
  * Create and run retry tasks of agent bulk actions
@@ -114,11 +109,7 @@ export class BulkActionsResolver {
       scope: ['fleet'],
       state: {},
       params: { actionParams, retryParams },
-      runAt:
-        runAt ??
-        moment(new Date())
-          .add(Math.pow(3, retryParams.retryCount ?? 1), 's')
-          .toDate(),
+      runAt: runAt ?? moment(new Date()).add(3, 's').toDate(),
     });
     appContextService.getLogger().info('Scheduling task ' + taskId);
     return taskId;
@@ -146,7 +137,10 @@ export function createRetryTask(
 
       const { esClient, soClient } = await getDeps();
 
-      const retryParams = taskInstance.params.retryParams;
+      const retryParams: RetryParams = getRetryParams(
+        taskInstance.taskType,
+        taskInstance.params.retryParams
+      );
 
       appContextService
         .getLogger()
diff --git a/x-pack/plugins/fleet/server/services/agents/reassign_action_runner.ts b/x-pack/plugins/fleet/server/services/agents/reassign_action_runner.ts
index cf6e3988e7bef2..b03146ab6b387b 100644
--- a/x-pack/plugins/fleet/server/services/agents/reassign_action_runner.ts
+++ b/x-pack/plugins/fleet/server/services/agents/reassign_action_runner.ts
@@ -18,7 +18,7 @@ import { ActionRunner } from './action_runner';
 import { bulkUpdateAgents } from './crud';
 import { createErrorActionResults, createAgentAction } from './actions';
 import { getHostedPolicies, isHostedAgent } from './hosted_agent';
-import { BulkActionTaskType } from './bulk_actions_resolver';
+import { BulkActionTaskType } from './bulk_action_types';
 
 export class ReassignActionRunner extends ActionRunner {
   protected async processAgents(agents: Agent[]): Promise<{ actionId: string }> {
diff --git a/x-pack/plugins/fleet/server/services/agents/request_diagnostics_action_runner.ts b/x-pack/plugins/fleet/server/services/agents/request_diagnostics_action_runner.ts
index 9728afedbb0282..d9552f3a1a41e7 100644
--- a/x-pack/plugins/fleet/server/services/agents/request_diagnostics_action_runner.ts
+++ b/x-pack/plugins/fleet/server/services/agents/request_diagnostics_action_runner.ts
@@ -12,7 +12,7 @@ import type { Agent } from '../../types';
 
 import { ActionRunner } from './action_runner';
 import { createAgentAction } from './actions';
-import { BulkActionTaskType } from './bulk_actions_resolver';
+import { BulkActionTaskType } from './bulk_action_types';
 
 export class RequestDiagnosticsActionRunner extends ActionRunner {
   protected async processAgents(agents: Agent[]): Promise<{ actionId: string }> {
diff --git a/x-pack/plugins/fleet/server/services/agents/retry_helper.ts b/x-pack/plugins/fleet/server/services/agents/retry_helper.ts
new file mode 100644
index 00000000000000..b15d5faa87c447
--- /dev/null
+++ b/x-pack/plugins/fleet/server/services/agents/retry_helper.ts
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SortResults } from '@elastic/elasticsearch/lib/api/types';
+
+import { BulkActionTaskType } from './bulk_action_types';
+
+export const MAX_RETRY_COUNT = 20;
+
+export interface RetryParams {
+  pitId?: string;
+  searchAfter?: SortResults;
+  retryCount?: number;
+  taskId?: string;
+}
+
+export function getRetryParams(taskType: string, retryParams: RetryParams): RetryParams {
+  // update tags will retry with tags filter
+  return taskType === BulkActionTaskType.UPDATE_AGENT_TAGS_RETRY
+    ? {
+        ...retryParams,
+        pitId: undefined,
+        searchAfter: undefined,
+      }
+    : retryParams;
+}
diff --git a/x-pack/plugins/fleet/server/services/agents/unenroll_action_runner.ts b/x-pack/plugins/fleet/server/services/agents/unenroll_action_runner.ts
index 359b016bd1b8c4..8f9a7f3763cc00 100644
--- a/x-pack/plugins/fleet/server/services/agents/unenroll_action_runner.ts
+++ b/x-pack/plugins/fleet/server/services/agents/unenroll_action_runner.ts
@@ -29,7 +29,7 @@ import {
   getUnenrollAgentActions,
 } from './actions';
 import { getHostedPolicies, isHostedAgent } from './hosted_agent';
-import { BulkActionTaskType } from './bulk_actions_resolver';
+import { BulkActionTaskType } from './bulk_action_types';
 
 export class UnenrollActionRunner extends ActionRunner {
   protected async processAgents(agents: Agent[]): Promise<{ actionId: string }> {
diff --git a/x-pack/plugins/fleet/server/services/agents/update_agent_tags.test.ts b/x-pack/plugins/fleet/server/services/agents/update_agent_tags.test.ts
index d59aee0c700b13..30c56b53640af8 100644
--- a/x-pack/plugins/fleet/server/services/agents/update_agent_tags.test.ts
+++ b/x-pack/plugins/fleet/server/services/agents/update_agent_tags.test.ts
@@ -8,9 +8,12 @@ import type { SavedObjectsClientContract } from '@kbn/core/server';
 import type { ElasticsearchClientMock } from '@kbn/core/server/mocks';
 import { elasticsearchServiceMock, savedObjectsClientMock } from '@kbn/core/server/mocks';
 
+import type { Agent } from '../../types';
+
 import { createClientMock } from './action.mock';
+import { MAX_RETRY_COUNT } from './retry_helper';
 import { updateAgentTags } from './update_agent_tags';
-import { updateTagsBatch } from './update_agent_tags_action_runner';
+import { UpdateAgentTagsActionRunner, updateTagsBatch } from './update_agent_tags_action_runner';
 
 jest.mock('../app_context', () => {
   return {
@@ -74,6 +77,7 @@ describe('update_agent_tags', () => {
     esClient.updateByQuery.mockResolvedValue({ failures: [], updated: 1 } as any);
 
     mockRunAsync.mockClear();
+    (UpdateAgentTagsActionRunner as jest.Mock).mockClear();
   });
 
   it('should remove duplicate tags', async () => {
@@ -83,7 +87,9 @@ describe('update_agent_tags', () => {
       expect.objectContaining({
         conflicts: 'proceed',
         index: '.fleet-agents',
-        query: { terms: { _id: ['agent1'] } },
+        query: {
+          terms: { _id: ['agent1'] },
+        },
         script: expect.objectContaining({
           lang: 'painless',
           params: expect.objectContaining({
@@ -121,37 +127,16 @@ describe('update_agent_tags', () => {
     expect(actionResults.body[1].error).not.toBeDefined();
   });
 
-  it('should update action results on success - kuery', async () => {
-    await updateTagsBatch(
-      soClient,
-      esClient,
-      [],
-      {},
-      {
-        tagsToAdd: ['new'],
-        tagsToRemove: [],
-        kuery: '',
-      }
-    );
-
-    const actionResults = esClient.bulk.mock.calls[0][0] as any;
-    const agentIds = actionResults?.body
-      ?.filter((i: any) => i.agent_id)
-      .map((i: any) => i.agent_id);
-    expect(agentIds[0]).toHaveLength(36); // uuid
-    expect(actionResults.body[1].error).not.toBeDefined();
-  });
-
   it('should skip hosted agent from total when agentIds are passed', async () => {
-    const { esClient: esClientMock, agentInHostedDoc } = createClientMock();
+    const { esClient: esClientMock, agentInHostedDoc, agentInRegularDoc } = createClientMock();
 
     esClientMock.updateByQuery.mockReset();
-    esClientMock.updateByQuery.mockResolvedValue({ failures: [], updated: 0, total: 0 } as any);
+    esClientMock.updateByQuery.mockResolvedValue({ failures: [], updated: 1, total: 1 } as any);
 
     await updateAgentTags(
       soClient,
       esClientMock,
-      { agentIds: [agentInHostedDoc._id] },
+      { agentIds: [agentInHostedDoc._id, agentInRegularDoc._id] },
       ['newName'],
       []
     );
@@ -160,9 +145,9 @@ describe('update_agent_tags', () => {
     expect(agentAction?.body).toEqual(
       expect.objectContaining({
         action_id: expect.anything(),
-        agents: [],
+        agents: [agentInRegularDoc._id],
         type: 'UPDATE_TAGS',
-        total: 0,
+        total: 1,
       })
     );
   });
@@ -205,14 +190,14 @@ describe('update_agent_tags', () => {
       updateTagsBatch(
         soClient,
         esClient,
-        [],
+        [{ id: 'agent1' } as Agent],
         {},
         {
           tagsToAdd: ['new'],
           tagsToRemove: [],
           kuery: '',
           total: 100,
-          retryCount: 5,
+          retryCount: MAX_RETRY_COUNT,
         }
       )
     ).rejects.toThrowError('version conflict of 100 agents');
@@ -247,13 +232,24 @@ describe('update_agent_tags', () => {
     await updateAgentTags(soClient, esClient, { kuery: '', batchSize: 2 }, ['newName'], []);
 
     expect(mockRunAsync).toHaveBeenCalled();
+    expect(UpdateAgentTagsActionRunner).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.anything(),
+      expect.objectContaining({
+        batchSize: 2,
+        kuery: '(NOT (tags:newName))',
+        tagsToAdd: ['newName'],
+        tagsToRemove: [],
+      }),
+      expect.anything()
+    );
   });
 
   it('should add tags filter if only one tag to add', async () => {
     await updateTagsBatch(
       soClient,
       esClient,
-      [],
+      [{ id: 'agent1' } as Agent, { id: 'agent2' } as Agent],
       {},
       {
         tagsToAdd: ['new'],
@@ -263,94 +259,57 @@ describe('update_agent_tags', () => {
     );
 
     const updateByQuery = esClient.updateByQuery.mock.calls[0][0] as any;
-    expect(updateByQuery.query).toMatchInlineSnapshot(`
-      Object {
-        "bool": Object {
-          "filter": Array [
-            Object {
-              "bool": Object {
-                "must_not": Object {
-                  "bool": Object {
-                    "minimum_should_match": 1,
-                    "should": Array [
-                      Object {
-                        "bool": Object {
-                          "minimum_should_match": 1,
-                          "should": Array [
-                            Object {
-                              "match": Object {
-                                "status": "inactive",
-                              },
-                            },
-                          ],
-                        },
-                      },
-                      Object {
-                        "bool": Object {
-                          "minimum_should_match": 1,
-                          "should": Array [
-                            Object {
-                              "match": Object {
-                                "status": "unenrolled",
-                              },
-                            },
-                          ],
-                        },
-                      },
-                    ],
-                  },
-                },
-              },
-            },
-            Object {
-              "bool": Object {
-                "must_not": Object {
-                  "bool": Object {
-                    "minimum_should_match": 1,
-                    "should": Array [
-                      Object {
-                        "match": Object {
-                          "tags": "new",
-                        },
-                      },
-                    ],
-                  },
-                },
-              },
-            },
-          ],
-        },
-      }
-    `);
+    expect(updateByQuery.query).toEqual({
+      terms: { _id: ['agent1', 'agent2'] },
+    });
   });
 
   it('should add tags filter if only one tag to remove', async () => {
-    await updateTagsBatch(
+    await updateAgentTags(soClient, esClient, { kuery: '' }, [], ['remove']);
+
+    expect(UpdateAgentTagsActionRunner).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.anything(),
+      expect.objectContaining({
+        batchSize: 10000,
+        kuery: '(tags:remove)',
+        tagsToAdd: [],
+        tagsToRemove: ['remove'],
+      }),
+      expect.anything()
+    );
+  });
+
+  it('should add tags filter to existing kuery if only one tag to remove', async () => {
+    await updateAgentTags(
       soClient,
       esClient,
+      { kuery: 'status:healthy OR status:offline' },
       [],
-      {},
-      {
-        tagsToAdd: [],
-        tagsToRemove: ['remove'],
-        kuery: '',
-      }
+      ['remove']
     );
 
-    const updateByQuery = esClient.updateByQuery.mock.calls[0][0] as any;
-    expect(JSON.stringify(updateByQuery.query)).toContain(
-      '{"bool":{"should":[{"match":{"tags":"remove"}}],"minimum_should_match":1}}'
+    expect(UpdateAgentTagsActionRunner).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.anything(),
+      expect.objectContaining({
+        batchSize: 10000,
+        kuery: '(status:healthy OR status:offline) AND (tags:remove)',
+        tagsToAdd: [],
+        tagsToRemove: ['remove'],
+      }),
+      expect.anything()
     );
   });
 
-  it('should write total from updateByQuery result if query returns less results', async () => {
+  it('should write total from total param if updateByQuery returns less results', async () => {
     esClient.updateByQuery.mockReset();
     esClient.updateByQuery.mockResolvedValue({ failures: [], updated: 0, total: 50 } as any);
 
     await updateTagsBatch(
       soClient,
       esClient,
-      [],
+      [{ id: 'agent1' } as Agent],
       {},
       {
         tagsToAdd: ['new'],
@@ -364,9 +323,9 @@ describe('update_agent_tags', () => {
     expect(agentAction?.body).toEqual(
       expect.objectContaining({
         action_id: expect.anything(),
-        agents: [],
+        agents: ['agent1'],
         type: 'UPDATE_TAGS',
-        total: 50,
+        total: 100,
       })
     );
   });
diff --git a/x-pack/plugins/fleet/server/services/agents/update_agent_tags.ts b/x-pack/plugins/fleet/server/services/agents/update_agent_tags.ts
index a53a5f45364202..5e335bfd41996a 100644
--- a/x-pack/plugins/fleet/server/services/agents/update_agent_tags.ts
+++ b/x-pack/plugins/fleet/server/services/agents/update_agent_tags.ts
@@ -10,7 +10,9 @@ import type { ElasticsearchClient, SavedObjectsClientContract } from '@kbn/core/
 import type { Agent } from '../../types';
 import { AgentReassignmentError } from '../../errors';
 
-import { getAgentsById } from './crud';
+import { SO_SEARCH_LIMIT } from '../../constants';
+
+import { getAgentsById, getAgentsByKuery, openPointInTime } from './crud';
 import type { GetAgentsOptions } from '.';
 import { UpdateAgentTagsActionRunner, updateTagsBatch } from './update_agent_tags_action_runner';
 
@@ -36,16 +38,41 @@ export async function updateAgentTags(
       }
     }
   } else if ('kuery' in options) {
+    const batchSize = options.batchSize ?? SO_SEARCH_LIMIT;
+
+    const filters = [];
+    if (options.kuery !== '') {
+      filters.push(options.kuery);
+    }
+    if (tagsToAdd.length === 1 && tagsToRemove.length === 0) {
+      filters.push(`NOT (tags:${tagsToAdd[0]})`);
+    } else if (tagsToRemove.length === 1 && tagsToAdd.length === 0) {
+      filters.push(`tags:${tagsToRemove[0]}`);
+    }
+
+    const kuery = filters.map((filter) => `(${filter})`).join(' AND ');
+    const pitId = await openPointInTime(esClient);
+
+    // calculate total count
+    const res = await getAgentsByKuery(esClient, soClient, {
+      kuery,
+      showInactive: options.showInactive ?? false,
+      perPage: 0,
+      pitId,
+    });
+
     return await new UpdateAgentTagsActionRunner(
       esClient,
       soClient,
       {
         ...options,
-        kuery: options.kuery,
+        kuery,
         tagsToAdd,
         tagsToRemove,
+        batchSize,
+        total: res.total,
       },
-      { pitId: '' }
+      { pitId }
     ).runActionAsyncWithRetry();
   }
 
diff --git a/x-pack/plugins/fleet/server/services/agents/update_agent_tags_action_runner.ts b/x-pack/plugins/fleet/server/services/agents/update_agent_tags_action_runner.ts
index 9c872594524935..1f12968b67c367 100644
--- a/x-pack/plugins/fleet/server/services/agents/update_agent_tags_action_runner.ts
+++ b/x-pack/plugins/fleet/server/services/agents/update_agent_tags_action_runner.ts
@@ -8,24 +8,19 @@
 import type { SavedObjectsClientContract, ElasticsearchClient } from '@kbn/core/server';
 import { v4 as uuidv4 } from 'uuid';
 import { uniq } from 'lodash';
-import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
 import type { Agent } from '../../types';
 
-import { AGENTS_INDEX, AGENT_POLICY_SAVED_OBJECT_TYPE } from '../../constants';
+import { AGENTS_INDEX } from '../../constants';
 
 import { appContextService } from '../app_context';
 
-import { agentPolicyService } from '../agent_policy';
+import { ActionRunner } from './action_runner';
 
-import { SO_SEARCH_LIMIT } from '../../../common/constants';
-
-import { ActionRunner, MAX_RETRY_COUNT } from './action_runner';
-
-import { BulkActionTaskType } from './bulk_actions_resolver';
+import { BulkActionTaskType } from './bulk_action_types';
 import { filterHostedPolicies } from './filter_hosted_agents';
 import { bulkCreateAgentActionResults, createAgentAction } from './actions';
-import { getElasticsearchQuery } from './crud';
+import { MAX_RETRY_COUNT } from './retry_helper';
 
 export class UpdateAgentTagsActionRunner extends ActionRunner {
   protected async processAgents(agents: Agent[]): Promise<{ actionId: string }> {
@@ -50,26 +45,6 @@ export class UpdateAgentTagsActionRunner extends ActionRunner {
   protected getActionType() {
     return 'UPDATE_TAGS';
   }
-
-  async processAgentsInBatches(): Promise<{ actionId: string }> {
-    const { updated, took } = await updateTagsBatch(
-      this.soClient,
-      this.esClient,
-      [],
-      {},
-      {
-        tagsToAdd: this.actionParams?.tagsToAdd,
-        tagsToRemove: this.actionParams?.tagsToRemove,
-        actionId: this.actionParams.actionId,
-        total: this.actionParams.total,
-        kuery: this.actionParams.kuery,
-        retryCount: this.retryParams.retryCount,
-      }
-    );
-
-    appContextService.getLogger().info(`processed ${updated} agents, took ${took}ms`);
-    return { actionId: this.actionParams.actionId! };
-  }
 }
 
 export async function updateTagsBatch(
@@ -97,38 +72,26 @@ export async function updateTagsBatch(
   );
   const agentIds = filteredAgents.map((agent) => agent.id);
 
-  let query: estypes.QueryDslQueryContainer | undefined;
-  if (options.kuery !== undefined) {
-    const hostedPolicies = await agentPolicyService.list(soClient, {
-      kuery: `${AGENT_POLICY_SAVED_OBJECT_TYPE}.is_managed:true`,
-      perPage: SO_SEARCH_LIMIT,
-    });
-    const hostedIds = hostedPolicies.items.map((item) => item.id);
-
-    const extraFilters = [];
-    if (options.tagsToAdd.length === 1 && options.tagsToRemove.length === 0) {
-      extraFilters.push(`NOT (tags:${options.tagsToAdd[0]})`);
-    } else if (options.tagsToRemove.length === 1 && options.tagsToAdd.length === 0) {
-      extraFilters.push(`tags:${options.tagsToRemove[0]}`);
-    }
-    const DEFAULT_STATUS_FILTER =
-      'status:online or (status:error or status:degraded) or (status:updating or status:unenrolling or status:enrolling) or status:offline';
-    // removing default staus filters, as it is a runtime field and doesn't work with updateByQuery
-    // this is a quick fix for bulk update tags with default filters
-    const kuery = options.kuery === DEFAULT_STATUS_FILTER ? '' : options.kuery;
-    query = getElasticsearchQuery(kuery, false, false, hostedIds, extraFilters);
-  } else {
-    query = {
-      terms: {
-        _id: agentIds,
-      },
-    };
+  const actionId = options.actionId ?? uuidv4();
+  if (agentIds.length === 0) {
+    appContextService.getLogger().debug('No agents to update tags, returning');
+    return { actionId, updated: 0, took: 0 };
   }
 
+  appContextService
+    .getLogger()
+    .debug(
+      `Agents to update tags in batch: ${agentIds.length}, tagsToAdd: ${options.tagsToAdd}, tagsToRemove: ${options.tagsToRemove}`
+    );
+
   let res;
   try {
     res = await esClient.updateByQuery({
-      query,
+      query: {
+        terms: {
+          _id: agentIds,
+        },
+      },
       index: AGENTS_INDEX,
       refresh: true,
       wait_for_completion: true,
@@ -166,16 +129,14 @@ export async function updateTagsBatch(
 
   appContextService.getLogger().debug(JSON.stringify(res).slice(0, 1000));
 
-  const actionId = options.actionId ?? uuidv4();
-
   if (options.retryCount === undefined) {
     // creating an action doc so that update tags  shows up in activity
     await createAgentAction(esClient, {
       id: actionId,
-      agents: options.kuery === undefined ? agentIds : [],
+      agents: agentIds,
       created_at: new Date().toISOString(),
       type: 'UPDATE_TAGS',
-      total: res.total,
+      total: options.total ?? res.total,
     });
   }
 
@@ -186,7 +147,7 @@ export async function updateTagsBatch(
   if (res.updated ?? 0 > 0) {
     await bulkCreateAgentActionResults(
       esClient,
-      (options.kuery === undefined ? agentIds : getUuidArray(res.updated!)).map((id) => ({
+      agentIds.map((id) => ({
         agentId: id,
         actionId,
       }))
diff --git a/x-pack/plugins/fleet/server/services/agents/upgrade_action_runner.ts b/x-pack/plugins/fleet/server/services/agents/upgrade_action_runner.ts
index 501afe0d540430..ff677db23cacc6 100644
--- a/x-pack/plugins/fleet/server/services/agents/upgrade_action_runner.ts
+++ b/x-pack/plugins/fleet/server/services/agents/upgrade_action_runner.ts
@@ -24,7 +24,7 @@ import type { GetAgentsOptions } from './crud';
 import { bulkUpdateAgents } from './crud';
 import { createErrorActionResults, createAgentAction } from './actions';
 import { getHostedPolicies, isHostedAgent } from './hosted_agent';
-import { BulkActionTaskType } from './bulk_actions_resolver';
+import { BulkActionTaskType } from './bulk_action_types';
 
 export class UpgradeActionRunner extends ActionRunner {
   protected async processAgents(agents: Agent[]): Promise<{ actionId: string }> {

From d692d4095797538aa73a140cb69e3072a3456bf5 Mon Sep 17 00:00:00 2001
From: Shahzad <shahzad31comp@gmail.com>
Date: Tue, 24 Jan 2023 11:12:37 +0100
Subject: [PATCH 43/54] [Synthetics] Object types panel and thresholds
 (#149099)

Fixes https://github.com/elastic/kibana/issues/145395
Fixes https://github.com/elastic/kibana/issues/145892
---
 .../e2e/journeys/synthetics/index.ts          |   1 +
 .../synthetics/step_details.journey.ts        |  55 +++++++
 .../synthetics/synthetics_app.tsx             |  18 +++
 .../hooks/use_object_metrics.ts               |  81 ++++++++--
 .../hooks/use_prev_object_metrics.ts          | 141 ++++++++++++++++++
 .../network_timings_breakdown.tsx             |  11 ++
 .../step_details_page/step_detail_page.tsx    |   2 +-
 .../step_metrics/step_metrics.tsx             |   2 +-
 .../step_objects/color_palette.tsx            |  59 +++++++-
 .../step_objects/object_count_list.tsx        |  10 +-
 .../step_objects/object_weight_list.tsx       |  10 +-
 .../network_timings_donut.tsx                 |   2 +-
 .../synthetics/hooks/use_redux_es_search.ts   |   9 +-
 .../server/queries/get_journey_details.ts     |   5 +
 14 files changed, 378 insertions(+), 28 deletions(-)
 create mode 100644 x-pack/plugins/synthetics/e2e/journeys/synthetics/step_details.journey.ts
 create mode 100644 x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_prev_object_metrics.ts

diff --git a/x-pack/plugins/synthetics/e2e/journeys/synthetics/index.ts b/x-pack/plugins/synthetics/e2e/journeys/synthetics/index.ts
index c7232fefb6efd4..15dd3c2b87247a 100644
--- a/x-pack/plugins/synthetics/e2e/journeys/synthetics/index.ts
+++ b/x-pack/plugins/synthetics/e2e/journeys/synthetics/index.ts
@@ -22,3 +22,4 @@ export * from './test_now_mode.journey';
 export * from './data_retention.journey';
 export * from './monitor_details_page/monitor_summary.journey';
 export * from './test_run_details.journey';
+export * from './step_details.journey';
diff --git a/x-pack/plugins/synthetics/e2e/journeys/synthetics/step_details.journey.ts b/x-pack/plugins/synthetics/e2e/journeys/synthetics/step_details.journey.ts
new file mode 100644
index 00000000000000..94172d2c2bde64
--- /dev/null
+++ b/x-pack/plugins/synthetics/e2e/journeys/synthetics/step_details.journey.ts
@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { journey, step, before, after } from '@elastic/synthetics';
+import { recordVideo } from '@kbn/observability-plugin/e2e/record_video';
+import { syntheticsAppPageProvider } from '../../page_objects/synthetics/synthetics_app';
+import { SyntheticsServices } from './services/synthetics_services';
+
+journey(`StepDetailsPage`, async ({ page, params }) => {
+  recordVideo(page);
+
+  page.setDefaultTimeout(60 * 1000);
+  const syntheticsApp = syntheticsAppPageProvider({ page, kibanaUrl: params.kibanaUrl });
+
+  const services = new SyntheticsServices(params);
+
+  before(async () => {
+    await services.cleaUp();
+    await services.enableMonitorManagedViaApi();
+    await services.addTestMonitor(
+      'https://www.google.com',
+      {
+        type: 'browser',
+        urls: 'https://www.google.com',
+        custom_heartbeat_id: 'a47bfc4e-361a-4eb0-83f3-b5bb68781b5b',
+        locations: [
+          { id: 'us_central', label: 'North America - US Central', isServiceManaged: true },
+        ],
+      },
+      'a47bfc4e-361a-4eb0-83f3-b5bb68781b5b'
+    );
+  });
+
+  after(async () => {
+    await services.cleaUp();
+  });
+
+  step('Go to step details page', async () => {
+    await syntheticsApp.navigateToStepDetails({
+      stepIndex: 1,
+      checkGroup: 'ab240846-8d22-11ed-8fac-52bb19a2321e',
+      configId: 'a47bfc4e-361a-4eb0-83f3-b5bb68781b5b',
+    });
+  });
+
+  step('it shows metrics', async () => {
+    await page.waitForSelector('text=558 KB');
+    await page.waitForSelector('text=402 ms');
+    await page.waitForSelector('text=521 ms');
+  });
+});
diff --git a/x-pack/plugins/synthetics/e2e/page_objects/synthetics/synthetics_app.tsx b/x-pack/plugins/synthetics/e2e/page_objects/synthetics/synthetics_app.tsx
index 1732c3f0e91b8e..f9e57b952961cc 100644
--- a/x-pack/plugins/synthetics/e2e/page_objects/synthetics/synthetics_app.tsx
+++ b/x-pack/plugins/synthetics/e2e/page_objects/synthetics/synthetics_app.tsx
@@ -50,6 +50,24 @@ export function syntheticsAppPageProvider({ page, kibanaUrl }: { page: Page; kib
       }
     },
 
+    async navigateToStepDetails({
+      configId,
+      stepIndex,
+      checkGroup,
+      doLogin = true,
+    }: {
+      checkGroup: string;
+      configId: string;
+      stepIndex: number;
+      doLogin?: boolean;
+    }) {
+      const stepDetails = `/monitor/${configId}/test-run/${checkGroup}/step/${stepIndex}?locationId=us_central`;
+      await page.goto(overview + stepDetails, { waitUntil: 'networkidle' });
+      if (doLogin) {
+        await this.loginToKibana();
+      }
+    },
+
     async waitForMonitorManagementLoadingToFinish() {
       while (true) {
         if ((await page.$(this.byTestId('uptimeLoader'))) === null) break;
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_object_metrics.ts b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_object_metrics.ts
index fd19ec7675ec63..6cc622c8e19b59 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_object_metrics.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_object_metrics.ts
@@ -7,31 +7,59 @@
 
 import { useSelector } from 'react-redux';
 import { useParams } from 'react-router-dom';
+import { usePreviousObjectMetrics } from './use_prev_object_metrics';
 import { MIME_FILTERS, MimeType, MimeTypesMap } from '../common/network_data/types';
 import { networkEventsSelector } from '../../../state/network_events/selectors';
 
 export const useObjectMetrics = () => {
   const { checkGroupId, stepIndex } = useParams<{ checkGroupId: string; stepIndex: string }>();
 
+  const { mimeData: prevMimeData } = usePreviousObjectMetrics();
+
   const _networkEvents = useSelector(networkEventsSelector);
   const networkEvents = _networkEvents[checkGroupId ?? '']?.[Number(stepIndex)];
 
-  const objectTypeCounts: Record<string, number> = {};
-  const objectTypeWeights: Record<string, number> = {};
+  const objectTypeCounts: Record<string, { value: number; prevValue: number }> = {};
+  const objectTypeWeights: Record<string, { value: number; prevValue: number }> = {};
 
   networkEvents?.events.forEach((event) => {
     if (event.mimeType) {
-      objectTypeCounts[MimeTypesMap[event.mimeType] ?? MimeType.Other] =
-        (objectTypeCounts[MimeTypesMap[event.mimeType] ?? MimeType.Other] ?? 0) + 1;
-      objectTypeWeights[MimeTypesMap[event.mimeType] ?? MimeType.Other] =
-        (objectTypeWeights[MimeTypesMap[event.mimeType] ?? MimeType.Other] ?? 0) +
-        (event.transferSize || 0);
+      const mimeType = MimeTypesMap[event.mimeType] ?? MimeType.Other;
+
+      if (objectTypeCounts[mimeType]) {
+        objectTypeCounts[mimeType].value++;
+      } else {
+        objectTypeCounts[mimeType] = { value: 1, prevValue: 0 };
+      }
+
+      if (objectTypeWeights[mimeType]) {
+        objectTypeWeights[mimeType].value += event.transferSize || 0;
+      } else {
+        objectTypeWeights[mimeType] = {
+          value: event.transferSize || 0,
+          prevValue: 0,
+        };
+      }
     }
   });
 
-  const totalObjects = Object.values(objectTypeCounts).reduce((acc, val) => acc + val, 0);
+  const totalObjects = Object.values(objectTypeCounts).reduce((acc, val) => acc + val.value, 0);
 
-  const totalObjectsWeight = Object.values(objectTypeWeights).reduce((acc, val) => acc + val, 0);
+  const totalObjectsWeight = Object.values(objectTypeWeights).reduce(
+    (acc, val) => acc + val.value,
+    0
+  );
+
+  Object.keys(prevMimeData).forEach((mimeType) => {
+    const mimeTypeKey = MimeTypesMap[mimeType] ?? MimeType.Other;
+    if (objectTypeCounts[mimeTypeKey]) {
+      objectTypeCounts[mimeTypeKey].prevValue += prevMimeData[mimeType].count;
+    }
+
+    if (objectTypeWeights[mimeTypeKey]) {
+      objectTypeWeights[mimeTypeKey].prevValue += prevMimeData[mimeType].weight;
+    }
+  });
 
   return {
     loading: networkEvents?.loading ?? true,
@@ -39,16 +67,41 @@ export const useObjectMetrics = () => {
     totalObjectsWeight: formatBytes(totalObjectsWeight),
     items: MIME_FILTERS.map(({ label, mimeType }) => ({
       label,
-      count: objectTypeCounts[mimeType] ?? 0,
-      total: totalObjects,
       mimeType,
-      percent: ((objectTypeCounts[mimeType] ?? 0) / totalObjects) * 100,
-      weight: formatBytes(objectTypeWeights[mimeType] ?? 0),
-      weightPercent: ((objectTypeWeights[mimeType] ?? 0) / totalObjectsWeight) * 100,
+      total: totalObjects,
+      count: objectTypeCounts?.[mimeType]?.value ?? 0,
+      percent: ((objectTypeCounts?.[mimeType]?.value ?? 0) / totalObjects) * 100,
+      weight: formatBytes(objectTypeWeights[mimeType]?.value ?? 0),
+      weightPercent: ((objectTypeWeights[mimeType]?.value ?? 0) / totalObjectsWeight) * 100,
+
+      countDelta: getDeltaPercent(
+        objectTypeCounts?.[mimeType]?.value ?? 0,
+        objectTypeCounts?.[mimeType]?.prevValue ?? 0
+      ),
+      weightDelta: getWeightDeltaPercent(
+        objectTypeWeights?.[mimeType]?.value,
+        objectTypeWeights?.[mimeType]?.prevValue
+      ),
     })),
   };
 };
 
+export const getWeightDeltaPercent = (current: number, previous: number) => {
+  if (previous === 0 || !previous) {
+    return 0;
+  }
+
+  return (((current - previous) / previous) * 100).toFixed(0);
+};
+
+export const getDeltaPercent = (current: number, previous: number) => {
+  if (previous === 0) {
+    return 0;
+  }
+
+  return (((current - previous) / previous) * 100).toFixed(0);
+};
+
 export const formatBytes = (bytes: number, decimals = 0) => {
   if (bytes === 0) return '0 Bytes';
 
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_prev_object_metrics.ts b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_prev_object_metrics.ts
new file mode 100644
index 00000000000000..1a5d31415decb4
--- /dev/null
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/hooks/use_prev_object_metrics.ts
@@ -0,0 +1,141 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useParams } from 'react-router-dom';
+import moment from 'moment';
+import { useJourneySteps } from '../../monitor_details/hooks/use_journey_steps';
+import { useReduxEsSearch } from '../../../hooks/use_redux_es_search';
+import { SYNTHETICS_INDEX_PATTERN } from '../../../../../../common/constants';
+
+export const MONITOR_DURATION_US = 'monitor.duration.us';
+export const SYNTHETICS_CLS = 'browser.experience.cls';
+export const SYNTHETICS_LCP = 'browser.experience.lcp.us';
+export const SYNTHETICS_FCP = 'browser.experience.fcp.us';
+export const SYNTHETICS_ONLOAD_EVENT = 'browser.experience.load.us';
+export const SYNTHETICS_DCL = 'browser.experience.dcl.us';
+export const SYNTHETICS_STEP_NAME = 'synthetics.step.name.keyword';
+export const SYNTHETICS_STEP_DURATION = 'synthetics.step.duration.us';
+
+export type PreviousObjectMetrics = ReturnType<typeof usePreviousObjectMetrics>;
+
+export const usePreviousObjectMetrics = () => {
+  const { monitorId, stepIndex, checkGroupId } = useParams<{
+    monitorId: string;
+    stepIndex: string;
+    checkGroupId: string;
+  }>();
+
+  const { data } = useJourneySteps();
+
+  const timestamp = data?.details?.timestamp;
+
+  const { data: prevObjectMetrics } = useReduxEsSearch(
+    {
+      index: SYNTHETICS_INDEX_PATTERN,
+      body: {
+        track_total_hits: false,
+        sort: [
+          {
+            '@timestamp': {
+              order: 'desc',
+            },
+          },
+        ],
+        size: 0,
+        runtime_mappings: {
+          'synthetics.payload.transfer_size': {
+            type: 'long',
+          },
+        },
+        query: {
+          bool: {
+            filter: [
+              {
+                range: {
+                  '@timestamp': {
+                    lte: timestamp ?? 'now',
+                    gte: moment(timestamp).subtract(1, 'day').toISOString(),
+                  },
+                },
+              },
+              {
+                term: {
+                  config_id: monitorId,
+                },
+              },
+              {
+                term: {
+                  'synthetics.type': 'journey/network_info',
+                },
+              },
+              {
+                term: {
+                  'synthetics.step.index': stepIndex,
+                },
+              },
+              {
+                range: {
+                  '@timestamp': {
+                    gte: 'now-24h/h',
+                    lte: 'now',
+                  },
+                },
+              },
+            ],
+            must_not: [
+              {
+                term: {
+                  'monitor.check_group': {
+                    value: checkGroupId,
+                  },
+                },
+              },
+            ],
+          },
+        },
+        aggs: {
+          testRuns: {
+            cardinality: {
+              field: 'monitor.check_group',
+            },
+          },
+          objectCounts: {
+            terms: {
+              field: 'http.response.mime_type',
+              size: 500,
+            },
+            aggs: {
+              weight: {
+                sum: {
+                  field: 'synthetics.payload.transfer_size',
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+    [stepIndex, monitorId, checkGroupId],
+    {
+      name: `previousObjectMetrics/${monitorId}/${checkGroupId}/${stepIndex}/`,
+      isRequestReady: !!timestamp,
+    }
+  );
+
+  const mimeData: Record<string, { weight: number; count: number }> = {};
+
+  const testRuns = prevObjectMetrics?.aggregations?.testRuns?.value ?? 0;
+
+  prevObjectMetrics?.aggregations?.objectCounts?.buckets?.forEach((bucket) => {
+    mimeData[bucket.key] = {
+      weight: bucket.weight.value ? bucket.weight.value / testRuns : 0,
+      count: bucket.doc_count / testRuns,
+    };
+  });
+
+  return { mimeData };
+};
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/network_timings_breakdown.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/network_timings_breakdown.tsx
index 27ec3e6deffbb3..cd9a89c7e53916 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/network_timings_breakdown.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/network_timings_breakdown.tsx
@@ -11,6 +11,8 @@ import { ReportTypes } from '@kbn/observability-plugin/public';
 import { EuiSpacer, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { ClientPluginsStart } from '../../../../plugin';
+import { useSelectedLocation } from '../monitor_details/hooks/use_selected_location';
+import { LoadingState } from '../monitors_page/overview/overview/monitor_detail_flyout';
 
 export const NetworkTimingsBreakdown = ({ monitorId }: { monitorId: string }) => {
   const { observability } = useKibana<ClientPluginsStart>().services;
@@ -19,6 +21,11 @@ export const NetworkTimingsBreakdown = ({ monitorId }: { monitorId: string }) =>
 
   const { stepIndex } = useParams<{ checkGroupId: string; stepIndex: string }>();
 
+  const selectedLocation = useSelectedLocation();
+  if (!selectedLocation) {
+    return <LoadingState />;
+  }
+
   return (
     <>
       <EuiTitle size="xs">
@@ -47,6 +54,10 @@ export const NetworkTimingsBreakdown = ({ monitorId }: { monitorId: string }) =>
                 field: 'synthetics.step.index',
                 values: [stepIndex],
               },
+              {
+                field: 'observer.geo.name',
+                values: [selectedLocation.label],
+              },
             ],
           },
         ]}
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_detail_page.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_detail_page.tsx
index dfb72e3315cbd8..e190a45bd38ba8 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_detail_page.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_detail_page.tsx
@@ -89,7 +89,7 @@ export const StepDetailPage = () => {
         </EuiFlexItem>
         <EuiFlexItem grow={2}>
           <EuiPanel hasShadow={false} hasBorder>
-            <EuiFlexGroup>
+            <EuiFlexGroup gutterSize="xl">
               <EuiFlexItem grow={1}>
                 <ObjectWeightList />
               </EuiFlexItem>
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_metrics/step_metrics.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_metrics/step_metrics.tsx
index 3845fdf2def59a..1539c98111c5fb 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_metrics/step_metrics.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_metrics/step_metrics.tsx
@@ -134,7 +134,7 @@ const StatThreshold = ({
               {title}
               <span style={{ marginLeft: 5 }}>
                 {isSame ? (
-                  <EuiIcon type="minus" size="l" />
+                  <EuiIcon type="minus" size="l" color="subdued" />
                 ) : (
                   <EuiIcon type={isUp ? 'sortUp' : 'sortDown'} size="l" />
                 )}
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/color_palette.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/color_palette.tsx
index 7d43f7d1dd26f4..78fbc568a0983a 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/color_palette.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/color_palette.tsx
@@ -6,9 +6,17 @@
  */
 
 import React, { useState, useEffect } from 'react';
-import { EuiFlexGroup, EuiFlexItem, EuiText, EuiLoadingContent } from '@elastic/eui';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiText,
+  EuiLoadingContent,
+  EuiIcon,
+  EuiToolTip,
+} from '@elastic/eui';
 import { useTheme } from '@kbn/observability-plugin/public';
 import styled from 'styled-components';
+import { i18n } from '@kbn/i18n';
 import { colourPalette } from '../common/network_data/data_formatting';
 
 export const ColorPalette = ({
@@ -17,17 +25,52 @@ export const ColorPalette = ({
   percent,
   value,
   loading,
+  delta,
+  hasAnyThresholdBreach,
   labelWidth = 40,
-  valueWidth = 60,
+  valueWidth = 65,
 }: {
   label: string;
   mimeType: string;
   percent: number;
+  delta: number;
   value: string;
   loading: boolean;
+  hasAnyThresholdBreach: boolean;
   labelWidth?: number;
   valueWidth?: number;
 }) => {
+  const getToolTipContent = () => {
+    return i18n.translate('xpack.synthetics.stepDetails.palette.tooltip.label', {
+      defaultMessage: 'Value is {deltaLabel} compared to steps in previous 24 hours.',
+      values: {
+        deltaLabel:
+          Math.abs(delta) === 0
+            ? i18n.translate('xpack.synthetics.stepDetails.palette.tooltip.noChange', {
+                defaultMessage: 'same',
+              })
+            : delta > 0
+            ? i18n.translate('xpack.synthetics.stepDetails.palette.increased', {
+                defaultMessage: '{delta}% higher',
+                values: { delta },
+              })
+            : i18n.translate('xpack.synthetics.stepDetails.palette.decreased', {
+                defaultMessage: '{delta}% lower',
+                values: { delta },
+              }),
+      },
+    });
+  };
+
+  const getColor = () => {
+    if (Math.abs(delta) < 5) {
+      return 'default';
+    }
+    return delta > 5 ? 'danger' : 'success';
+  };
+
+  const hasDelta = Math.abs(delta) > 0;
+
   return (
     <EuiFlexGroup gutterSize="s">
       <EuiFlexItem grow={false} style={{ width: labelWidth }}>
@@ -45,10 +88,22 @@ export const ColorPalette = ({
           size="s"
           style={{ fontWeight: 'bold', whiteSpace: 'nowrap' }}
           className="eui-textRight"
+          color={getColor()}
         >
           {value}
         </EuiText>
       </EuiFlexItem>
+      {hasAnyThresholdBreach && (
+        <EuiFlexItem grow={false} style={{ width: 40 }}>
+          <EuiToolTip content={getToolTipContent()}>
+            {hasDelta ? (
+              <EuiIcon type={delta > 0 ? 'sortUp' : 'sortDown'} size="m" color={getColor()} />
+            ) : (
+              <EuiIcon type="minus" size="m" color="subdued" />
+            )}
+          </EuiToolTip>
+        </EuiFlexItem>
+      )}
     </EuiFlexGroup>
   );
 };
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/object_count_list.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/object_count_list.tsx
index bbfec1d56fc2f3..ec4555da24dc06 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/object_count_list.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/object_count_list.tsx
@@ -14,6 +14,10 @@ import { useObjectMetrics } from '../hooks/use_object_metrics';
 export const ObjectCountList = () => {
   const objectMetrics = useObjectMetrics();
 
+  const hasAnyThresholdBreach = objectMetrics.items.some(
+    ({ countDelta }) => Math.abs(Number(countDelta)) > 5
+  );
+
   return (
     <>
       <EuiFlexGroup>
@@ -28,17 +32,19 @@ export const ObjectCountList = () => {
           </EuiText>
         </EuiFlexItem>
       </EuiFlexGroup>
-      <EuiSpacer size="s" />
+      <EuiSpacer size="m" />
       <div>
-        {objectMetrics.items.map(({ label, mimeType, percent, count }) => (
+        {objectMetrics.items.map(({ label, mimeType, percent, count, countDelta }) => (
           <Fragment key={mimeType}>
             <ColorPalette
+              hasAnyThresholdBreach={hasAnyThresholdBreach}
               label={label}
               mimeType={mimeType}
               percent={percent}
               value={String(count)}
               valueWidth={30}
               loading={objectMetrics.loading}
+              delta={Number(countDelta)}
             />
             <EuiSpacer size="m" />
           </Fragment>
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/object_weight_list.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/object_weight_list.tsx
index c787fcc0711ba7..186f92b9782df4 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/object_weight_list.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_objects/object_weight_list.tsx
@@ -13,7 +13,9 @@ import { useObjectMetrics } from '../hooks/use_object_metrics';
 
 export const ObjectWeightList = () => {
   const objectMetrics = useObjectMetrics();
-
+  const hasAnyThresholdBreach = objectMetrics.items.some(
+    ({ weightDelta }) => Math.abs(Number(weightDelta)) > 5
+  );
   return (
     <>
       <EuiFlexGroup>
@@ -29,16 +31,18 @@ export const ObjectWeightList = () => {
           </EuiText>
         </EuiFlexItem>
       </EuiFlexGroup>
-      <EuiSpacer size="s" />
+      <EuiSpacer size="m" />
       <div>
-        {objectMetrics.items.map(({ label, mimeType, weightPercent, weight }) => (
+        {objectMetrics.items.map(({ label, mimeType, weightPercent, weight, weightDelta }) => (
           <Fragment key={mimeType}>
             <ColorPalette
+              hasAnyThresholdBreach={hasAnyThresholdBreach}
               label={label}
               mimeType={mimeType}
               percent={weightPercent}
               value={weight}
               loading={objectMetrics.loading}
+              delta={Number(weightDelta)}
             />
             <EuiSpacer size="m" />{' '}
           </Fragment>
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/network_timings_donut.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/network_timings_donut.tsx
index 439cc300afe4f6..e9d58427e88266 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/network_timings_donut.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/network_timings_donut.tsx
@@ -51,7 +51,7 @@ export const NetworkTimingsDonut = () => {
         <h3>{TIMINGS_BREAKDOWN}</h3>
       </EuiTitle>
       <EuiSpacer size="m" />
-      <Chart size={{ height: 180 }}>
+      <Chart size={{ height: 240 }}>
         <Settings theme={[themeOverrides, LIGHT_THEME ?? {}]} showLegend={false} />
         <Partition
           id="spec_1"
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_redux_es_search.ts b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_redux_es_search.ts
index 5afb38431878d8..01130c61faad25 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_redux_es_search.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/hooks/use_redux_es_search.ts
@@ -23,9 +23,10 @@ export const useReduxEsSearch = <
 >(
   params: TParams,
   fnDeps: any[],
-  options: { inspector?: IInspectorInfo; name: string }
+  options: { inspector?: IInspectorInfo; name: string; isRequestReady?: boolean }
 ) => {
-  const { name } = options ?? {};
+  const { name, isRequestReady = true } = options ?? {};
+
   const dispatch = useDispatch();
 
   const loadings = useSelector(selectEsQueryLoading);
@@ -33,11 +34,11 @@ export const useReduxEsSearch = <
   const errors = useSelector(selectEsQueryError);
 
   useEffect(() => {
-    if (params.index) {
+    if (params.index && isRequestReady) {
       dispatch(executeEsQueryAction.get({ params, name }));
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [dispatch, name, JSON.stringify(params)]);
+  }, [dispatch, name, JSON.stringify(params), isRequestReady]);
 
   return useMemo(() => {
     return {
diff --git a/x-pack/plugins/synthetics/server/queries/get_journey_details.ts b/x-pack/plugins/synthetics/server/queries/get_journey_details.ts
index bacc3cf64ae48d..f5b67f8e0e6a44 100644
--- a/x-pack/plugins/synthetics/server/queries/get_journey_details.ts
+++ b/x-pack/plugins/synthetics/server/queries/get_journey_details.ts
@@ -65,6 +65,11 @@ export const getJourneyDetails: UMElasticsearchQueryFn<
                   'monitor.id': thisJourneySource.monitor.id,
                 },
               },
+              {
+                term: {
+                  'observer.geo.name': thisJourneySource.observer?.geo?.name,
+                },
+              },
               {
                 term: {
                   'synthetics.type': 'journey/start',

From 06cec014790130a59d0e860beda2f5b325d3b20c Mon Sep 17 00:00:00 2001
From: Marco Liberati <dej611@users.noreply.github.com>
Date: Tue, 24 Jan 2023 11:32:17 +0100
Subject: [PATCH 44/54] [Lens] Enable previous time shift when using a date
 histogram (#149126)

## Summary

Fixes #104259

This PR expands the support of the `previous` time shift for
visualisations with a date histogram defined.
On the implementation side, an absolute time shift in the shape of
`endAt( startRange )` is leveraged to make it work the `previous` shift:
anchoring the shift to the beginning of the current range will make sure
to compute the right shift in terms of buckets in order to avoid
misaligned shifts and the main reason why this feature has been disabled
initially.

I've tried to condense an explanation here with this diagram of the
misalignment problem:


![previous_before](https://user-images.githubusercontent.com/924948/213234848-40e3382a-843d-43fa-83d1-769a5f2e7953.png)

With the current approach, there's a small time range overlap between
the two requested interval, but that's the result of the rounding logic
to get both shifts aligned.


![previous_2](https://user-images.githubusercontent.com/924948/213235429-1c99aefb-e18b-450a-b2d7-45b7d74c9e71.png)

The only alternative to avoid the overlap is to get a gap between the
two, but the former seems a better result to me.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to
identify risks that should be tested prior to the change/feature
release.

When forming the risk matrix, consider some of the following examples
and how they may potentially impact the change:

| Risk | Probability | Severity | Mitigation/Notes |

|---------------------------|-------------|----------|-------------------------|
| Multiple Spaces&mdash;unexpected behavior in non-default Kibana Space.
| Low | High | Integration tests will verify that all features are still
supported in non-default Kibana Space and when user switches between
spaces. |
| Multiple nodes&mdash;Elasticsearch polling might have race conditions
when multiple Kibana nodes are polling for the same tasks. | High | Low
| Tasks are idempotent, so executing them multiple times will not result
in logical error, but will degrade performance. To test for this case we
add plenty of unit tests around this logic and document manual testing
procedure. |
| Code should gracefully handle cases when feature X or plugin Y are
disabled. | Medium | High | Unit tests will verify that any feature flag
or plugin combination still results in our service operational. |
| [See more potential risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) |


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Co-authored-by: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
---
 .../form_based/dimension_panel/time_shift.tsx |  5 +-
 .../definitions/calculations/counter_rate.tsx | 20 ++---
 .../calculations/cumulative_sum.tsx           | 20 ++---
 .../definitions/calculations/differences.tsx  | 20 ++---
 .../calculations/moving_average.tsx           | 25 ++----
 .../definitions/calculations/time_scale.tsx   |  4 +-
 .../operations/definitions/cardinality.tsx    |  2 -
 .../operations/definitions/count.tsx          |  2 -
 .../formula/editor/math_completion.ts         |  6 +-
 .../operations/definitions/last_value.tsx     |  2 -
 .../operations/definitions/metrics.tsx        |  2 -
 .../operations/definitions/percentile.tsx     |  2 -
 .../definitions/percentile_ranks.tsx          |  2 -
 .../form_based/time_shift_utils.test.tsx      | 77 ++-----------------
 .../form_based/time_shift_utils.tsx           | 52 ++++---------
 .../datasources/form_based/to_expression.ts   | 21 ++++-
 .../translations/translations/fr-FR.json      |  1 -
 .../translations/translations/ja-JP.json      |  1 -
 .../translations/translations/zh-CN.json      |  1 -
 19 files changed, 74 insertions(+), 191 deletions(-)

diff --git a/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/time_shift.tsx b/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/time_shift.tsx
index 1d3cfefa66a4d1..8bf26114416de3 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/time_shift.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/time_shift.tsx
@@ -151,10 +151,7 @@ export function TimeShift({
               options={timeShiftOptions.filter(({ value }) => {
                 const parsedValue = parseTimeShift(value);
                 return (
-                  parsedValue &&
-                  !isValueTooSmall(parsedValue) &&
-                  !isValueNotMultiple(parsedValue) &&
-                  !(parsedValue === 'previous' && dateHistogramInterval.interval)
+                  parsedValue && !isValueTooSmall(parsedValue) && !isValueNotMultiple(parsedValue) // &&
                 );
               })}
               selectedOptions={getSelectedOption()}
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/counter_rate.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/counter_rate.tsx
index 3b89de8e94c51c..e516ce206eb877 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/counter_rate.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/counter_rate.tsx
@@ -18,8 +18,7 @@ import {
 } from './utils';
 import { DEFAULT_TIME_SCALE } from '../../time_scale_utils';
 import { OperationDefinition } from '..';
-import { getFormatFromPreviousColumn, getFilter, combineErrorMessages } from '../helpers';
-import { getDisallowedPreviousShiftMessage } from '../../../time_shift_utils';
+import { getFormatFromPreviousColumn, getFilter } from '../helpers';
 
 const ofName = buildLabelFunction((name?: string) => {
   return i18n.translate('xpack.lens.indexPattern.CounterRateOf', {
@@ -107,16 +106,13 @@ export const counterRateOperation: OperationDefinition<
     return hasDateField(newIndexPattern);
   },
   getErrorMessage: (layer: FormBasedLayer, columnId: string) => {
-    return combineErrorMessages([
-      getErrorsForDateReference(
-        layer,
-        columnId,
-        i18n.translate('xpack.lens.indexPattern.counterRate', {
-          defaultMessage: 'Counter rate',
-        })
-      ),
-      getDisallowedPreviousShiftMessage(layer, columnId),
-    ]);
+    return getErrorsForDateReference(
+      layer,
+      columnId,
+      i18n.translate('xpack.lens.indexPattern.counterRate', {
+        defaultMessage: 'Counter rate',
+      })
+    );
   },
   getDisabledStatus(indexPattern, layer, layerType) {
     const opName = i18n.translate('xpack.lens.indexPattern.counterRate', {
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/cumulative_sum.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/cumulative_sum.tsx
index 339f5e4bc40030..773f366990799a 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/cumulative_sum.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/cumulative_sum.tsx
@@ -17,8 +17,7 @@ import {
   checkForDataLayerType,
 } from './utils';
 import { OperationDefinition } from '..';
-import { getFormatFromPreviousColumn, getFilter, combineErrorMessages } from '../helpers';
-import { getDisallowedPreviousShiftMessage } from '../../../time_shift_utils';
+import { getFormatFromPreviousColumn, getFilter } from '../helpers';
 import { DOCUMENT_FIELD_NAME } from '../../../../../../common';
 
 const ofName = buildLabelFunction((name?: string) => {
@@ -107,16 +106,13 @@ export const cumulativeSumOperation: OperationDefinition<
     return true;
   },
   getErrorMessage: (layer: FormBasedLayer, columnId: string) => {
-    return combineErrorMessages([
-      getErrorsForDateReference(
-        layer,
-        columnId,
-        i18n.translate('xpack.lens.indexPattern.cumulativeSum', {
-          defaultMessage: 'Cumulative sum',
-        })
-      ),
-      getDisallowedPreviousShiftMessage(layer, columnId),
-    ]);
+    return getErrorsForDateReference(
+      layer,
+      columnId,
+      i18n.translate('xpack.lens.indexPattern.cumulativeSum', {
+        defaultMessage: 'Cumulative sum',
+      })
+    );
   },
   getDisabledStatus(indexPattern, layer, layerType) {
     const opName = i18n.translate('xpack.lens.indexPattern.cumulativeSum', {
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/differences.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/differences.tsx
index f2c379b5af5c15..f6ce789859b8c4 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/differences.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/differences.tsx
@@ -17,8 +17,7 @@ import {
   checkForDataLayerType,
 } from './utils';
 import { OperationDefinition } from '..';
-import { getFormatFromPreviousColumn, getFilter, combineErrorMessages } from '../helpers';
-import { getDisallowedPreviousShiftMessage } from '../../../time_shift_utils';
+import { getFormatFromPreviousColumn, getFilter } from '../helpers';
 
 const OPERATION_NAME = 'differences';
 
@@ -93,16 +92,13 @@ export const derivativeOperation: OperationDefinition<
     return hasDateField(newIndexPattern);
   },
   getErrorMessage: (layer: FormBasedLayer, columnId: string) => {
-    return combineErrorMessages([
-      getErrorsForDateReference(
-        layer,
-        columnId,
-        i18n.translate('xpack.lens.indexPattern.derivative', {
-          defaultMessage: 'Differences',
-        })
-      ),
-      getDisallowedPreviousShiftMessage(layer, columnId),
-    ]);
+    return getErrorsForDateReference(
+      layer,
+      columnId,
+      i18n.translate('xpack.lens.indexPattern.derivative', {
+        defaultMessage: 'Differences',
+      })
+    );
   },
   getDisabledStatus(indexPattern, layer, layerType) {
     const opName = i18n.translate('xpack.lens.indexPattern.derivative', {
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/moving_average.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/moving_average.tsx
index d7b46d09c0f1e9..1d20f205216987 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/moving_average.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/moving_average.tsx
@@ -21,14 +21,8 @@ import {
   checkForDataLayerType,
 } from './utils';
 import { updateColumnParam } from '../../layer_helpers';
-import {
-  getFormatFromPreviousColumn,
-  isValidNumber,
-  getFilter,
-  combineErrorMessages,
-} from '../helpers';
+import { getFormatFromPreviousColumn, isValidNumber, getFilter } from '../helpers';
 import type { OperationDefinition, ParamEditorProps } from '..';
-import { getDisallowedPreviousShiftMessage } from '../../../time_shift_utils';
 
 const ofName = buildLabelFunction((name?: string) => {
   return i18n.translate('xpack.lens.indexPattern.movingAverageOf', {
@@ -115,16 +109,13 @@ export const movingAverageOperation: OperationDefinition<
     return hasDateField(newIndexPattern);
   },
   getErrorMessage: (layer: FormBasedLayer, columnId: string) => {
-    return combineErrorMessages([
-      getErrorsForDateReference(
-        layer,
-        columnId,
-        i18n.translate('xpack.lens.indexPattern.movingAverage', {
-          defaultMessage: 'Moving average',
-        })
-      ),
-      getDisallowedPreviousShiftMessage(layer, columnId),
-    ]);
+    return getErrorsForDateReference(
+      layer,
+      columnId,
+      i18n.translate('xpack.lens.indexPattern.movingAverage', {
+        defaultMessage: 'Moving average',
+      })
+    );
   },
   helpComponent: () => <MovingAveragePopup />,
   helpComponentTitle: i18n.translate('xpack.lens.indexPattern.movingAverage.titleHelp', {
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/time_scale.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/time_scale.tsx
index 59eb7fea46233a..ecf91b9bd3609e 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/time_scale.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/calculations/time_scale.tsx
@@ -14,7 +14,6 @@ import { getErrorsForDateReference } from './utils';
 import type { OperationDefinition } from '..';
 import { combineErrorMessages, getFormatFromPreviousColumn } from '../helpers';
 import { FormBasedLayer } from '../../../types';
-import { getDisallowedPreviousShiftMessage } from '../../../time_shift_utils';
 
 type OverallMetricIndexPatternColumn<T extends string> = FormattedIndexPatternColumn &
   ReferenceBasedIndexPatternColumn & {
@@ -110,7 +109,6 @@ export const timeScaleOperation: OperationDefinition<TimeScaleIndexPatternColumn
             defaultMessage: 'Normalize by unit',
           })
         ),
-        getDisallowedPreviousShiftMessage(layer, columnId),
         !(layer.columns[columnId] as TimeScaleIndexPatternColumn).params.unit
           ? [
               i18n.translate('xpack.lens.indexPattern.timeScale.missingUnit', {
@@ -123,7 +121,7 @@ export const timeScaleOperation: OperationDefinition<TimeScaleIndexPatternColumn
         ) === -1
           ? [
               i18n.translate('xpack.lens.indexPattern.timeScale.wrongUnit', {
-                defaultMessage: 'Unknown unit specified, use s,m,h or d.',
+                defaultMessage: 'Unknown unit specified: use s, m, h or d.',
               }),
             ]
           : [],
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/cardinality.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/cardinality.tsx
index 04b11885c016ec..9d00f326619728 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/cardinality.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/cardinality.tsx
@@ -23,7 +23,6 @@ import {
   isColumnOfType,
 } from './helpers';
 import { adjustTimeScaleLabelSuffix } from '../time_scale_utils';
-import { getDisallowedPreviousShiftMessage } from '../../time_shift_utils';
 import { updateColumnParam } from '../layer_helpers';
 import { getColumnReducedTimeRangeError } from '../../reduced_time_range_utils';
 import { getGroupByKey } from './get_group_by_key';
@@ -93,7 +92,6 @@ export const cardinalityOperation: OperationDefinition<
   getErrorMessage: (layer, columnId, indexPattern) =>
     combineErrorMessages([
       getInvalidFieldMessage(layer.columns[columnId] as FieldBasedIndexPatternColumn, indexPattern),
-      getDisallowedPreviousShiftMessage(layer, columnId),
       getColumnReducedTimeRangeError(layer, columnId, indexPattern),
     ]),
   isTransferable: (column, newIndexPattern) => {
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/count.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/count.tsx
index 60c1a0cdf0f5dd..b5bd36d94225e1 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/count.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/count.tsx
@@ -23,7 +23,6 @@ import {
   isColumnOfType,
 } from './helpers';
 import { adjustTimeScaleLabelSuffix } from '../time_scale_utils';
-import { getDisallowedPreviousShiftMessage } from '../../time_shift_utils';
 import { updateColumnParam } from '../layer_helpers';
 import { getColumnReducedTimeRangeError } from '../../reduced_time_range_utils';
 import { getGroupByKey } from './get_group_by_key';
@@ -92,7 +91,6 @@ export const countOperation: OperationDefinition<CountIndexPatternColumn, 'field
   getErrorMessage: (layer, columnId, indexPattern) =>
     combineErrorMessages([
       getInvalidFieldMessage(layer.columns[columnId] as FieldBasedIndexPatternColumn, indexPattern),
-      getDisallowedPreviousShiftMessage(layer, columnId),
       getColumnReducedTimeRangeError(layer, columnId, indexPattern),
     ]),
   allowAsReference: true,
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/formula/editor/math_completion.ts b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/formula/editor/math_completion.ts
index a0a968a1368863..11d6797a1c9972 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/formula/editor/math_completion.ts
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/formula/editor/math_completion.ts
@@ -395,9 +395,9 @@ export async function getNamedArgumentSuggestions({
         if (dateHistogramInterval == null) return true;
         const parsedValue = parseTimeShift(value);
         return (
-          parsedValue !== 'previous' &&
-          (parsedValue === 'invalid' ||
-            Number.isInteger(parsedValue.asMilliseconds() / dateHistogramInterval))
+          parsedValue === 'previous' ||
+          parsedValue === 'invalid' ||
+          Number.isInteger(parsedValue.asMilliseconds() / dateHistogramInterval)
         );
       })
       .map(({ value }) => value);
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.tsx
index db9c7c0d6ab0c3..cde3f10b64c0b1 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/last_value.tsx
@@ -29,7 +29,6 @@ import {
   getFilter,
 } from './helpers';
 import { adjustTimeScaleLabelSuffix } from '../time_scale_utils';
-import { getDisallowedPreviousShiftMessage } from '../../time_shift_utils';
 import { isRuntimeField, isScriptedField } from './terms/helpers';
 import { FormRow } from './shared_components/form_row';
 import { getColumnReducedTimeRangeError } from '../../reduced_time_range_utils';
@@ -214,7 +213,6 @@ export const lastValueOperation: OperationDefinition<
     if (invalidSortFieldMessage) {
       errorMessages = [invalidSortFieldMessage];
     }
-    errorMessages.push(...(getDisallowedPreviousShiftMessage(layer, columnId) || []));
     errorMessages.push(...(getColumnReducedTimeRangeError(layer, columnId, indexPattern) || []));
     return errorMessages.length ? errorMessages : undefined;
   },
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/metrics.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/metrics.tsx
index bb15831a318545..4c11393af08e0a 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/metrics.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/metrics.tsx
@@ -25,7 +25,6 @@ import {
   ValueFormatConfig,
 } from './column_types';
 import { adjustTimeScaleLabelSuffix } from '../time_scale_utils';
-import { getDisallowedPreviousShiftMessage } from '../../time_shift_utils';
 import { updateColumnParam } from '../layer_helpers';
 import { getColumnReducedTimeRangeError } from '../../reduced_time_range_utils';
 import { getGroupByKey } from './get_group_by_key';
@@ -215,7 +214,6 @@ function buildMetricOperation<T extends MetricColumn<string>>({
           layer.columns[columnId] as FieldBasedIndexPatternColumn,
           indexPattern
         ),
-        getDisallowedPreviousShiftMessage(layer, columnId),
         getColumnReducedTimeRangeError(layer, columnId, indexPattern),
       ]),
     filterable: true,
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/percentile.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/percentile.tsx
index b55b1325a245ec..34f9f854d3745d 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/percentile.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/percentile.tsx
@@ -28,7 +28,6 @@ import {
 import { FieldBasedIndexPatternColumn } from './column_types';
 import { adjustTimeScaleLabelSuffix } from '../time_scale_utils';
 import { useDebouncedValue } from '../../../../shared_components';
-import { getDisallowedPreviousShiftMessage } from '../../time_shift_utils';
 import { FormRow } from './shared_components';
 import { getColumnReducedTimeRangeError } from '../../reduced_time_range_utils';
 import { getGroupByKey, groupByKey } from './get_group_by_key';
@@ -290,7 +289,6 @@ export const percentileOperation: OperationDefinition<
   getErrorMessage: (layer, columnId, indexPattern) =>
     combineErrorMessages([
       getInvalidFieldMessage(layer.columns[columnId] as FieldBasedIndexPatternColumn, indexPattern),
-      getDisallowedPreviousShiftMessage(layer, columnId),
       getColumnReducedTimeRangeError(layer, columnId, indexPattern),
     ]),
   paramEditor: function PercentileParamEditor({
diff --git a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/percentile_ranks.tsx b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/percentile_ranks.tsx
index 3d7b12802858c5..3aadcb293114ec 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/percentile_ranks.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/operations/definitions/percentile_ranks.tsx
@@ -23,7 +23,6 @@ import {
 import { FieldBasedIndexPatternColumn } from './column_types';
 import { adjustTimeScaleLabelSuffix } from '../time_scale_utils';
 import { useDebouncedValue } from '../../../../shared_components';
-import { getDisallowedPreviousShiftMessage } from '../../time_shift_utils';
 import { FormRow } from './shared_components';
 import { getColumnReducedTimeRangeError } from '../../reduced_time_range_utils';
 
@@ -168,7 +167,6 @@ export const percentileRanksOperation: OperationDefinition<
   getErrorMessage: (layer, columnId, indexPattern) =>
     combineErrorMessages([
       getInvalidFieldMessage(layer.columns[columnId] as FieldBasedIndexPatternColumn, indexPattern),
-      getDisallowedPreviousShiftMessage(layer, columnId),
       getColumnReducedTimeRangeError(layer, columnId, indexPattern),
     ]),
   paramEditor: function PercentileParamEditor({
diff --git a/x-pack/plugins/lens/public/datasources/form_based/time_shift_utils.test.tsx b/x-pack/plugins/lens/public/datasources/form_based/time_shift_utils.test.tsx
index 3405752d3ec4fd..a2495fbbbc1f65 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/time_shift_utils.test.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/time_shift_utils.test.tsx
@@ -6,80 +6,9 @@
  */
 
 import moment from 'moment';
-import { getDisallowedPreviousShiftMessage, resolveTimeShift } from './time_shift_utils';
-import { FormBasedLayer } from './types';
+import { resolveTimeShift } from './time_shift_utils';
 
 describe('time_shift_utils', () => {
-  describe('getDisallowedPreviousShiftMessage', () => {
-    const layer: FormBasedLayer = {
-      indexPatternId: '',
-      columnOrder: [],
-      columns: {
-        a: {
-          operationType: 'date_histogram',
-          dataType: 'date',
-          isBucketed: true,
-          label: '',
-          references: [],
-          sourceField: 'timestamp',
-        },
-        b: {
-          operationType: 'count',
-          dataType: 'number',
-          isBucketed: false,
-          label: 'non shifted',
-          references: [],
-          sourceField: 'records',
-        },
-        c: {
-          operationType: 'count',
-          dataType: 'number',
-          isBucketed: false,
-          label: 'shifted',
-          timeShift: '1d',
-          references: [],
-          sourceField: 'records',
-        },
-      },
-    };
-
-    it('shoud not produce an error for no shift', () => {
-      expect(getDisallowedPreviousShiftMessage(layer, 'b')).toBeUndefined();
-    });
-
-    it('shoud not produce an error for non-previous shift', () => {
-      expect(getDisallowedPreviousShiftMessage(layer, 'c')).toBeUndefined();
-    });
-
-    it('shoud produce an error for previous shift with date histogram', () => {
-      expect(
-        getDisallowedPreviousShiftMessage(
-          {
-            ...layer,
-            columns: { ...layer.columns, c: { ...layer.columns.c, timeShift: 'previous' } },
-          },
-          'c'
-        )
-      ).toHaveLength(1);
-    });
-
-    it('shoud not produce an error for previous shift without date histogram', () => {
-      expect(
-        getDisallowedPreviousShiftMessage(
-          {
-            ...layer,
-            columns: {
-              ...layer.columns,
-              a: { ...layer.columns.a, operationType: 'terms' },
-              c: { ...layer.columns.c, timeShift: 'previous' },
-            },
-          },
-          'c'
-        )
-      ).toBeUndefined();
-    });
-  });
-
   describe('resolveTimeShift', () => {
     const dateString = '2022-11-02T00:00:00.000Z';
     // shift by 2 days + 2500 s (to get a shift which is not a multiple of the given interval)
@@ -113,6 +42,10 @@ describe('time_shift_utils', () => {
         .toBe('261000s');
     });
 
+    it('should convert previous relative time shift to seconds (rounded) when a date histogram is present', () => {
+      expect(resolveTimeShift(`previous`, getDateRange(), 100, true)).toBe('171000s');
+    });
+
     it('should always include the passed date in the computed interval', () => {
       const dateRange = getDateRange();
       for (const anchor of ['startAt', 'endAt']) {
diff --git a/x-pack/plugins/lens/public/datasources/form_based/time_shift_utils.tsx b/x-pack/plugins/lens/public/datasources/form_based/time_shift_utils.tsx
index b673f00a343924..c287a93675f64c 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/time_shift_utils.tsx
+++ b/x-pack/plugins/lens/public/datasources/form_based/time_shift_utils.tsx
@@ -23,10 +23,13 @@ import type { FormBasedLayer, FormBasedPrivateState } from './types';
 import type { FramePublicAPI, IndexPattern } from '../../types';
 
 export function parseTimeShiftWrapper(timeShiftString: string, dateRange: DateRange) {
-  return isAbsoluteTimeShift(timeShiftString.trim())
-    ? parseAbsoluteTimeShift(timeShiftString, { from: dateRange.fromDate, to: dateRange.toDate })
-        .value
-    : parseTimeShift(timeShiftString);
+  if (isAbsoluteTimeShift(timeShiftString.trim())) {
+    return parseAbsoluteTimeShift(timeShiftString, {
+      from: dateRange.fromDate,
+      to: dateRange.toDate,
+    }).value;
+  }
+  return parseTimeShift(timeShiftString);
 }
 
 export const timeShiftOptions = [
@@ -142,7 +145,6 @@ export function getDateHistogramInterval(
 
 export function getLayerTimeShiftChecks({
   interval: dateHistogramInterval,
-  hasDateHistogram,
   canShift,
 }: ReturnType<typeof getDateHistogramInterval>) {
   return {
@@ -164,42 +166,11 @@ export function getLayerTimeShiftChecks({
       );
     },
     isInvalid: (parsedValue: ReturnType<typeof parseTimeShiftWrapper>) => {
-      return Boolean(
-        parsedValue === 'invalid' || (hasDateHistogram && parsedValue && parsedValue === 'previous')
-      );
+      return Boolean(parsedValue === 'invalid');
     },
   };
 }
 
-export function getDisallowedPreviousShiftMessage(
-  layer: FormBasedLayer,
-  columnId: string
-): string[] | undefined {
-  const currentColumn = layer.columns[columnId];
-  const hasPreviousShift =
-    currentColumn.timeShift &&
-    !isAbsoluteTimeShift(currentColumn.timeShift) &&
-    parseTimeShift(currentColumn.timeShift) === 'previous';
-  if (!hasPreviousShift) {
-    return;
-  }
-  const hasDateHistogram = Object.values(layer.columns).some(
-    (column) => column.operationType === 'date_histogram'
-  );
-  if (!hasDateHistogram) {
-    return;
-  }
-  return [
-    i18n.translate('xpack.lens.indexPattern.dateHistogramTimeShift', {
-      defaultMessage:
-        'In a single layer, you are unable to combine previous time range shift with date histograms. Either use an explicit time shift duration in "{column}" or replace the date histogram.',
-      values: {
-        column: currentColumn.label,
-      },
-    }),
-  ];
-}
-
 export function getStateTimeShiftWarningMessages(
   datatableUtilities: DatatableUtilitiesService,
   state: FormBasedPrivateState,
@@ -346,10 +317,15 @@ function roundAbsoluteInterval(timeShift: string, dateRange: DateRange, targetBa
 export function resolveTimeShift(
   timeShift: string | undefined,
   dateRange: DateRange,
-  targetBars: number
+  targetBars: number,
+  hasDateHistogram: boolean = false
 ) {
   if (timeShift && isAbsoluteTimeShift(timeShift)) {
     return roundAbsoluteInterval(timeShift, dateRange, targetBars);
   }
+  // Translate a relative "previous" shift into an absolute endAt(<current range start timestamp>)
+  if (timeShift && hasDateHistogram && timeShift === 'previous') {
+    return roundAbsoluteInterval(`endAt(${dateRange.fromDate})`, dateRange, targetBars);
+  }
   return timeShift;
 }
diff --git a/x-pack/plugins/lens/public/datasources/form_based/to_expression.ts b/x-pack/plugins/lens/public/datasources/form_based/to_expression.ts
index 61e17c72ca8294..9ec654c47868f1 100644
--- a/x-pack/plugins/lens/public/datasources/form_based/to_expression.ts
+++ b/x-pack/plugins/lens/public/datasources/form_based/to_expression.ts
@@ -158,7 +158,12 @@ function getExpressionForLayer(
         let aggAst = def.toEsAggsFn(
           {
             ...col,
-            timeShift: resolveTimeShift(col.timeShift, dateRange, histogramBarsTarget),
+            timeShift: resolveTimeShift(
+              col.timeShift,
+              dateRange,
+              histogramBarsTarget,
+              hasDateHistogram
+            ),
           },
           wrapInFilter || wrapInTimeFilter ? `${aggId}-metric` : aggId,
           indexPattern,
@@ -181,11 +186,21 @@ function getExpressionForLayer(
                   schema: 'bucket',
                   filter: col.filter && queryToAst(col.filter),
                   timeWindow: wrapInTimeFilter ? col.reducedTimeRange : undefined,
-                  timeShift: resolveTimeShift(col.timeShift, dateRange, histogramBarsTarget),
+                  timeShift: resolveTimeShift(
+                    col.timeShift,
+                    dateRange,
+                    histogramBarsTarget,
+                    hasDateHistogram
+                  ),
                 }),
               ]),
               customMetric: buildExpression({ type: 'expression', chain: [aggAst] }),
-              timeShift: resolveTimeShift(col.timeShift, dateRange, histogramBarsTarget),
+              timeShift: resolveTimeShift(
+                col.timeShift,
+                dateRange,
+                histogramBarsTarget,
+                hasDateHistogram
+              ),
             }
           ).toAst();
         }
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index ae0994252e749b..eb0d05782eaa85 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -18116,7 +18116,6 @@
     "xpack.lens.indexPattern.cumulativeSumOf": "Somme cumulée de {name}",
     "xpack.lens.indexPattern.dateHistogram.autoLongerExplanation": "Pour choisir l'intervalle, Lens divise la plage temporelle spécifiée par le paramètre avancé {targetBarSetting} et calcule le meilleur intervalle pour vos données. Par exemple, lorsque la plage temporelle est de 4 jours, les données sont divisées en compartiments horaires. Pour configurer le nombre de barres maximal, utilisez le paramètre avancé {maxBarSetting}.",
     "xpack.lens.indexPattern.dateHistogram.restrictedInterval": "Intervalle fixé à {intervalValue} en raison de restrictions d'agrégation.",
-    "xpack.lens.indexPattern.dateHistogramTimeShift": "Dans un calque unique, vous ne pouvez pas combiner un décalage de plage temporelle précédent avec des histogrammes de dates. Utilisez une durée de décalage temporel explicite dans \"{column}\" ou remplacez l’histogramme de dates.",
     "xpack.lens.indexPattern.derivativeOf": "Différences de {name}",
     "xpack.lens.indexPattern.fieldNoOperation": "Le champ {field} ne peut pas être utilisé sans opération",
     "xpack.lens.indexPattern.fieldsNotFound": "{count, plural, one {Champ} other {Champs}} {missingFields} {count, plural, one {introuvable} other {introuvables}}",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 1082e2930effbd..cfaed97466f363 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -18098,7 +18098,6 @@
     "xpack.lens.indexPattern.cumulativeSumOf": "{name}の累積和",
     "xpack.lens.indexPattern.dateHistogram.autoLongerExplanation": "間隔を選択するために、Lensでは、指定された時間範囲が{targetBarSetting}詳細設定で分割され、データに最適な間隔が計算されます。たとえば、時間範囲が4日の場合、データは1時間のバケットに分割されます。バーの最大数を設定するには、{maxBarSetting}詳細設定を使用します。",
     "xpack.lens.indexPattern.dateHistogram.restrictedInterval": "集約の制限により間隔は {intervalValue} に固定されています。",
-    "xpack.lens.indexPattern.dateHistogramTimeShift": "単一のレイヤーでは、前の時間範囲シフトと日付ヒストグラムを結合できません。\"{column}\"で明示的な時間シフト期間を使用するか、日付ヒストグラムを置換してください。",
     "xpack.lens.indexPattern.derivativeOf": "{name} の差異",
     "xpack.lens.indexPattern.fieldNoOperation": "フィールド{field}は演算なしで使用できません",
     "xpack.lens.indexPattern.fieldsNotFound": "{count, plural, other {個のフィールド}} {missingFields} {count, plural, other {が}}見つかりません",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 9a3d2c6a2b0b51..add5fcecf5ea69 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -18121,7 +18121,6 @@
     "xpack.lens.indexPattern.cumulativeSumOf": "{name} 的累计和",
     "xpack.lens.indexPattern.dateHistogram.autoLongerExplanation": "要选择时间间隔，Lens 会按 {targetBarSetting} 高级设置分割指定的时间范围，并为您的数据计算最佳时间间隔。例如，当时间间隔为 4 天时，数据将分割为每小时存储桶。要配置最大条形数，请使用 {maxBarSetting} 高级设置。",
     "xpack.lens.indexPattern.dateHistogram.restrictedInterval": "由于聚合限制，时间间隔固定为 {intervalValue}。",
-    "xpack.lens.indexPattern.dateHistogramTimeShift": "在单个图层中，您无法组合上一时间范围偏移与 Date Histogram。在“{column}”中使用显式时间偏移持续时间，或替换 Date Histogram。",
     "xpack.lens.indexPattern.derivativeOf": "{name} 的差异",
     "xpack.lens.indexPattern.fieldNoOperation": "没有运算，无法使用字段 {field}",
     "xpack.lens.indexPattern.fieldsNotFound": "找不到{count, plural, other {字段}} {missingFields} {count, plural, other {}}",

From 48eb4d51d12a0c37a0e197ff7bb43db8d3d23d20 Mon Sep 17 00:00:00 2001
From: Jordan <51442161+JordanSh@users.noreply.github.com>
Date: Tue, 24 Jan 2023 12:54:15 +0200
Subject: [PATCH 45/54] [Cloud Posture] CIS AWS support - changes to findings
 tables (#148945)

---
 .../common/schemas/csp_rule_metadata.ts       |  1 +
 .../common/utils/helpers.ts                   | 14 +++-
 .../components/compliance_score_bar.tsx       | 77 +++++++++++++++++++
 .../compliance_charts/risks_table.tsx         | 63 +--------------
 .../pages/findings/__mocks__/findings.ts      |  1 +
 .../latest_findings_table.test.tsx            |  6 +-
 .../latest_findings/latest_findings_table.tsx |  7 +-
 .../findings_by_resource_container.tsx        |  4 +-
 .../findings_by_resource_table.test.tsx       | 32 ++++----
 .../findings_by_resource_table.tsx            | 42 +++-------
 .../resource_findings_table.tsx               |  2 +-
 .../use_findings_by_resource.ts               | 32 ++++++--
 .../pages/findings/layout/findings_layout.tsx | 39 +++++++---
 .../collectors/accounts_stats_collector.ts    |  2 +-
 .../get_grouped_findings_evaluation.ts        |  2 +-
 .../compliance_dashboard/get_stats.test.ts    |  8 +-
 .../routes/compliance_dashboard/get_stats.ts  | 11 +--
 .../routes/compliance_dashboard/get_trends.ts |  2 +-
 .../saved_objects/migrations/csp_rule.ts      |  2 +-
 .../migrations/csp_rule_template.ts           |  2 +-
 .../translations/translations/fr-FR.json      |  4 -
 .../translations/translations/ja-JP.json      |  4 -
 .../translations/translations/zh-CN.json      |  4 -
 .../pages/findings.ts                         | 20 ++---
 24 files changed, 206 insertions(+), 175 deletions(-)
 create mode 100644 x-pack/plugins/cloud_security_posture/public/components/compliance_score_bar.tsx

diff --git a/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_metadata.ts b/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_metadata.ts
index 9bfd8eb5b8f296..40d84e95243371 100644
--- a/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_metadata.ts
+++ b/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_metadata.ts
@@ -12,6 +12,7 @@ export const cspRuleMetadataSchema = rt.object({
     name: rt.string(),
     id: rt.string(),
     version: rt.string(),
+    rule_number: rt.maybe(rt.string()),
   }),
   default_value: rt.maybe(rt.string()),
   description: rt.string(),
diff --git a/x-pack/plugins/cloud_security_posture/common/utils/helpers.ts b/x-pack/plugins/cloud_security_posture/common/utils/helpers.ts
index d128713e6fdd6e..a7f07f70fd89ea 100644
--- a/x-pack/plugins/cloud_security_posture/common/utils/helpers.ts
+++ b/x-pack/plugins/cloud_security_posture/common/utils/helpers.ts
@@ -18,7 +18,7 @@ import {
   CLOUDBEAT_VANILLA,
   CSP_RULE_TEMPLATE_SAVED_OBJECT_TYPE,
 } from '../constants';
-import { BenchmarkId } from '../types';
+import type { BenchmarkId, Score } from '../types';
 
 /**
  * @example
@@ -72,3 +72,15 @@ export function assert(condition: any, msg?: string): asserts condition {
     throw new Error(msg);
   }
 }
+
+/**
+ * @param value value is [0, 1] range
+ */
+export const roundScore = (value: number): Score => Number((value * 100).toFixed(1));
+
+export const calculatePostureScore = (passed: number, failed: number): Score => {
+  const total = passed + failed;
+  if (total === 0) return total;
+
+  return roundScore(passed / (passed + failed));
+};
diff --git a/x-pack/plugins/cloud_security_posture/public/components/compliance_score_bar.tsx b/x-pack/plugins/cloud_security_posture/public/components/compliance_score_bar.tsx
new file mode 100644
index 00000000000000..cc5a6de2a6c531
--- /dev/null
+++ b/x-pack/plugins/cloud_security_posture/public/components/compliance_score_bar.tsx
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiText, EuiToolTip, useEuiTheme } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React from 'react';
+import { calculatePostureScore } from '../../common/utils/helpers';
+import { statusColors } from '../common/constants';
+
+export const ComplianceScoreBar = ({
+  totalPassed,
+  totalFailed,
+}: {
+  totalPassed: number;
+  totalFailed: number;
+}) => {
+  const { euiTheme } = useEuiTheme();
+  const complianceScore = calculatePostureScore(totalPassed, totalFailed);
+
+  return (
+    <EuiFlexGroup
+      gutterSize="none"
+      alignItems="center"
+      justifyContent="flexEnd"
+      style={{ gap: euiTheme.size.s }}
+    >
+      <EuiFlexItem>
+        <EuiToolTip
+          content={i18n.translate('xpack.csp.complianceScoreBar.tooltipTitle', {
+            defaultMessage: '{failed} failed and {passed} passed findings',
+            values: {
+              passed: totalPassed,
+              failed: totalFailed,
+            },
+          })}
+        >
+          <EuiFlexGroup
+            gutterSize="none"
+            style={{
+              height: euiTheme.size.xs,
+              borderRadius: euiTheme.border.radius.medium,
+              overflow: 'hidden',
+              gap: 1,
+            }}
+          >
+            {!!totalFailed && (
+              <EuiFlexItem
+                style={{
+                  flex: totalFailed,
+                  background: statusColors.failed,
+                }}
+              />
+            )}
+            {!!totalPassed && (
+              <EuiFlexItem
+                style={{
+                  flex: totalPassed,
+                  background: statusColors.passed,
+                }}
+              />
+            )}
+          </EuiFlexGroup>
+        </EuiToolTip>
+      </EuiFlexItem>
+      <EuiFlexItem grow={false}>
+        <EuiText
+          size="xs"
+          style={{ fontWeight: euiTheme.font.weight.bold }}
+        >{`${complianceScore.toFixed(0)}%`}</EuiText>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/compliance_dashboard/compliance_charts/risks_table.tsx b/x-pack/plugins/cloud_security_posture/public/pages/compliance_dashboard/compliance_charts/risks_table.tsx
index 34fdff3eac69c8..51f7847ffe5a1c 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/compliance_dashboard/compliance_charts/risks_table.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/compliance_dashboard/compliance_charts/risks_table.tsx
@@ -13,12 +13,9 @@ import {
   EuiFlexItem,
   EuiInMemoryTable,
   EuiLink,
-  EuiText,
-  EuiToolTip,
-  useEuiTheme,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { statusColors } from '../../../common/constants';
+import { ComplianceScoreBar } from '../../../components/compliance_score_bar';
 import { ComplianceDashboardData, GroupedFindingsEvaluation } from '../../../../common/types';
 
 export interface RisksTableProps {
@@ -49,8 +46,6 @@ export const RisksTable = ({
   viewAllButtonTitle,
   compact,
 }: RisksTableProps) => {
-  const { euiTheme } = useEuiTheme();
-
   const columns: Array<EuiBasicTableColumn<GroupedFindingsEvaluation>> = useMemo(
     () => [
       {
@@ -76,63 +71,11 @@ export const RisksTable = ({
               defaultMessage: 'Compliance',
             }),
         render: (postureScore: GroupedFindingsEvaluation['postureScore'], data) => (
-          <EuiFlexGroup
-            gutterSize="none"
-            alignItems="center"
-            justifyContent="flexEnd"
-            style={{ gap: euiTheme.size.s }}
-          >
-            <EuiFlexItem>
-              <EuiToolTip
-                content={i18n.translate(
-                  'xpack.csp.complianceDashboard.complianceByCisSection.complianceColumnTooltip',
-                  {
-                    defaultMessage: '{passed}/{total}',
-                    values: { passed: data.totalPassed, total: data.totalFindings },
-                  }
-                )}
-              >
-                <EuiFlexGroup
-                  gutterSize="none"
-                  style={{
-                    height: euiTheme.size.xs,
-                    borderRadius: euiTheme.border.radius.medium,
-                    overflow: 'hidden',
-                    gap: 1,
-                  }}
-                >
-                  <EuiFlexItem
-                    style={{
-                      flex: data.totalFailed,
-                      background: statusColors.failed,
-                    }}
-                  />
-                  <EuiFlexItem
-                    style={{
-                      flex: data.totalPassed,
-                      background: statusColors.passed,
-                    }}
-                  />
-                </EuiFlexGroup>
-              </EuiToolTip>
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <EuiText size="xs" style={{ fontWeight: euiTheme.font.weight.bold }}>{`${
-                postureScore?.toFixed(0) || 0
-              }%`}</EuiText>
-            </EuiFlexItem>
-          </EuiFlexGroup>
+          <ComplianceScoreBar totalPassed={data.totalPassed} totalFailed={data.totalFailed} />
         ),
       },
     ],
-    [
-      compact,
-      euiTheme.border.radius.medium,
-      euiTheme.font.weight.bold,
-      euiTheme.size.s,
-      euiTheme.size.xs,
-      onCellClick,
-    ]
+    [compact, onCellClick]
   );
 
   const sortedByComplianceScore = getTopRisks(cisSectionsEvaluations, maxItems);
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/__mocks__/findings.ts b/x-pack/plugins/cloud_security_posture/public/pages/findings/__mocks__/findings.ts
index 48956856bf31c5..274d5a789b981e 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/findings/__mocks__/findings.ts
+++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/__mocks__/findings.ts
@@ -89,6 +89,7 @@ export const mockFindingsHit: CspFinding = {
       'Kubernetes provides a `default` service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. The default service account should be configured such that it does not provide a service account token and does not have any explicit rights assignments.\n',
     version: '1.0',
     benchmark: {
+      rule_number: '1.1.1',
       name: 'CIS Kubernetes V1.23',
       id: 'cis_k8s',
       version: 'v1.0.0',
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings/latest_findings_table.test.tsx b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings/latest_findings_table.test.tsx
index 56b7c624287e96..f082171b22da1c 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings/latest_findings_table.test.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings/latest_findings_table.test.tsx
@@ -32,6 +32,7 @@ const getFakeFindings = (name: string): CspFinding & { id: string } => ({
   rule: {
     audit: chance.paragraph(),
     benchmark: {
+      rule_number: '1.1.1',
       name: 'CIS Kubernetes',
       version: '1.6.0',
       id: 'cis_k8s',
@@ -140,12 +141,11 @@ describe('<FindingsTable />', () => {
     const row = data[0];
 
     const columns = [
-      'resource.id',
       'result.evaluation',
-      'resource.sub_type',
+      'resource.id',
       'resource.name',
+      'resource.sub_type',
       'rule.name',
-      'cluster_id',
     ];
 
     columns.forEach((field) => {
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings/latest_findings_table.tsx b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings/latest_findings_table.tsx
index 12b26f1b94bd1f..34f29fa6473a21 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings/latest_findings_table.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings/latest_findings_table.tsx
@@ -64,14 +64,13 @@ const FindingsTableComponent = ({
   ] = useMemo(
     () => [
       getExpandColumn<CspFinding>({ onClick: setSelectedFinding }),
-      createColumnWithFilters(baseFindingsColumns['resource.id'], { onAddFilter }),
       createColumnWithFilters(baseFindingsColumns['result.evaluation'], { onAddFilter }),
-      createColumnWithFilters(baseFindingsColumns['resource.sub_type'], { onAddFilter }),
+      createColumnWithFilters(baseFindingsColumns['resource.id'], { onAddFilter }),
       createColumnWithFilters(baseFindingsColumns['resource.name'], { onAddFilter }),
+      createColumnWithFilters(baseFindingsColumns['resource.sub_type'], { onAddFilter }),
+      baseFindingsColumns['rule.benchmark.rule_number'],
       createColumnWithFilters(baseFindingsColumns['rule.name'], { onAddFilter }),
-      createColumnWithFilters(baseFindingsColumns['rule.benchmark.name'], { onAddFilter }),
       baseFindingsColumns['rule.section'],
-      createColumnWithFilters(baseFindingsColumns.cluster_id, { onAddFilter }),
       baseFindingsColumns['@timestamp'],
     ],
     [onAddFilter]
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_container.tsx b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_container.tsx
index 10f2ef8dcec2fd..9964077f42f447 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_container.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_container.tsx
@@ -42,7 +42,7 @@ const getDefaultQuery = ({
   query,
   filters,
   pageIndex: 0,
-  sortDirection: 'desc',
+  sortDirection: 'asc',
 });
 
 export const FindingsByResourceContainer = ({ dataView }: FindingsBaseProps) => (
@@ -179,7 +179,7 @@ const LatestFindingsByResource = ({ dataView }: FindingsBaseProps) => {
               });
             }}
             sorting={{
-              sort: { field: 'failed_findings', direction: urlQuery.sortDirection },
+              sort: { field: 'compliance_score', direction: urlQuery.sortDirection },
             }}
             onAddFilter={(field, value, negate) =>
               setUrlQuery({
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_table.test.tsx b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_table.test.tsx
index f3f05fcc9f9f02..a98cedafc6610a 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_table.test.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_table.test.tsx
@@ -7,20 +7,19 @@
 import React from 'react';
 import { render, screen, within } from '@testing-library/react';
 import * as TEST_SUBJECTS from '../test_subjects';
-import { FindingsByResourceTable, formatNumber, getResourceId } from './findings_by_resource_table';
+import { FindingsByResourceTable, getResourceId } from './findings_by_resource_table';
 import type { PropsOf } from '@elastic/eui';
 import Chance from 'chance';
-import numeral from '@elastic/numeral';
 import { TestProvider } from '../../../test/test_provider';
 import type { FindingsByResourcePage } from './use_findings_by_resource';
+import { calculatePostureScore } from '../../../../common/utils/helpers';
 
 const chance = new Chance();
 
 const getFakeFindingsByResource = (): FindingsByResourcePage => {
-  const count = chance.integer();
-  const total = chance.integer() + count + 1;
-  const normalized = count / total;
-
+  const failed = chance.natural();
+  const passed = chance.natural();
+  const total = failed + passed;
   const [resourceName, resourceSubtype, ruleBenchmarkName, ...cisSections] = chance.unique(
     chance.word,
     5
@@ -33,9 +32,11 @@ const getFakeFindingsByResource = (): FindingsByResourcePage => {
     'resource.sub_type': resourceSubtype,
     'rule.section': cisSections,
     'rule.benchmark.name': ruleBenchmarkName,
-    failed_findings: {
-      count,
-      normalized,
+    compliance_score: passed / total,
+    findings: {
+      failed_findings: failed,
+      passed_findings: passed,
+      normalized: passed / total,
       total_findings: total,
     },
   };
@@ -50,7 +51,7 @@ describe('<FindingsByResourceTable />', () => {
       items: [],
       pagination: { pageIndex: 0, pageSize: 10, totalItemCount: 0 },
       sorting: {
-        sort: { field: 'failed_findings', direction: 'desc' },
+        sort: { field: 'compliance_score', direction: 'desc' },
       },
       setTableOptions: jest.fn(),
       onAddFilter: jest.fn(),
@@ -75,7 +76,7 @@ describe('<FindingsByResourceTable />', () => {
       items: data,
       pagination: { pageIndex: 0, pageSize: 10, totalItemCount: 0 },
       sorting: {
-        sort: { field: 'failed_findings', direction: 'desc' },
+        sort: { field: 'compliance_score', direction: 'desc' },
       },
       setTableOptions: jest.fn(),
       onAddFilter: jest.fn(),
@@ -97,10 +98,13 @@ describe('<FindingsByResourceTable />', () => {
         expect(within(row).getByText(item['resource.name'])).toBeInTheDocument();
       if (item['resource.sub_type'])
         expect(within(row).getByText(item['resource.sub_type'])).toBeInTheDocument();
-      expect(within(row).getByText(item['rule.section'].join(', '))).toBeInTheDocument();
-      expect(within(row).getByText(formatNumber(item.failed_findings.count))).toBeInTheDocument();
       expect(
-        within(row).getByText(new RegExp(numeral(item.failed_findings.normalized).format('0%')))
+        within(row).getByText(
+          `${calculatePostureScore(
+            item.findings.passed_findings,
+            item.findings.failed_findings
+          ).toFixed(0)}%`
+        )
       ).toBeInTheDocument();
     });
   });
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_table.tsx b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_table.tsx
index 18ddb34256df96..630edd6cb8dcf8 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_table.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/findings_by_resource_table.tsx
@@ -8,17 +8,16 @@ import React, { useMemo } from 'react';
 import {
   EuiEmptyPrompt,
   EuiBasicTable,
-  EuiTextColor,
   type EuiTableFieldDataColumnType,
   type CriteriaWithPagination,
   type Pagination,
   EuiToolTip,
   EuiBasicTableProps,
 } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n-react';
 import numeral from '@elastic/numeral';
 import { Link, generatePath } from 'react-router-dom';
+import { ComplianceScoreBar } from '../../../components/compliance_score_bar';
 import * as TEST_SUBJECTS from '../test_subjects';
 import type { FindingsByResourcePage } from './use_findings_by_resource';
 import { findingsNavigation } from '../../../common/navigation/constants';
@@ -31,9 +30,7 @@ import {
 export const formatNumber = (value: number) =>
   value < 1000 ? value : numeral(value).format('0.0a');
 
-type Sorting = Required<
-  EuiBasicTableProps<Pick<FindingsByResourcePage, 'failed_findings'>>
->['sorting'];
+type Sorting = Required<EuiBasicTableProps<FindingsByResourcePage>>['sorting'];
 
 interface Props {
   items: FindingsByResourcePage[];
@@ -66,9 +63,8 @@ const FindingsByResourceTableComponent = ({
       createColumnWithFilters(findingsByResourceColumns['resource.sub_type'], { onAddFilter }),
       createColumnWithFilters(findingsByResourceColumns['resource.name'], { onAddFilter }),
       createColumnWithFilters(findingsByResourceColumns['rule.benchmark.name'], { onAddFilter }),
-      findingsByResourceColumns['rule.section'],
       createColumnWithFilters(findingsByResourceColumns.cluster_id, { onAddFilter }),
-      findingsByResourceColumns.failed_findings,
+      findingsByResourceColumns.compliance_score,
     ],
     [onAddFilter]
   );
@@ -106,6 +102,7 @@ const baseColumns: Array<EuiTableFieldDataColumnType<FindingsByResourcePage>> =
   {
     ...baseFindingsColumns['resource.id'],
     field: 'resource_id',
+    width: '15%',
     render: (resourceId: FindingsByResourcePage['resource_id']) => (
       <Link
         to={generatePath(findingsNavigation.resource_findings.path, { resourceId })}
@@ -139,36 +136,21 @@ const baseColumns: Array<EuiTableFieldDataColumnType<FindingsByResourcePage>> =
   },
   baseFindingsColumns.cluster_id,
   {
-    field: 'failed_findings',
+    field: 'compliance_score',
     width: '150px',
     truncateText: true,
     sortable: true,
     name: (
       <FormattedMessage
-        id="xpack.csp.findings.findingsByResourceTable.failedFindingsColumnLabel"
-        defaultMessage="Failed Findings"
+        id="xpack.csp.findings.findingsByResourceTable.complianceScoreColumnLabel"
+        defaultMessage="Compliance Score"
       />
     ),
-    render: (failedFindings: FindingsByResourcePage['failed_findings']) => (
-      <EuiToolTip
-        content={i18n.translate(
-          'xpack.csp.findings.findingsByResourceTable.failedFindingsToolTip',
-          {
-            defaultMessage: '{failed} out of {total}',
-            values: {
-              failed: failedFindings.count,
-              total: failedFindings.total_findings,
-            },
-          }
-        )}
-      >
-        <>
-          <EuiTextColor color={failedFindings.count === 0 ? '' : 'danger'}>
-            {formatNumber(failedFindings.count)}
-          </EuiTextColor>
-          <span> ({numeral(failedFindings.normalized).format('0%')})</span>
-        </>
-      </EuiToolTip>
+    render: (complianceScore: FindingsByResourcePage['compliance_score'], data) => (
+      <ComplianceScoreBar
+        totalPassed={data.findings.passed_findings}
+        totalFailed={data.findings.failed_findings}
+      />
     ),
     dataType: 'number',
   },
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/resource_findings/resource_findings_table.tsx b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/resource_findings/resource_findings_table.tsx
index 2de252b5515e0e..41f18af723b8ec 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/resource_findings/resource_findings_table.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/resource_findings/resource_findings_table.tsx
@@ -57,8 +57,8 @@ const ResourceFindingsTableComponent = ({
     () => [
       getExpandColumn<CspFinding>({ onClick: setSelectedFinding }),
       createColumnWithFilters(baseFindingsColumns['result.evaluation'], { onAddFilter }),
+      baseFindingsColumns['rule.benchmark.rule_number'],
       createColumnWithFilters(baseFindingsColumns['rule.name'], { onAddFilter }),
-      createColumnWithFilters(baseFindingsColumns['rule.benchmark.name'], { onAddFilter }),
       baseFindingsColumns['rule.section'],
       baseFindingsColumns['@timestamp'],
     ],
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/use_findings_by_resource.ts b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/use_findings_by_resource.ts
index 139013d88cec49..4a0110e0d536e7 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/use_findings_by_resource.ts
+++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/latest_findings_by_resource/use_findings_by_resource.ts
@@ -9,12 +9,12 @@ import { lastValueFrom } from 'rxjs';
 import { IKibanaSearchRequest, IKibanaSearchResponse } from '@kbn/data-plugin/common';
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { Pagination } from '@elastic/eui';
+import { MAX_FINDINGS_TO_LOAD } from '../../../common/constants';
 import { useKibana } from '../../../common/hooks/use_kibana';
 import { showErrorToast } from '../latest_findings/use_latest_findings';
 import type { FindingsBaseEsQuery, Sort } from '../types';
 import { getAggregationCount, getFindingsCountAggQuery } from '../utils/utils';
 import { CSP_LATEST_FINDINGS_DATA_VIEW } from '../../../../common/constants';
-import { MAX_FINDINGS_TO_LOAD } from '../../../common/constants';
 
 interface UseFindingsByResourceOptions extends FindingsBaseEsQuery {
   enabled: boolean;
@@ -35,11 +35,13 @@ type FindingsAggResponse = IKibanaSearchResponse<
 >;
 
 export interface FindingsByResourcePage {
-  failed_findings: {
-    count: number;
+  findings: {
+    failed_findings: number;
+    passed_findings: number;
     normalized: number;
     total_findings: number;
   };
+  compliance_score: number;
   resource_id: string;
   cluster_id: string;
   'resource.name': string;
@@ -56,6 +58,8 @@ interface FindingsByResourceAggs {
 
 interface FindingsAggBucket extends estypes.AggregationsStringRareTermsBucketKeys {
   failed_findings: estypes.AggregationsMultiBucketBase;
+  compliance_score: estypes.AggregationsScriptedMetricAggregate;
+  passed_findings: estypes.AggregationsMultiBucketBase;
   name: estypes.AggregationsMultiBucketAggregateBase<estypes.AggregationsStringTermsBucketKeys>;
   subtype: estypes.AggregationsMultiBucketAggregateBase<estypes.AggregationsStringTermsBucketKeys>;
   cluster_id: estypes.AggregationsMultiBucketAggregateBase<estypes.AggregationsStringTermsBucketKeys>;
@@ -92,15 +96,27 @@ export const getFindingsByResourceAggQuery = ({
           failed_findings: {
             filter: { term: { 'result.evaluation': 'failed' } },
           },
+          passed_findings: {
+            filter: { term: { 'result.evaluation': 'passed' } },
+          },
           cluster_id: {
             terms: { field: 'cluster_id', size: 1 },
           },
-          sort_failed_findings: {
+          compliance_score: {
+            bucket_script: {
+              buckets_path: {
+                passed: 'passed_findings>_count',
+                failed: 'failed_findings>_count',
+              },
+              script: 'params.passed / (params.passed + params.failed)',
+            },
+          },
+          sort_by_compliance_score: {
             bucket_sort: {
               size: MAX_FINDINGS_TO_LOAD,
               sort: [
                 {
-                  'failed_findings>_count': { order: sortDirection },
+                  compliance_score: { order: sortDirection },
                   _count: { order: 'desc' },
                   _key: { order: 'asc' },
                 },
@@ -177,11 +193,13 @@ const createFindingsByResource = (resource: FindingsAggBucket): FindingsByResour
     cluster_id: resource.cluster_id.buckets[0]?.key,
     ['rule.section']: resource.cis_sections.buckets.map((v) => v.key),
     ['rule.benchmark.name']: resource.benchmarkName.buckets[0]?.key,
-    failed_findings: {
-      count: resource.failed_findings.doc_count,
+    compliance_score: resource.compliance_score.value,
+    findings: {
+      failed_findings: resource.failed_findings.doc_count,
       normalized:
         resource.doc_count > 0 ? resource.failed_findings.doc_count / resource.doc_count : 0,
       total_findings: resource.doc_count,
+      passed_findings: resource.passed_findings.doc_count,
     },
   };
 };
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/findings/layout/findings_layout.tsx b/x-pack/plugins/cloud_security_posture/public/pages/findings/layout/findings_layout.tsx
index e279d78ac0b7c4..1112d1f9d36888 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/findings/layout/findings_layout.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/findings/layout/findings_layout.tsx
@@ -123,9 +123,10 @@ const baseColumns = [
   },
   {
     field: 'rule.name',
-    name: i18n.translate('xpack.csp.findings.findingsTable.findingsTableColumn.ruleColumnLabel', {
-      defaultMessage: 'Rule',
-    }),
+    name: i18n.translate(
+      'xpack.csp.findings.findingsTable.findingsTableColumn.ruleNameColumnLabel',
+      { defaultMessage: 'Rule Name' }
+    ),
     sortable: true,
     render: (name: string) => (
       <EuiToolTip content={name} position="left" anchorClassName="eui-textTruncate">
@@ -134,12 +135,29 @@ const baseColumns = [
     ),
   },
   {
-    field: 'rule.benchmark.name',
+    field: 'rule.benchmark.rule_number',
     name: i18n.translate(
-      'xpack.csp.findings.findingsTable.findingsTableColumn.ruleBenchmarkColumnLabel',
-      { defaultMessage: 'Benchmark' }
+      'xpack.csp.findings.findingsTable.findingsTableColumn.ruleNumberColumnLabel',
+      {
+        defaultMessage: 'Rule Number',
+      }
+    ),
+    width: '120px',
+  },
+  {
+    field: 'rule.benchmark.name',
+    name: (
+      <ColumnNameWithTooltip
+        columnName={i18n.translate(
+          'xpack.csp.findings.findingsTable.findingsTableColumn.ruleBenchmarkColumnLabel',
+          { defaultMessage: 'Applicable Benchmark' }
+        )}
+        tooltipContent={i18n.translate(
+          'xpack.csp.findings.findingsTable.findingsTableColumn.ruleBenchmarkColumnTooltipLabel',
+          { defaultMessage: 'The benchmark(s) rules used to evaluate this resource came from' }
+        )}
+      />
     ),
-    width: '10%',
     sortable: true,
     truncateText: true,
   },
@@ -149,7 +167,6 @@ const baseColumns = [
       'xpack.csp.findings.findingsTable.findingsTableColumn.ruleSectionColumnLabel',
       { defaultMessage: 'CIS Section' }
     ),
-    width: '7%',
     sortable: true,
     truncateText: true,
     render: (section: string) => (
@@ -164,15 +181,14 @@ const baseColumns = [
       <ColumnNameWithTooltip
         columnName={i18n.translate(
           'xpack.csp.findings.findingsTable.findingsTableColumn.clusterIdColumnLabel',
-          { defaultMessage: 'Cluster ID' }
+          { defaultMessage: 'Belongs To' }
         )}
         tooltipContent={i18n.translate(
           'xpack.csp.findings.findingsTable.findingsTableColumn.clusterIdColumnTooltipLabel',
-          { defaultMessage: 'Kube-System Namespace ID' }
+          { defaultMessage: 'Kubernetes Cluster ID or Cloud Account Name' }
         )}
       />
     ),
-    width: '150px',
     sortable: true,
     truncateText: true,
     render: (section: string) => (
@@ -183,6 +199,7 @@ const baseColumns = [
   },
   {
     field: '@timestamp',
+    align: 'right',
     width: '10%',
     name: i18n.translate(
       'xpack.csp.findings.findingsTable.findingsTableColumn.lastCheckedColumnLabel',
diff --git a/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/accounts_stats_collector.ts b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/accounts_stats_collector.ts
index 01637f43a5dea9..cf28f5b07113db 100644
--- a/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/accounts_stats_collector.ts
+++ b/x-pack/plugins/cloud_security_posture/server/lib/telemetry/collectors/accounts_stats_collector.ts
@@ -7,7 +7,7 @@
 import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
 import type { Logger } from '@kbn/core/server';
 import type { SearchRequest } from '@elastic/elasticsearch/lib/api/types';
-import { calculatePostureScore } from '../../../routes/compliance_dashboard/get_stats';
+import { calculatePostureScore } from '../../../../common/utils/helpers';
 import type { CspmAccountsStats } from './types';
 import { LATEST_FINDINGS_INDEX_DEFAULT_NS } from '../../../../common/constants';
 
diff --git a/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_grouped_findings_evaluation.ts b/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_grouped_findings_evaluation.ts
index 4f295ad7a2fdb6..f20b43619e914c 100644
--- a/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_grouped_findings_evaluation.ts
+++ b/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_grouped_findings_evaluation.ts
@@ -11,7 +11,7 @@ import type {
   QueryDslQueryContainer,
   SearchRequest,
 } from '@elastic/elasticsearch/lib/api/types';
-import { calculatePostureScore } from './get_stats';
+import { calculatePostureScore } from '../../../common/utils/helpers';
 import type { ComplianceDashboardData } from '../../../common/types';
 import { KeyDocCount } from './compliance_dashboard';
 
diff --git a/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_stats.test.ts b/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_stats.test.ts
index aff4e39f9d49ce..1a824e1671227d 100644
--- a/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_stats.test.ts
+++ b/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_stats.test.ts
@@ -5,12 +5,8 @@
  * 2.0.
  */
 
-import {
-  calculatePostureScore,
-  FindingsEvaluationsQueryResult,
-  getStatsFromFindingsEvaluationsAggs,
-  roundScore,
-} from './get_stats';
+import { FindingsEvaluationsQueryResult, getStatsFromFindingsEvaluationsAggs } from './get_stats';
+import { calculatePostureScore, roundScore } from '../../../common/utils/helpers';
 
 const standardQueryResult: FindingsEvaluationsQueryResult = {
   resources_evaluated: {
diff --git a/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_stats.ts b/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_stats.ts
index d0fcd5b7967744..a59d7487488e0e 100644
--- a/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_stats.ts
+++ b/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_stats.ts
@@ -7,15 +7,8 @@
 
 import { ElasticsearchClient } from '@kbn/core/server';
 import type { QueryDslQueryContainer, SearchRequest } from '@elastic/elasticsearch/lib/api/types';
-import type { ComplianceDashboardData, Score } from '../../../common/types';
-
-/**
- * @param value value is [0, 1] range
- */
-export const roundScore = (value: number): Score => Number((value * 100).toFixed(1));
-
-export const calculatePostureScore = (passed: number, failed: number): Score =>
-  roundScore(passed / (passed + failed));
+import { calculatePostureScore } from '../../../common/utils/helpers';
+import type { ComplianceDashboardData } from '../../../common/types';
 
 export interface FindingsEvaluationsQueryResult {
   failed_findings: {
diff --git a/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_trends.ts b/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_trends.ts
index a47b63e1fb9218..cc8234fa6d7af9 100644
--- a/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_trends.ts
+++ b/x-pack/plugins/cloud_security_posture/server/routes/compliance_dashboard/get_trends.ts
@@ -6,9 +6,9 @@
  */
 
 import { ElasticsearchClient } from '@kbn/core/server';
+import { calculatePostureScore } from '../../../common/utils/helpers';
 import { BENCHMARK_SCORE_INDEX_DEFAULT_NS } from '../../../common/constants';
 import type { PosturePolicyTemplate, Stats } from '../../../common/types';
-import { calculatePostureScore } from './get_stats';
 
 export interface ScoreTrendDoc {
   '@timestamp': string;
diff --git a/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule.ts b/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule.ts
index 9e4dea8a1a78b8..1ebb4199231e9f 100644
--- a/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule.ts
+++ b/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule.ts
@@ -28,7 +28,7 @@ function migrateCspRuleMetadata(
       policy_id,
       metadata: {
         ...metadata,
-        benchmark: { ...benchmark, id: 'cis_k8s' },
+        benchmark: { ...benchmark, id: 'cis_k8s', rule_number: '' },
         impact: metadata.impact || undefined,
         default_value: metadata.default_value || undefined,
         references: metadata.references || undefined,
diff --git a/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule_template.ts b/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule_template.ts
index b25fd7feb3e752..bd46457c76281c 100644
--- a/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule_template.ts
+++ b/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule_template.ts
@@ -28,7 +28,7 @@ function migrateCspRuleMetadata(
       muted,
       metadata: {
         ...metadata,
-        benchmark: { ...benchmark, id: 'cis_k8s' },
+        benchmark: { ...benchmark, id: 'cis_k8s', rule_number: '' },
         impact: metadata.impact || undefined,
         default_value: metadata.default_value || undefined,
         references: metadata.references || undefined,
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index eb0d05782eaa85..a178a7b0014fae 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -10135,12 +10135,10 @@
     "xpack.csp.benchmarks.benchmarkEmptyState.integrationsNotFoundForNameTitle": " pour \"{name}\"",
     "xpack.csp.benchmarks.totalIntegrationsCountMessage": "Affichage de {pageCount} sur {totalCount, plural, one {# intégration} other {# intégrations}}",
     "xpack.csp.cloudPosturePage.errorRenderer.errorDescription": "{error} {statusCode} : {body}",
-    "xpack.csp.complianceDashboard.complianceByCisSection.complianceColumnTooltip": "{passed}/{total}",
     "xpack.csp.dashboard.benchmarkSection.clusterTitle": "{title} - {shortId}",
     "xpack.csp.dashboard.benchmarkSection.clusterTitleTooltip.clusterTitle": "{title} - {shortId}",
     "xpack.csp.dashboard.benchmarkSection.lastEvaluatedTitle": "Dernière évaluation {dateFromNow}",
     "xpack.csp.findings.distributionBar.showingPageOfTotalLabel": "Affichage de {pageStart}-{pageEnd} sur {total} {type}",
-    "xpack.csp.findings.findingsByResourceTable.failedFindingsToolTip": "{failed} sur {total}",
     "xpack.csp.findings.findingsTableCell.addFilterButton": "Ajouter un filtre {field}",
     "xpack.csp.findings.findingsTableCell.addNegateFilterButton": "Ajouter un filtre {field} négatif",
     "xpack.csp.findings.resourceFindings.resourceFindingsPageTitle": "{resourceName} - Résultats",
@@ -10198,7 +10196,6 @@
     "xpack.csp.findings.findingsByResource.noFindingsTitle": "Il n'y a aucun résultat",
     "xpack.csp.findings.findingsByResource.tableRowTypeLabel": "Ressources",
     "xpack.csp.findings.findingsByResourceTable.cisSectionsColumnLabel": "Sections CIS",
-    "xpack.csp.findings.findingsByResourceTable.failedFindingsColumnLabel": "Échec des résultats",
     "xpack.csp.findings.findingsErrorToast.searchFailedTitle": "Échec de la recherche",
     "xpack.csp.findings.findingsFlyout.jsonTabTitle": "JSON",
     "xpack.csp.findings.findingsFlyout.overviewTab.actualTitle": "Réel",
@@ -10240,7 +10237,6 @@
     "xpack.csp.findings.findingsTable.findingsTableColumn.resourceTypeColumnLabel": "Type de ressource",
     "xpack.csp.findings.findingsTable.findingsTableColumn.resultColumnLabel": "Résultat",
     "xpack.csp.findings.findingsTable.findingsTableColumn.ruleBenchmarkColumnLabel": "Benchmark",
-    "xpack.csp.findings.findingsTable.findingsTableColumn.ruleColumnLabel": "Règle",
     "xpack.csp.findings.findingsTable.findingsTableColumn.ruleSectionColumnLabel": "Section CIS",
     "xpack.csp.findings.groupBySelector.groupByLabel": "Regrouper par",
     "xpack.csp.findings.groupBySelector.groupByNoneLabel": "Aucun",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index cfaed97466f363..3cfdf2f6d90936 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -10124,12 +10124,10 @@
     "xpack.csp.benchmarks.benchmarkEmptyState.integrationsNotFoundForNameTitle": " \"{name}\"",
     "xpack.csp.benchmarks.totalIntegrationsCountMessage": "{pageCount}/{totalCount, plural, other {#個の統合}}を表示しています",
     "xpack.csp.cloudPosturePage.errorRenderer.errorDescription": "{error} {statusCode}: {body}",
-    "xpack.csp.complianceDashboard.complianceByCisSection.complianceColumnTooltip": "{passed}/{total}",
     "xpack.csp.dashboard.benchmarkSection.clusterTitle": "{title} - {shortId}",
     "xpack.csp.dashboard.benchmarkSection.clusterTitleTooltip.clusterTitle": "{title} - {shortId}",
     "xpack.csp.dashboard.benchmarkSection.lastEvaluatedTitle": "前回の評価{dateFromNow}",
     "xpack.csp.findings.distributionBar.showingPageOfTotalLabel": "{total}件中{pageStart}-{pageEnd}件の{type}を表示しています",
-    "xpack.csp.findings.findingsByResourceTable.failedFindingsToolTip": "{total}件中{failed}件",
     "xpack.csp.findings.findingsTableCell.addFilterButton": "{field}フィルターを追加",
     "xpack.csp.findings.findingsTableCell.addNegateFilterButton": "{field}否定フィルターを追加",
     "xpack.csp.findings.resourceFindings.resourceFindingsPageTitle": "{resourceName} - 調査結果",
@@ -10187,7 +10185,6 @@
     "xpack.csp.findings.findingsByResource.noFindingsTitle": "調査結果はありません",
     "xpack.csp.findings.findingsByResource.tableRowTypeLabel": "リソース",
     "xpack.csp.findings.findingsByResourceTable.cisSectionsColumnLabel": "CISセクション",
-    "xpack.csp.findings.findingsByResourceTable.failedFindingsColumnLabel": "失敗した調査結果",
     "xpack.csp.findings.findingsErrorToast.searchFailedTitle": "検索失敗",
     "xpack.csp.findings.findingsFlyout.jsonTabTitle": "JSON",
     "xpack.csp.findings.findingsFlyout.overviewTab.actualTitle": "実際",
@@ -10229,7 +10226,6 @@
     "xpack.csp.findings.findingsTable.findingsTableColumn.resourceTypeColumnLabel": "リソースタイプ",
     "xpack.csp.findings.findingsTable.findingsTableColumn.resultColumnLabel": "結果",
     "xpack.csp.findings.findingsTable.findingsTableColumn.ruleBenchmarkColumnLabel": "ベンチマーク",
-    "xpack.csp.findings.findingsTable.findingsTableColumn.ruleColumnLabel": "ルール",
     "xpack.csp.findings.findingsTable.findingsTableColumn.ruleSectionColumnLabel": "CISセクション",
     "xpack.csp.findings.groupBySelector.groupByLabel": "グループ分けの条件",
     "xpack.csp.findings.groupBySelector.groupByNoneLabel": "なし",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index add5fcecf5ea69..6f7c68de2494cf 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -10139,12 +10139,10 @@
     "xpack.csp.benchmarks.benchmarkEmptyState.integrationsNotFoundForNameTitle": " 对于“{name}”",
     "xpack.csp.benchmarks.totalIntegrationsCountMessage": "正在显示 {pageCount}/{totalCount, plural, other {# 个集成}}",
     "xpack.csp.cloudPosturePage.errorRenderer.errorDescription": "{error} {statusCode}：{body}",
-    "xpack.csp.complianceDashboard.complianceByCisSection.complianceColumnTooltip": "{passed}/{total}",
     "xpack.csp.dashboard.benchmarkSection.clusterTitle": "{title} - {shortId}",
     "xpack.csp.dashboard.benchmarkSection.clusterTitleTooltip.clusterTitle": "{title} - {shortId}",
     "xpack.csp.dashboard.benchmarkSection.lastEvaluatedTitle": "上次评估于 {dateFromNow}",
     "xpack.csp.findings.distributionBar.showingPageOfTotalLabel": "正在显示第 {pageStart}-{pageEnd} 个（共 {total} 个）{type}",
-    "xpack.csp.findings.findingsByResourceTable.failedFindingsToolTip": "{failed} 个（共 {total} 个）",
     "xpack.csp.findings.findingsTableCell.addFilterButton": "添加 {field} 筛选",
     "xpack.csp.findings.findingsTableCell.addNegateFilterButton": "添加 {field} 作废筛选",
     "xpack.csp.findings.resourceFindings.resourceFindingsPageTitle": "{resourceName} - 结果",
@@ -10202,7 +10200,6 @@
     "xpack.csp.findings.findingsByResource.noFindingsTitle": "无结果",
     "xpack.csp.findings.findingsByResource.tableRowTypeLabel": "资源",
     "xpack.csp.findings.findingsByResourceTable.cisSectionsColumnLabel": "CIS 部分",
-    "xpack.csp.findings.findingsByResourceTable.failedFindingsColumnLabel": "失败的结果",
     "xpack.csp.findings.findingsErrorToast.searchFailedTitle": "搜索失败",
     "xpack.csp.findings.findingsFlyout.jsonTabTitle": "JSON",
     "xpack.csp.findings.findingsFlyout.overviewTab.actualTitle": "实际",
@@ -10244,7 +10241,6 @@
     "xpack.csp.findings.findingsTable.findingsTableColumn.resourceTypeColumnLabel": "资源类型",
     "xpack.csp.findings.findingsTable.findingsTableColumn.resultColumnLabel": "结果",
     "xpack.csp.findings.findingsTable.findingsTableColumn.ruleBenchmarkColumnLabel": "基准",
-    "xpack.csp.findings.findingsTable.findingsTableColumn.ruleColumnLabel": "规则",
     "xpack.csp.findings.findingsTable.findingsTableColumn.ruleSectionColumnLabel": "CIS 部分",
     "xpack.csp.findings.groupBySelector.groupByLabel": "分组依据",
     "xpack.csp.findings.groupBySelector.groupByNoneLabel": "无",
diff --git a/x-pack/test/cloud_security_posture_functional/pages/findings.ts b/x-pack/test/cloud_security_posture_functional/pages/findings.ts
index 3cfbc0234388a8..afba99a5542ed0 100644
--- a/x-pack/test/cloud_security_posture_functional/pages/findings.ts
+++ b/x-pack/test/cloud_security_posture_functional/pages/findings.ts
@@ -88,7 +88,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         await filterBar.addFilter({ field: 'rule.name', operation: 'is', value: ruleName1 });
 
         expect(await filterBar.hasFilter('rule.name', ruleName1)).to.be(true);
-        expect(await table.hasColumnValue('Rule', ruleName1)).to.be(true);
+        expect(await table.hasColumnValue('Rule Name', ruleName1)).to.be(true);
       });
 
       it('remove filter', async () => {
@@ -102,8 +102,8 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         await queryBar.setQuery(ruleName1);
         await queryBar.submitQuery();
 
-        expect(await table.hasColumnValue('Rule', ruleName1)).to.be(true);
-        expect(await table.hasColumnValue('Rule', ruleName2)).to.be(false);
+        expect(await table.hasColumnValue('Rule Name', ruleName1)).to.be(true);
+        expect(await table.hasColumnValue('Rule Name', ruleName2)).to.be(false);
 
         await queryBar.setQuery('');
         await queryBar.submitQuery();
@@ -114,18 +114,18 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
 
     describe('Table Filters', () => {
       it('add cell value filter', async () => {
-        await table.addCellFilter('Rule', ruleName1, false);
+        await table.addCellFilter('Rule Name', ruleName1, false);
 
         expect(await filterBar.hasFilter('rule.name', ruleName1)).to.be(true);
-        expect(await table.hasColumnValue('Rule', ruleName1)).to.be(true);
+        expect(await table.hasColumnValue('Rule Name', ruleName1)).to.be(true);
       });
 
       it('add negated cell value filter', async () => {
-        await table.addCellFilter('Rule', ruleName1, true);
+        await table.addCellFilter('Rule Name', ruleName1, true);
 
         expect(await filterBar.hasFilter('rule.name', ruleName1, true, false, true)).to.be(true);
-        expect(await table.hasColumnValue('Rule', ruleName1)).to.be(false);
-        expect(await table.hasColumnValue('Rule', ruleName2)).to.be(true);
+        expect(await table.hasColumnValue('Rule Name', ruleName1)).to.be(false);
+        expect(await table.hasColumnValue('Rule Name', ruleName2)).to.be(true);
 
         await filterBar.removeFilter('rule.name');
       });
@@ -147,8 +147,8 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) {
         const testCases: TestCase[] = [
           ['CIS Section', 'asc', sortByAlphabeticalOrder],
           ['CIS Section', 'desc', sortByAlphabeticalOrder],
-          ['Cluster ID', 'asc', compareStringByLexicographicOrder],
-          ['Cluster ID', 'desc', compareStringByLexicographicOrder],
+          ['Resource ID', 'asc', compareStringByLexicographicOrder],
+          ['Resource ID', 'desc', compareStringByLexicographicOrder],
           ['Resource Name', 'asc', sortByAlphabeticalOrder],
           ['Resource Name', 'desc', sortByAlphabeticalOrder],
           ['Resource Type', 'asc', sortByAlphabeticalOrder],

From 83d799a9c789b39b09456bead4ca750adf714298 Mon Sep 17 00:00:00 2001
From: Abdul Wahab Zahid <awahab07@yahoo.com>
Date: Tue, 24 Jan 2023 11:59:45 +0100
Subject: [PATCH 46/54] [Synthetics] Better formatting for waterfall timeline
 tooltips (#149142)

Co-authored-by: Shahzad <shahzad31comp@gmail.com>
---
 .../common/monitor_test_result/result_details.tsx          | 4 ++--
 .../common/network_data/data_formatting.ts                 | 7 +++++--
 .../step_timing_breakdown/breakdown_legend.tsx             | 2 +-
 .../step_timing_breakdown/network_timings_donut.tsx        | 2 +-
 .../waterfall/waterfall_marker/waterfall_markers.tsx       | 6 ++----
 5 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/result_details.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/result_details.tsx
index 54f0fe8412551c..dc5a2b2f3f62c7 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/result_details.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/monitor_test_result/result_details.tsx
@@ -54,10 +54,10 @@ export const TimingDetails = ({ step }: { step: JourneyStep }) => {
         <EuiLoadingContent lines={1} />
       ) : (
         <ThresholdIndicator
-          currentFormatted={formatMillisecond(item.value, 1)}
+          currentFormatted={formatMillisecond(item.value, { digits: 1 })}
           current={Number(item.value.toFixed(1))}
           previous={Number(prevValue.toFixed(1))}
-          previousFormatted={formatMillisecond(prevValue, 1)}
+          previousFormatted={formatMillisecond(prevValue, { digits: 1 })}
         />
       ),
     };
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts
index fb12506065cde1..aa1a64d9eb447e 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/common/network_data/data_formatting.ts
@@ -491,8 +491,11 @@ export const colourPalette: ColourPalette = { ...TIMING_PALETTE, ...MIME_TYPE_PA
 export const formatTooltipHeading = (index: number, fullText: string): string =>
   isNaN(index) ? fullText : `${index}. ${fullText}`;
 
-export const formatMillisecond = (ms: number, digits?: number) => {
-  if (ms < 1000) {
+export const formatMillisecond = (
+  ms: number,
+  { maxMillis = 1000, digits }: { digits?: number; maxMillis?: number }
+) => {
+  if (ms < maxMillis) {
     return `${ms.toFixed(digits ?? 0)} ms`;
   }
   return `${(ms / 1000).toFixed(digits ?? 1)} s`;
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/breakdown_legend.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/breakdown_legend.tsx
index 46c81f98198bc0..6e2e0a144755c6 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/breakdown_legend.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/breakdown_legend.tsx
@@ -32,7 +32,7 @@ export const BreakdownLegend = () => {
             </EuiFlexItem>
             <EuiFlexItem grow={false}>
               <EuiText css={{ whiteSpace: 'nowrap' }} size="s">
-                {formatMillisecond(value)}
+                {formatMillisecond(value, {})}
               </EuiText>
             </EuiFlexItem>
           </EuiFlexGroup>
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/network_timings_donut.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/network_timings_donut.tsx
index e9d58427e88266..075ae8a4ce84d6 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/network_timings_donut.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_timing_breakdown/network_timings_donut.tsx
@@ -58,7 +58,7 @@ export const NetworkTimingsDonut = () => {
           data={networkTimings.timingsWithLabels}
           layout={PartitionLayout.sunburst}
           valueAccessor={(d: Datum) => d?.value}
-          valueFormatter={(d: number) => formatMillisecond(d)}
+          valueFormatter={(d: number) => formatMillisecond(d, {})}
           layers={[
             {
               groupByRollup: (d: Datum) => d.label,
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_marker/waterfall_markers.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_marker/waterfall_markers.tsx
index e2337746cbcd07..c1a8db93c3e6a9 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_marker/waterfall_markers.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_waterfall_chart/waterfall/waterfall_marker/waterfall_markers.tsx
@@ -13,6 +13,7 @@ import { euiStyled } from '@kbn/kibana-react-plugin/common';
 
 import { MarkerItems, useWaterfallContext } from '../context/waterfall_context';
 import { WaterfallMarkerIcon } from './waterfall_marker_icon';
+import { formatMillisecond } from '../../../common/network_data/data_formatting';
 
 export const FIELD_SYNTHETICS_LCP = 'browser.experience.lcp.us';
 export const FIELD_SYNTHETICS_FCP = 'browser.experience.fcp.us';
@@ -98,10 +99,7 @@ export function WaterfallChartMarkers() {
               {
                 dataValue: offset,
                 details: label,
-                header: i18n.translate('xpack.synthetics.synthetics.waterfall.offsetUnit', {
-                  defaultMessage: '{offset} ms',
-                  values: { offset },
-                }),
+                header: formatMillisecond(offset, { maxMillis: 4000 }),
               },
             ]}
             marker={<WaterfallMarkerIcon field={field} label={label} />}

From 05d04ce1e0592b8f02a1752e5b31f0578cdf2fb1 Mon Sep 17 00:00:00 2001
From: Walter Rafelsberger <walter.rafelsberger@elastic.co>
Date: Tue, 24 Jan 2023 13:07:43 +0100
Subject: [PATCH 47/54] [ML] Consolidate `query_utils` into package
 `@kbn/ml-query-utils` (#149224)

Consolidates more `query_utils` into package `@kbn/ml-query-utils`.
---
 x-pack/packages/ml/query_utils/README.md      |  2 +-
 x-pack/packages/ml/query_utils/index.ts       |  2 +
 .../src/add_exclude_frozen_to_query.test.ts   |  2 +-
 .../src/build_base_filter_criteria.test.ts    | 49 ++++++++++++++++++
 .../src/build_base_filter_criteria.ts}        | 23 ++++-----
 .../src/get_safe_aggregation_name.test.ts     | 20 ++++++++
 .../src/get_safe_aggregation_name.ts          | 20 ++++++++
 x-pack/packages/ml/query_utils/tsconfig.json  |  1 +
 ...ild_extended_base_filter_criteria.test.ts} | 16 +++---
 ...=> build_extended_base_filter_criteria.ts} | 22 ++------
 .../aiops/public/get_document_stats.ts        |  4 +-
 x-pack/plugins/aiops/tsconfig.json            |  1 +
 .../correlations/utils/field_stats_utils.ts   | 38 --------------
 .../hooks/use_field_stats.ts                  |  5 +-
 .../requests/get_document_stats.ts            |  2 +-
 .../requests/get_field_examples.ts            |  2 +-
 .../search_strategy/requests/overall_stats.ts |  5 +-
 x-pack/plugins/data_visualizer/tsconfig.json  |  1 +
 .../plugins/ml/common/util/job_utils.test.ts  | 13 -----
 x-pack/plugins/ml/common/util/job_utils.ts    |  8 ---
 .../fill_missing_chart_data.test.ts           |  2 +-
 .../plugins/ml/server/lib/query_utils.test.ts | 51 -------------------
 x-pack/plugins/ml/server/lib/query_utils.ts   | 38 --------------
 .../models/data_visualizer/data_visualizer.ts |  3 +-
 24 files changed, 127 insertions(+), 203 deletions(-)
 create mode 100644 x-pack/packages/ml/query_utils/src/build_base_filter_criteria.test.ts
 rename x-pack/{plugins/data_visualizer/common/utils/query_utils.ts => packages/ml/query_utils/src/build_base_filter_criteria.ts} (56%)
 create mode 100644 x-pack/packages/ml/query_utils/src/get_safe_aggregation_name.test.ts
 create mode 100644 x-pack/packages/ml/query_utils/src/get_safe_aggregation_name.ts
 rename x-pack/plugins/aiops/public/application/utils/{query_utils.test.ts => build_extended_base_filter_criteria.test.ts} (91%)
 rename x-pack/plugins/aiops/public/application/utils/{query_utils.ts => build_extended_base_filter_criteria.ts} (85%)
 delete mode 100644 x-pack/plugins/apm/server/routes/correlations/utils/field_stats_utils.ts
 delete mode 100644 x-pack/plugins/ml/server/lib/query_utils.test.ts
 delete mode 100644 x-pack/plugins/ml/server/lib/query_utils.ts

diff --git a/x-pack/packages/ml/query_utils/README.md b/x-pack/packages/ml/query_utils/README.md
index 69a1d5972b7ddf..2a60cf71496b2c 100644
--- a/x-pack/packages/ml/query_utils/README.md
+++ b/x-pack/packages/ml/query_utils/README.md
@@ -1,3 +1,3 @@
 # @kbn/ml-query-utils
 
-Query utilities.
+Query utilities to be used in UIs maintained by the @elastic/ml-ui team.
diff --git a/x-pack/packages/ml/query_utils/index.ts b/x-pack/packages/ml/query_utils/index.ts
index f016fa6475c809..3e2ac6d532aad1 100644
--- a/x-pack/packages/ml/query_utils/index.ts
+++ b/x-pack/packages/ml/query_utils/index.ts
@@ -6,3 +6,5 @@
  */
 
 export { addExcludeFrozenToQuery } from './src/add_exclude_frozen_to_query';
+export { buildBaseFilterCriteria } from './src/build_base_filter_criteria';
+export { getSafeAggregationName } from './src/get_safe_aggregation_name';
diff --git a/x-pack/packages/ml/query_utils/src/add_exclude_frozen_to_query.test.ts b/x-pack/packages/ml/query_utils/src/add_exclude_frozen_to_query.test.ts
index 4193b1486bdfea..9c2e5cf0a38c72 100644
--- a/x-pack/packages/ml/query_utils/src/add_exclude_frozen_to_query.test.ts
+++ b/x-pack/packages/ml/query_utils/src/add_exclude_frozen_to_query.test.ts
@@ -7,7 +7,7 @@
 
 import { addExcludeFrozenToQuery } from './add_exclude_frozen_to_query';
 
-describe('Util: addExcludeFrozenToQuery()', () => {
+describe('addExcludeFrozenToQuery', () => {
   test('Validation checks.', () => {
     expect(
       addExcludeFrozenToQuery({
diff --git a/x-pack/packages/ml/query_utils/src/build_base_filter_criteria.test.ts b/x-pack/packages/ml/query_utils/src/build_base_filter_criteria.test.ts
new file mode 100644
index 00000000000000..6fd293e5dbb627
--- /dev/null
+++ b/x-pack/packages/ml/query_utils/src/build_base_filter_criteria.test.ts
@@ -0,0 +1,49 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { buildBaseFilterCriteria } from './build_base_filter_criteria';
+
+describe('buildBaseFilterCriteria', () => {
+  const earliestMs = 1483228800000; // 1 Jan 2017 00:00:00
+  const latestMs = 1485907199000; // 31 Jan 2017 23:59:59
+  const query = {
+    query_string: {
+      query: 'region:sa-east-1',
+      analyze_wildcard: true,
+      default_field: '*',
+    },
+  };
+
+  test('returns correct criteria for time range', () => {
+    expect(buildBaseFilterCriteria('timestamp', earliestMs, latestMs)).toEqual([
+      {
+        range: {
+          timestamp: {
+            gte: earliestMs,
+            lte: latestMs,
+            format: 'epoch_millis',
+          },
+        },
+      },
+    ]);
+  });
+
+  test('returns correct criteria for time range and query', () => {
+    expect(buildBaseFilterCriteria('timestamp', earliestMs, latestMs, query)).toEqual([
+      {
+        range: {
+          timestamp: {
+            gte: earliestMs,
+            lte: latestMs,
+            format: 'epoch_millis',
+          },
+        },
+      },
+      query,
+    ]);
+  });
+});
diff --git a/x-pack/plugins/data_visualizer/common/utils/query_utils.ts b/x-pack/packages/ml/query_utils/src/build_base_filter_criteria.ts
similarity index 56%
rename from x-pack/plugins/data_visualizer/common/utils/query_utils.ts
rename to x-pack/packages/ml/query_utils/src/build_base_filter_criteria.ts
index 9f0f746f8909ba..28a70d0532145e 100644
--- a/x-pack/plugins/data_visualizer/common/utils/query_utils.ts
+++ b/x-pack/packages/ml/query_utils/src/build_base_filter_criteria.ts
@@ -8,12 +8,16 @@
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { Query } from '@kbn/es-query';
 
-/*
- * Contains utility functions for building and processing queries.
+/**
+ * Builds the base filter criteria used in queries,
+ * adding criteria for the time range and an optional query.
+ *
+ * @param timeFieldName - optional time field name of the data view
+ * @param earliestMs - optional earliest timestamp of the selected time range
+ * @param latestMs - optional latest timestamp of the selected time range
+ * @param query - optional query
+ * @returns filter criteria
  */
-
-// Builds the base filter criteria used in queries,
-// adding criteria for the time range and an optional query.
 export function buildBaseFilterCriteria(
   timeFieldName?: string,
   earliestMs?: number,
@@ -21,6 +25,7 @@ export function buildBaseFilterCriteria(
   query?: Query['query']
 ): estypes.QueryDslQueryContainer[] {
   const filterCriteria = [];
+
   if (timeFieldName && earliestMs && latestMs) {
     filterCriteria.push({
       range: {
@@ -39,11 +44,3 @@ export function buildBaseFilterCriteria(
 
   return filterCriteria;
 }
-
-// Returns a name which is safe to use in elasticsearch aggregations for the supplied
-// field name. Aggregation names must be alpha-numeric and can only contain '_' and '-' characters,
-// so if the supplied field names contains disallowed characters, the provided index
-// identifier is used to return a safe 'dummy' name in the format 'field_index' e.g. field_0, field_1
-export function getSafeAggregationName(fieldName: string, index: number): string {
-  return fieldName.match(/^[a-zA-Z0-9-_.]+$/) ? fieldName : `field_${index}`;
-}
diff --git a/x-pack/packages/ml/query_utils/src/get_safe_aggregation_name.test.ts b/x-pack/packages/ml/query_utils/src/get_safe_aggregation_name.test.ts
new file mode 100644
index 00000000000000..822e46d19b74a7
--- /dev/null
+++ b/x-pack/packages/ml/query_utils/src/get_safe_aggregation_name.test.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getSafeAggregationName } from './get_safe_aggregation_name';
+
+describe('getSafeAggregationName', () => {
+  test('"foo" should be "foo"', () => {
+    expect(getSafeAggregationName('foo', 0)).toBe('foo');
+  });
+  test('"foo.bar" should be "foo.bar"', () => {
+    expect(getSafeAggregationName('foo.bar', 0)).toBe('foo.bar');
+  });
+  test('"foo&bar" should be "field_0"', () => {
+    expect(getSafeAggregationName('foo&bar', 0)).toBe('field_0');
+  });
+});
diff --git a/x-pack/packages/ml/query_utils/src/get_safe_aggregation_name.ts b/x-pack/packages/ml/query_utils/src/get_safe_aggregation_name.ts
new file mode 100644
index 00000000000000..df1be7628cef85
--- /dev/null
+++ b/x-pack/packages/ml/query_utils/src/get_safe_aggregation_name.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+/**
+ * Returns a name which is safe to use in elasticsearch aggregations for the supplied
+ * field name. Aggregation names must be alpha-numeric and can only contain '_' and '-' characters,
+ * so if the supplied field names contains disallowed characters, the provided index
+ * identifier is used to return a safe 'dummy' name in the format 'field_index' e.g. field_0, field_1
+ *
+ * @param fieldName - the field name to check
+ * @param index - the index number to be used for the safe aggregation name
+ * @returns safe aggregation name
+ */
+export function getSafeAggregationName(fieldName: string, index: number): string {
+  return fieldName.match(/^[a-zA-Z0-9-_.]+$/) ? fieldName : `field_${index}`;
+}
diff --git a/x-pack/packages/ml/query_utils/tsconfig.json b/x-pack/packages/ml/query_utils/tsconfig.json
index 1db807def57b82..acdb082c874b70 100644
--- a/x-pack/packages/ml/query_utils/tsconfig.json
+++ b/x-pack/packages/ml/query_utils/tsconfig.json
@@ -17,5 +17,6 @@
   ],
   "kbn_references": [
     "@kbn/ml-is-populated-object",
+    "@kbn/es-query",
   ]
 }
diff --git a/x-pack/plugins/aiops/public/application/utils/query_utils.test.ts b/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.test.ts
similarity index 91%
rename from x-pack/plugins/aiops/public/application/utils/query_utils.test.ts
rename to x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.test.ts
index 7a2650f02d3a96..c19dbbdb203c97 100644
--- a/x-pack/plugins/aiops/public/application/utils/query_utils.test.ts
+++ b/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.test.ts
@@ -9,7 +9,7 @@ import type { ChangePoint } from '@kbn/ml-agg-utils';
 
 import type { GroupTableItem } from '../../components/spike_analysis_table/types';
 
-import { buildBaseFilterCriteria } from './query_utils';
+import { buildExtendedBaseFilterCriteria } from './build_extended_base_filter_criteria';
 
 const selectedChangePointMock: ChangePoint = {
   doc_count: 53408,
@@ -41,9 +41,9 @@ const selectedGroupMock: GroupTableItem = {
 };
 
 describe('query_utils', () => {
-  describe('buildBaseFilterCriteria', () => {
+  describe('buildExtendedBaseFilterCriteria', () => {
     it('returns range filter based on minimum supplied arguments', () => {
-      const baseFilterCriteria = buildBaseFilterCriteria('the-time-field-name', 1234, 5678);
+      const baseFilterCriteria = buildExtendedBaseFilterCriteria('the-time-field-name', 1234, 5678);
 
       expect(baseFilterCriteria).toEqual([
         {
@@ -59,7 +59,7 @@ describe('query_utils', () => {
     });
 
     it('returns filters including default query with supplied arguments provided via UI', () => {
-      const baseFilterCriteria = buildBaseFilterCriteria(
+      const baseFilterCriteria = buildExtendedBaseFilterCriteria(
         '@timestamp',
         1640082000012,
         1640103600906,
@@ -81,7 +81,7 @@ describe('query_utils', () => {
     });
 
     it('includes a term filter when including a selectedChangePoint', () => {
-      const baseFilterCriteria = buildBaseFilterCriteria(
+      const baseFilterCriteria = buildExtendedBaseFilterCriteria(
         '@timestamp',
         1640082000012,
         1640103600906,
@@ -105,7 +105,7 @@ describe('query_utils', () => {
     });
 
     it('includes a term filter with must_not when excluding a selectedChangePoint', () => {
-      const baseFilterCriteria = buildBaseFilterCriteria(
+      const baseFilterCriteria = buildExtendedBaseFilterCriteria(
         '@timestamp',
         1640082000012,
         1640103600906,
@@ -130,7 +130,7 @@ describe('query_utils', () => {
     });
 
     it('includes multiple term filters when including a selectedGroupMock', () => {
-      const baseFilterCriteria = buildBaseFilterCriteria(
+      const baseFilterCriteria = buildExtendedBaseFilterCriteria(
         '@timestamp',
         1640082000012,
         1640103600906,
@@ -185,7 +185,7 @@ describe('query_utils', () => {
     });
 
     it('includes a must_not with nested term filters when excluding a selectedGroup', () => {
-      const baseFilterCriteria = buildBaseFilterCriteria(
+      const baseFilterCriteria = buildExtendedBaseFilterCriteria(
         '@timestamp',
         1640082000012,
         1640103600906,
diff --git a/x-pack/plugins/aiops/public/application/utils/query_utils.ts b/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.ts
similarity index 85%
rename from x-pack/plugins/aiops/public/application/utils/query_utils.ts
rename to x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.ts
index c39aa62b377c0c..b8a2ad55f468cc 100644
--- a/x-pack/plugins/aiops/public/application/utils/query_utils.ts
+++ b/x-pack/plugins/aiops/public/application/utils/build_extended_base_filter_criteria.ts
@@ -12,6 +12,9 @@ import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
 import type { Query } from '@kbn/es-query';
 import type { ChangePoint, FieldValuePair } from '@kbn/ml-agg-utils';
+
+import { buildBaseFilterCriteria } from '@kbn/ml-query-utils';
+
 import type { GroupTableItem } from '../../components/spike_analysis_table/types';
 
 /*
@@ -20,7 +23,7 @@ import type { GroupTableItem } from '../../components/spike_analysis_table/types
 
 // Builds the base filter criteria used in queries,
 // adding criteria for the time range and an optional query.
-export function buildBaseFilterCriteria(
+export function buildExtendedBaseFilterCriteria(
   timeFieldName?: string,
   earliestMs?: number,
   latestMs?: number,
@@ -29,22 +32,7 @@ export function buildBaseFilterCriteria(
   includeSelectedChangePoint = true,
   selectedGroup?: GroupTableItem | null
 ): estypes.QueryDslQueryContainer[] {
-  const filterCriteria = [];
-  if (timeFieldName && earliestMs && latestMs) {
-    filterCriteria.push({
-      range: {
-        [timeFieldName]: {
-          gte: earliestMs,
-          lte: latestMs,
-          format: 'epoch_millis',
-        },
-      },
-    });
-  }
-
-  if (query && typeof query === 'object') {
-    filterCriteria.push(query);
-  }
+  const filterCriteria = buildBaseFilterCriteria(timeFieldName, earliestMs, latestMs, query);
 
   const groupFilter = [];
   if (selectedGroup) {
diff --git a/x-pack/plugins/aiops/public/get_document_stats.ts b/x-pack/plugins/aiops/public/get_document_stats.ts
index f95e0eb2cc6108..4f76cb8244e68b 100644
--- a/x-pack/plugins/aiops/public/get_document_stats.ts
+++ b/x-pack/plugins/aiops/public/get_document_stats.ts
@@ -13,7 +13,7 @@ import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 import type { ChangePoint } from '@kbn/ml-agg-utils';
 import type { Query } from '@kbn/es-query';
 
-import { buildBaseFilterCriteria } from './application/utils/query_utils';
+import { buildExtendedBaseFilterCriteria } from './application/utils/build_extended_base_filter_criteria';
 import { GroupTableItem } from './components/spike_analysis_table/types';
 
 export interface DocumentCountStats {
@@ -54,7 +54,7 @@ export const getDocumentCountStatsRequest = (params: DocumentStatsSearchStrategy
   } = params;
 
   const size = 0;
-  const filterCriteria = buildBaseFilterCriteria(
+  const filterCriteria = buildExtendedBaseFilterCriteria(
     timeFieldName,
     earliestMs,
     latestMs,
diff --git a/x-pack/plugins/aiops/tsconfig.json b/x-pack/plugins/aiops/tsconfig.json
index 6e130d66384d6b..a5f260e695cbb9 100644
--- a/x-pack/plugins/aiops/tsconfig.json
+++ b/x-pack/plugins/aiops/tsconfig.json
@@ -46,6 +46,7 @@
     "@kbn/ml-local-storage",
     "@kbn/ml-date-picker",
     "@kbn/ml-local-storage",
+    "@kbn/ml-query-utils",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/apm/server/routes/correlations/utils/field_stats_utils.ts b/x-pack/plugins/apm/server/routes/correlations/utils/field_stats_utils.ts
deleted file mode 100644
index a60622583781b5..00000000000000
--- a/x-pack/plugins/apm/server/routes/correlations/utils/field_stats_utils.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/*
- * Contains utility functions for building and processing queries.
- */
-
-// Builds the base filter criteria used in queries,
-// adding criteria for the time range and an optional query.
-export function buildBaseFilterCriteria(
-  timeFieldName?: string,
-  earliestMs?: number,
-  latestMs?: number,
-  query?: object
-) {
-  const filterCriteria = [];
-  if (timeFieldName && earliestMs && latestMs) {
-    filterCriteria.push({
-      range: {
-        [timeFieldName]: {
-          gte: earliestMs,
-          lte: latestMs,
-          format: 'epoch_millis',
-        },
-      },
-    });
-  }
-
-  if (query) {
-    filterCriteria.push(query);
-  }
-
-  return filterCriteria;
-}
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_field_stats.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_field_stats.ts
index 2a91f9aa5366bc..06e7725f25652c 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_field_stats.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_field_stats.ts
@@ -12,6 +12,7 @@ import { last, cloneDeep } from 'lodash';
 import { mergeMap, switchMap } from 'rxjs/operators';
 import { Comparators } from '@elastic/eui';
 import type { ISearchOptions } from '@kbn/data-plugin/common';
+import { buildBaseFilterCriteria, getSafeAggregationName } from '@kbn/ml-query-utils';
 import type {
   DataStatsFetchProgress,
   FieldStatsSearchStrategyReturnBase,
@@ -22,10 +23,6 @@ import type {
 import { useDataVisualizerKibana } from '../../kibana_context';
 import type { FieldRequestConfig } from '../../../../common/types';
 import type { DataVisualizerIndexBasedAppState } from '../types/index_data_visualizer_state';
-import {
-  buildBaseFilterCriteria,
-  getSafeAggregationName,
-} from '../../../../common/utils/query_utils';
 import type { FieldStats, FieldStatsError } from '../../../../common/types/field_stats';
 import { getInitialProgress, getReducer } from '../progress_utils';
 import { MAX_EXAMPLES_DEFAULT } from '../search_strategy/requests/constants';
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/get_document_stats.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/get_document_stats.ts
index e6fc220ea7f3c4..690b8ec29740e9 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/get_document_stats.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/get_document_stats.ts
@@ -11,8 +11,8 @@ import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 import { DataPublicPluginStart, ISearchOptions } from '@kbn/data-plugin/public';
 import seedrandom from 'seedrandom';
 import { isDefined } from '@kbn/ml-is-defined';
+import { buildBaseFilterCriteria } from '@kbn/ml-query-utils';
 import { RANDOM_SAMPLER_PROBABILITIES } from '../../constants/random_sampler';
-import { buildBaseFilterCriteria } from '../../../../../common/utils/query_utils';
 import type {
   DocumentCountStats,
   OverallStatsSearchStrategyParams,
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/get_field_examples.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/get_field_examples.ts
index dfc68e6dac9aee..df7afb16479f09 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/get_field_examples.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/get_field_examples.ts
@@ -16,8 +16,8 @@ import type {
 } from '@kbn/data-plugin/public';
 import { isPopulatedObject } from '@kbn/ml-is-populated-object';
 import type { SearchHit } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
+import { buildBaseFilterCriteria } from '@kbn/ml-query-utils';
 import { getUniqGeoOrStrExamples } from '../../../common/util/example_utils';
-import { buildBaseFilterCriteria } from '../../../../../common/utils/query_utils';
 import type {
   Field,
   FieldExamples,
diff --git a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/overall_stats.ts b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/overall_stats.ts
index 28bf46bfd7c05c..c6643410b148e8 100644
--- a/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/overall_stats.ts
+++ b/x-pack/plugins/data_visualizer/public/application/index_data_visualizer/search_strategy/requests/overall_stats.ts
@@ -11,11 +11,8 @@ import { Query } from '@kbn/es-query';
 import type { IKibanaSearchResponse } from '@kbn/data-plugin/common';
 import type { AggCardinality } from '@kbn/ml-agg-utils';
 import { isPopulatedObject } from '@kbn/ml-is-populated-object';
+import { buildBaseFilterCriteria, getSafeAggregationName } from '@kbn/ml-query-utils';
 import { buildAggregationWithSamplingOption } from './build_random_sampler_agg';
-import {
-  buildBaseFilterCriteria,
-  getSafeAggregationName,
-} from '../../../../../common/utils/query_utils';
 import { getDatafeedAggregations } from '../../../../../common/utils/datafeed_utils';
 import { AggregatableField, NonAggregatableField } from '../../types/overall_stats';
 import { Aggs, SamplingOption } from '../../../../../common/types/field_stats';
diff --git a/x-pack/plugins/data_visualizer/tsconfig.json b/x-pack/plugins/data_visualizer/tsconfig.json
index 4730c35cd36584..fd61172e31587d 100644
--- a/x-pack/plugins/data_visualizer/tsconfig.json
+++ b/x-pack/plugins/data_visualizer/tsconfig.json
@@ -55,6 +55,7 @@
     "@kbn/ml-local-storage",
     "@kbn/ml-date-picker",
     "@kbn/ml-is-defined",
+    "@kbn/ml-query-utils",
   ],
   "exclude": [
     "target/**/*",
diff --git a/x-pack/plugins/ml/common/util/job_utils.test.ts b/x-pack/plugins/ml/common/util/job_utils.test.ts
index 3318001a6f3d27..d003710bb57e4c 100644
--- a/x-pack/plugins/ml/common/util/job_utils.test.ts
+++ b/x-pack/plugins/ml/common/util/job_utils.test.ts
@@ -17,7 +17,6 @@ import {
   mlFunctionToESAggregation,
   isJobIdValid,
   prefixDatafeedId,
-  getSafeAggregationName,
   getLatestDataOrBucketTimestamp,
   getEarliestDatafeedStartTime,
   resolveMaxTimeInterval,
@@ -566,18 +565,6 @@ describe('ML - job utils', () => {
     });
   });
 
-  describe('getSafeAggregationName', () => {
-    test('"foo" should be "foo"', () => {
-      expect(getSafeAggregationName('foo', 0)).toBe('foo');
-    });
-    test('"foo.bar" should be "foo.bar"', () => {
-      expect(getSafeAggregationName('foo.bar', 0)).toBe('foo.bar');
-    });
-    test('"foo&bar" should be "field_0"', () => {
-      expect(getSafeAggregationName('foo&bar', 0)).toBe('field_0');
-    });
-  });
-
   describe('getLatestDataOrBucketTimestamp', () => {
     test('returns expected value when no gap in data at end of bucket processing', () => {
       expect(getLatestDataOrBucketTimestamp(1549929594000, 1549928700000)).toBe(1549929594000);
diff --git a/x-pack/plugins/ml/common/util/job_utils.ts b/x-pack/plugins/ml/common/util/job_utils.ts
index a0cbb5d5762de4..dd68ef6d59d83e 100644
--- a/x-pack/plugins/ml/common/util/job_utils.ts
+++ b/x-pack/plugins/ml/common/util/job_utils.ts
@@ -424,14 +424,6 @@ export function createDatafeedId(jobId: string) {
   return `datafeed-${jobId}`;
 }
 
-// Returns a name which is safe to use in elasticsearch aggregations for the supplied
-// field name. Aggregation names must be alpha-numeric and can only contain '_' and '-' characters,
-// so if the supplied field names contains disallowed characters, the provided index
-// identifier is used to return a safe 'dummy' name in the format 'field_index' e.g. field_0, field_1
-export function getSafeAggregationName(fieldName: string, index: number): string {
-  return fieldName.match(/^[a-zA-Z0-9-_.]+$/) ? fieldName : `field_${index}`;
-}
-
 export function uniqWithIsEqual<T extends any[]>(arr: T): T {
   return arr.reduce((dedupedArray, value) => {
     if (dedupedArray.filter((compareValue: any) => isEqual(compareValue, value)).length === 0) {
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/datafeed_chart_flyout/fill_missing_chart_data.test.ts b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/datafeed_chart_flyout/fill_missing_chart_data.test.ts
index 5ef38a4a0e51e0..891d9432afe347 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/datafeed_chart_flyout/fill_missing_chart_data.test.ts
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/datafeed_chart_flyout/fill_missing_chart_data.test.ts
@@ -16,7 +16,7 @@ const completeData: ChartDataWithNullValues = [
   [1666846800000, 6],
 ];
 
-describe('buildBaseFilterCriteria', () => {
+describe('fillMissingChartData', () => {
   it('returns chart data with missing timestamps in middle of dataset filled in to null', () => {
     const dataWithMissingValues: ChartDataWithNullValues = [
       [1666828800000, 7],
diff --git a/x-pack/plugins/ml/server/lib/query_utils.test.ts b/x-pack/plugins/ml/server/lib/query_utils.test.ts
deleted file mode 100644
index c505a8a9b1fa82..00000000000000
--- a/x-pack/plugins/ml/server/lib/query_utils.test.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { buildBaseFilterCriteria } from './query_utils';
-
-describe('ML - query utils', () => {
-  describe('buildBaseFilterCriteria', () => {
-    const earliestMs = 1483228800000; // 1 Jan 2017 00:00:00
-    const latestMs = 1485907199000; // 31 Jan 2017 23:59:59
-    const query = {
-      query_string: {
-        query: 'region:sa-east-1',
-        analyze_wildcard: true,
-        default_field: '*',
-      },
-    };
-
-    test('returns correct criteria for time range', () => {
-      expect(buildBaseFilterCriteria('timestamp', earliestMs, latestMs)).toEqual([
-        {
-          range: {
-            timestamp: {
-              gte: earliestMs,
-              lte: latestMs,
-              format: 'epoch_millis',
-            },
-          },
-        },
-      ]);
-    });
-
-    test('returns correct criteria for time range and query', () => {
-      expect(buildBaseFilterCriteria('timestamp', earliestMs, latestMs, query)).toEqual([
-        {
-          range: {
-            timestamp: {
-              gte: earliestMs,
-              lte: latestMs,
-              format: 'epoch_millis',
-            },
-          },
-        },
-        query,
-      ]);
-    });
-  });
-});
diff --git a/x-pack/plugins/ml/server/lib/query_utils.ts b/x-pack/plugins/ml/server/lib/query_utils.ts
deleted file mode 100644
index a60622583781b5..00000000000000
--- a/x-pack/plugins/ml/server/lib/query_utils.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-/*
- * Contains utility functions for building and processing queries.
- */
-
-// Builds the base filter criteria used in queries,
-// adding criteria for the time range and an optional query.
-export function buildBaseFilterCriteria(
-  timeFieldName?: string,
-  earliestMs?: number,
-  latestMs?: number,
-  query?: object
-) {
-  const filterCriteria = [];
-  if (timeFieldName && earliestMs && latestMs) {
-    filterCriteria.push({
-      range: {
-        [timeFieldName]: {
-          gte: earliestMs,
-          lte: latestMs,
-          format: 'epoch_millis',
-        },
-      },
-    });
-  }
-
-  if (query) {
-    filterCriteria.push(query);
-  }
-
-  return filterCriteria;
-}
diff --git a/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts b/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts
index e34afb42cde9dc..824ded33f8ef72 100644
--- a/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts
+++ b/x-pack/plugins/ml/server/models/data_visualizer/data_visualizer.ts
@@ -15,9 +15,8 @@ import {
 } from '@kbn/ml-agg-utils';
 import type { AggCardinality, FieldsForHistograms } from '@kbn/ml-agg-utils';
 import { isPopulatedObject } from '@kbn/ml-is-populated-object';
+import { buildBaseFilterCriteria, getSafeAggregationName } from '@kbn/ml-query-utils';
 import { ML_JOB_FIELD_TYPES } from '../../../common/constants/field_types';
-import { getSafeAggregationName } from '../../../common/util/job_utils';
-import { buildBaseFilterCriteria } from '../../lib/query_utils';
 import { RuntimeMappings } from '../../../common/types/fields';
 import { getDatafeedAggregations } from '../../../common/util/datafeed_utils';
 import { Datafeed } from '../../../common/types/anomaly_detection_jobs';

From b87dca93c3c1ee9d199aae60ee9ec9071586387a Mon Sep 17 00:00:00 2001
From: David Roberts <dave.roberts@elastic.co>
Date: Tue, 24 Jan 2023 12:08:54 +0000
Subject: [PATCH 48/54] [ML] Remove job_type from job definitions in modules
 (#149247)

All the job definitions in ML modules contain the field `job_type`. For
anomaly detection jobs this is always `anomaly_detector`. Officially it
is not a valid input to the create job API. Elasticsearch accepts it
(which is technically a bug as it's out-of-spec) which is why it has
never been noticed before. However, the language clients do not accept
it, which causes problems if somebody wants to create module jobs using
a language client. It's best that the jobs in our modules conform
accurately to the specification of a valid job creation request.
---
 .../modules/apm_transaction/ml/apm_tx_metrics.json               | 1 -
 .../ml/docker_high_count_process_events_ecs.json                 | 1 -
 .../ml/docker_rare_process_activity_ecs.json                     | 1 -
 .../modules/logs_ui_analysis/ml/log_entry_rate.json              | 1 -
 .../logs_ui_categories/ml/log_entry_categories_count.json        | 1 -
 .../metricbeat_system_ecs/ml/high_mean_cpu_iowait_ecs.json       | 1 -
 .../metricbeat_system_ecs/ml/max_disk_utilization_ecs.json       | 1 -
 .../modules/metricbeat_system_ecs/ml/metricbeat_outages_ecs.json | 1 -
 .../modules/metrics_ui_hosts/ml/hosts_memory_usage.json          | 1 -
 .../modules/metrics_ui_hosts/ml/hosts_network_in.json            | 1 -
 .../modules/metrics_ui_hosts/ml/hosts_network_out.json           | 1 -
 .../modules/metrics_ui_k8s/ml/k8s_memory_usage.json              | 1 -
 .../modules/metrics_ui_k8s/ml/k8s_network_in.json                | 1 -
 .../modules/metrics_ui_k8s/ml/k8s_network_out.json               | 1 -
 .../modules/security_auth/ml/auth_high_count_logon_events.json   | 1 -
 .../ml/auth_high_count_logon_events_for_a_source_ip.json         | 1 -
 .../modules/security_auth/ml/auth_high_count_logon_fails.json    | 1 -
 .../modules/security_auth/ml/auth_rare_hour_for_a_user.json      | 1 -
 .../modules/security_auth/ml/auth_rare_source_ip_for_a_user.json | 1 -
 .../data_recognizer/modules/security_auth/ml/auth_rare_user.json | 1 -
 .../modules/security_auth/ml/suspicious_login_activity.json      | 1 -
 .../ml/high_distinct_count_error_message.json                    | 1 -
 .../modules/security_cloudtrail/ml/rare_error_code.json          | 1 -
 .../modules/security_cloudtrail/ml/rare_method_for_a_city.json   | 1 -
 .../security_cloudtrail/ml/rare_method_for_a_country.json        | 1 -
 .../security_cloudtrail/ml/rare_method_for_a_username.json       | 1 -
 .../security_linux/ml/v3_linux_anomalous_network_activity.json   | 1 -
 .../ml/v3_linux_anomalous_network_port_activity.json             | 1 -
 .../security_linux/ml/v3_linux_anomalous_process_all_hosts.json  | 1 -
 .../modules/security_linux/ml/v3_linux_anomalous_user_name.json  | 1 -
 .../ml/v3_linux_network_configuration_discovery.json             | 1 -
 .../security_linux/ml/v3_linux_network_connection_discovery.json | 1 -
 .../security_linux/ml/v3_linux_rare_metadata_process.json        | 1 -
 .../modules/security_linux/ml/v3_linux_rare_metadata_user.json   | 1 -
 .../modules/security_linux/ml/v3_linux_rare_sudo_user.json       | 1 -
 .../modules/security_linux/ml/v3_linux_rare_user_compiler.json   | 1 -
 .../security_linux/ml/v3_linux_system_information_discovery.json | 1 -
 .../security_linux/ml/v3_linux_system_process_discovery.json     | 1 -
 .../security_linux/ml/v3_linux_system_user_discovery.json        | 1 -
 .../modules/security_linux/ml/v3_rare_process_by_host_linux.json | 1 -
 .../security_network/ml/high_count_by_destination_country.json   | 1 -
 .../modules/security_network/ml/high_count_network_denies.json   | 1 -
 .../modules/security_network/ml/high_count_network_events.json   | 1 -
 .../modules/security_network/ml/rare_destination_country.json    | 1 -
 .../modules/security_packetbeat/ml/packetbeat_dns_tunneling.json | 1 -
 .../security_packetbeat/ml/packetbeat_rare_dns_question.json     | 1 -
 .../security_packetbeat/ml/packetbeat_rare_server_domain.json    | 1 -
 .../modules/security_packetbeat/ml/packetbeat_rare_urls.json     | 1 -
 .../security_packetbeat/ml/packetbeat_rare_user_agent.json       | 1 -
 .../security_windows/ml/v3_rare_process_by_host_windows.json     | 1 -
 .../ml/v3_windows_anomalous_network_activity.json                | 1 -
 .../security_windows/ml/v3_windows_anomalous_path_activity.json  | 1 -
 .../ml/v3_windows_anomalous_process_all_hosts.json               | 1 -
 .../ml/v3_windows_anomalous_process_creation.json                | 1 -
 .../modules/security_windows/ml/v3_windows_anomalous_script.json | 1 -
 .../security_windows/ml/v3_windows_anomalous_service.json        | 1 -
 .../security_windows/ml/v3_windows_anomalous_user_name.json      | 1 -
 .../security_windows/ml/v3_windows_rare_metadata_process.json    | 1 -
 .../security_windows/ml/v3_windows_rare_metadata_user.json       | 1 -
 .../security_windows/ml/v3_windows_rare_user_runas_event.json    | 1 -
 .../ml/v3_windows_rare_user_type10_remote_login.json             | 1 -
 .../modules/uptime_heartbeat/ml/high_latency_by_geo.json         | 1 -
 62 files changed, 62 deletions(-)

diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/apm_tx_metrics.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/apm_tx_metrics.json
index 9f67527ba677da..c6815fca7602da 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/apm_tx_metrics.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/apm_transaction/ml/apm_tx_metrics.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "groups": [
     "apm"
   ],
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/docker_high_count_process_events_ecs.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/docker_high_count_process_events_ecs.json
index 046736b6f55595..ae9d5d9140b5b1 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/docker_high_count_process_events_ecs.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/docker_high_count_process_events_ecs.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Auditbeat: Detect unusual increases in process execution rates in docker containers (ECS)",
   "groups": ["auditd"],
   "analysis_config": {
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/docker_rare_process_activity_ecs.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/docker_rare_process_activity_ecs.json
index ab405d47484d91..4eca07b037846e 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/docker_rare_process_activity_ecs.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/auditbeat_process_docker_ecs/ml/docker_rare_process_activity_ecs.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Auditbeat: Detect rare process executions in docker containers (ECS)",
   "groups": ["auditd"],
   "analysis_config": {
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/logs_ui_analysis/ml/log_entry_rate.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/logs_ui_analysis/ml/log_entry_rate.json
index 0cd99ae71765da..eaa12cb74efd12 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/logs_ui_analysis/ml/log_entry_rate.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/logs_ui_analysis/ml/log_entry_rate.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Logs UI: Detects anomalies in the log entry ingestion rate",
   "groups": ["logs-ui"],
   "analysis_config": {
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/logs_ui_categories/ml/log_entry_categories_count.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/logs_ui_categories/ml/log_entry_categories_count.json
index 74f434f36e4ed5..5b20815cfb2a67 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/logs_ui_categories/ml/log_entry_categories_count.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/logs_ui_categories/ml/log_entry_categories_count.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Logs UI: Detects anomalies in count of log entries by category",
   "groups": [
     "logs-ui"
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/high_mean_cpu_iowait_ecs.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/high_mean_cpu_iowait_ecs.json
index d6218acfae84fc..ff318f91e00f09 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/high_mean_cpu_iowait_ecs.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/high_mean_cpu_iowait_ecs.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Metricbeat CPU: Detect unusual increases in cpu time spent in iowait (ECS)",
   "groups": [
     "metricbeat"
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/max_disk_utilization_ecs.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/max_disk_utilization_ecs.json
index dd502c1d6ae379..ed60473b1f31ab 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/max_disk_utilization_ecs.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/max_disk_utilization_ecs.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Metricbeat filesystem: Detect unusual increases in disk utilization (ECS)",
   "groups": [
     "metricbeat"
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/metricbeat_outages_ecs.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/metricbeat_outages_ecs.json
index fb2838ac57856b..312b2d964347de 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/metricbeat_outages_ecs.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metricbeat_system_ecs/ml/metricbeat_outages_ecs.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Metricbeat outages: Detect unusual decreases in metricbeat documents (ECS)",
   "groups": [
     "metricbeat"
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_memory_usage.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_memory_usage.json
index 6448d32b65f157..7bf5aa5ea61c2f 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_memory_usage.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_memory_usage.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "groups": [
     "hosts",
     "metrics"
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_in.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_in.json
index 3c78907bf73a94..e21581e68119eb 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_in.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_in.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Metrics: Hosts - Identify unusual spikes in inbound traffic across hosts.",
   "groups": [
     "hosts",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_out.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_out.json
index 9d7c39cf0aabc3..cd87289c0354c5 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_out.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_hosts/ml/hosts_network_out.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Metrics: Hosts - Identify unusual spikes in outbound traffic across hosts.",
   "groups": [
     "hosts",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_memory_usage.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_memory_usage.json
index 5c60137655cabc..2a633f2b6ff1ea 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_memory_usage.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_memory_usage.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "groups": [
     "k8s",
     "metrics"
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_in.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_in.json
index 35cbe5c28205a0..4e2d7cbf48b582 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_in.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_in.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Metrics: Kubernetes - Identify unusual spikes in inbound traffic across Kubernetes pods.",
   "groups": [
     "k8s",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_out.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_out.json
index a9e8a1fa8b224d..dff1bfacddfcf9 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_out.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/metrics_ui_k8s/ml/k8s_network_out.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Metrics: Kubernetes - Identify unusual spikes in outbound traffic across Kubernetes pods.",
   "groups": [
     "k8s",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events.json
index 65f3bf5966bbdc..7ca7a5ebd71e48 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Authentication - Looks for an unusually large spike in successful authentication events. This can be due to password spraying, user enumeration, or brute force activity.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events_for_a_source_ip.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events_for_a_source_ip.json
index 22594cbacc48bb..47096f4c6413f2 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events_for_a_source_ip.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_events_for_a_source_ip.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Authentication - Looks for an unusually large spike in successful authentication events from a particular source IP address. This can be due to password spraying, user enumeration, or brute force activity.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_fails.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_fails.json
index d335f7b0128fa9..48586ef642ca63 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_fails.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_high_count_logon_fails.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Authentication - Looks for an unusually large spike in authentication failure events. This can be due to password spraying, user enumeration, or brute force activity and may be a precursor to account takeover or credentialed access.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_hour_for_a_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_hour_for_a_user.json
index afe905a02283fe..1f421ed298b9f8 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_hour_for_a_user.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_hour_for_a_user.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Authentication - looks for a user logging in at a time of day that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different time zones. In addition, unauthorized user activity often takes place during non-business hours.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_source_ip_for_a_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_source_ip_for_a_user.json
index 7d4e9e022915db..98a249074a67a1 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_source_ip_for_a_user.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_source_ip_for_a_user.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Authentication - looks for a user logging in from an IP address that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different locations. An unusual source IP address for a username could also be due to lateral movement when a compromised account is used to pivot between hosts.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_user.json
index 5f31cc6aaa435b..e2488480e61d19 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_user.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/auth_rare_user.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Authentication - looks for an unusual user name in the authentication logs. An unusual user name is one way of detecting credentialed access by means of a new or dormant user account. A user account that is normally inactive, because the user has left the organization, which becomes active, may be due to credentialed access using a compromised account password. Threat actors will sometimes also create new users as a means of persisting in a compromised web application.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/suspicious_login_activity.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/suspicious_login_activity.json
index f96537b85e9884..00e810b5348e7e 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/suspicious_login_activity.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/suspicious_login_activity.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Auditbeat - Detect unusually high number of authentication attempts.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/high_distinct_count_error_message.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/high_distinct_count_error_message.json
index 59dc155b96d333..11b5f4625a4846 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/high_distinct_count_error_message.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/high_distinct_count_error_message.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Cloudtrail - Looks for a spike in the rate of an error message which may simply indicate an impending service failure but these can also be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection activity by a threat actor.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_error_code.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_error_code.json
index 7c62eb4d8905e9..c54c8e8378f2c7 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_error_code.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_error_code.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Cloudtrail - Looks for unusual errors. Rare and unusual errors may simply indicate an impending service failure but they can also be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection activity by a threat actor.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_city.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_city.json
index 1d220f4c87b5e6..2ed28884be94fc 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_city.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_city.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Cloudtrail - Looks for AWS API calls that, while not inherently suspicious or abnormal, are sourcing from a geolocation (city) that is unusual. This can be the result of compromised credentials or keys.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_country.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_country.json
index cd772b49ae2e73..1f14357e734445 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_country.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_country.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Cloudtrail - Looks for AWS API calls that, while not inherently suspicious or abnormal, are sourcing from a geolocation (country) that is unusual. This can be the result of compromised credentials or keys.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_username.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_username.json
index 36ff1d0cfb83d2..76cce7fb829cad 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_username.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_cloudtrail/ml/rare_method_for_a_username.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Cloudtrail - Looks for AWS API calls that, while not inherently suspicious or abnormal, are sourcing from a user context that does not normally call the method. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfil data.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_network_activity.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_network_activity.json
index 9c3dfc3f59e948..29f6bf1d98412d 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_network_activity.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_network_activity.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for unusual processes using the network which could indicate command-and-control, lateral movement, persistence, or data exfiltration activity.",
   "groups": [
     "auditbeat",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_network_port_activity.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_network_port_activity.json
index 945b99b1bb651f..34b97358260acc 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_network_port_activity.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_network_port_activity.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for unusual destination port activity that could indicate command-and-control, persistence mechanism, or data exfiltration activity.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_process_all_hosts.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_process_all_hosts.json
index ececcb0b9d0ad0..a20a508391fb94 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_process_all_hosts.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_process_all_hosts.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for processes that are unusual to all Linux hosts. Such unusual processes may indicate unauthorized software, malware, or persistence mechanisms.",
   "groups": [
     "auditbeat",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_user_name.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_user_name.json
index 7bbacf6d0999b5..72be89bd79aadd 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_user_name.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_anomalous_user_name.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Rare and unusual users that are not normally active may indicate unauthorized changes or activity by an unauthorized user which may be credentialed access or lateral movement.",
   "groups": [
     "auditbeat",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_network_configuration_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_network_configuration_discovery.json
index e04140a850b5bd..1481b7a03a5596 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_network_configuration_discovery.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_network_configuration_discovery.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for commands related to system network configuration discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network configuration discovery to increase their understanding of connected networks and hosts. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_network_connection_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_network_connection_discovery.json
index 0975d1139828bf..2b1cf43ac94d3e 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_network_connection_discovery.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_network_connection_discovery.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for commands related to system network connection discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network connection discovery to increase their understanding of connected services and systems. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_metadata_process.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_metadata_process.json
index 00a2bde273f9f1..fcec32acd69b50 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_metadata_process.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_metadata_process.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.",
   "groups": [
     "auditbeat",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_metadata_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_metadata_user.json
index 0320ec9412311e..d8414c8bf22bd3 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_metadata_user.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_metadata_user.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for anomalous access to the metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.",
   "groups": [
     "auditbeat",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_sudo_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_sudo_user.json
index 6f403653ab7265..a99e5f95572f7d 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_sudo_user.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_sudo_user.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for sudo activity from an unusual user context. Unusual user context changes can be due to privilege escalation.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_user_compiler.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_user_compiler.json
index 4f5e47bd26d281..9c8ca5316ace3f 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_user_compiler.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_rare_user_compiler.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for compiler activity by a user context which does not normally run compilers. This can be ad-hoc software changes or unauthorized software deployment. This can also be due to local privilege elevation via locally run exploits or malware activity.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_information_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_information_discovery.json
index 32ee1c4342d64b..0202854934285a 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_information_discovery.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_information_discovery.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for commands related to system information discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system information discovery to gather detailed information about system configuration and software versions. This may be a precursor to the selection of a persistence mechanism or a method of privilege elevation.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_process_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_process_discovery.json
index 1451416dc0cbde..23e6e607ccf080 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_process_discovery.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_process_discovery.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for commands related to system process discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system process discovery to increase their understanding of software applications running on a target host or network. This may be a precursor to the selection of a persistence mechanism or a method of privilege elevation.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_user_discovery.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_user_discovery.json
index 22485ed6071ca2..8659e7a8f1f91d 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_user_discovery.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_linux_system_user_discovery.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for commands related to system user or owner discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system owner or user discovery to identify currently active or primary users of a system. This may be a precursor to additional discovery, credential dumping, or privilege elevation activity.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_rare_process_by_host_linux.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_rare_process_by_host_linux.json
index b36913d68e6263..a072007a0f13cb 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_rare_process_by_host_linux.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux/ml/v3_rare_process_by_host_linux.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Linux - Looks for processes that are unusual to a particular Linux host. Such unusual processes may indicate unauthorized software, malware, or persistence mechanisms.",
   "groups": [
     "auditbeat",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_by_destination_country.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_by_destination_country.json
index 653001a4534529..4479fe8f8c6627 100755
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_by_destination_country.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_by_destination_country.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Network - Looks for an unusually large spike in network activity to one destination country in the network logs. This could be due to unusually large amounts of reconnaissance or enumeration traffic. Data exfiltration activity may also produce such a surge in traffic to a destination country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_network_denies.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_network_denies.json
index 5b1600d1245468..984bfea22fa2db 100755
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_network_denies.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_network_denies.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Network - Looks for an unusually large spike in network traffic that was denied by network ACLs or firewall rules. Such a burst of denied traffic is usually either 1) a misconfigured application or firewall or 2) suspicious or malicious activity. Unsuccessful attempts at network transit, in order to connect to command-and-control (C2), or engage in data exfiltration, may produce a burst of failed connections. This could also be due to unusually large amounts of reconnaissance or enumeration traffic.  Denial-of-service attacks or traffic floods may also produce such a surge in traffic.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_network_events.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_network_events.json
index 7c0a5d9537cb1c..ba740d581a27ee 100755
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_network_events.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/high_count_network_events.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Network - Looks for an unusually large spike in network traffic. Such a burst of traffic, if not caused by a surge in business activity, can be due to suspicious or malicious activity. Large-scale data exfiltration may produce a burst of network traffic; this could also be due to unusually large amounts of reconnaissance or enumeration traffic.  Denial-of-service attacks or traffic floods may also produce such a surge in traffic.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/rare_destination_country.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/rare_destination_country.json
index 7becc6599e31b4..123b802c475fb0 100755
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/rare_destination_country.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_network/ml/rare_destination_country.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Network - looks for an unusual destination country name in the network logs. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from a server in a country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_dns_tunneling.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_dns_tunneling.json
index 61fa894ab1dc1d..313bd8e1bea398 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_dns_tunneling.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_dns_tunneling.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Packetbeat - Looks for unusual DNS activity that could indicate command-and-control or data exfiltration activity.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_dns_question.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_dns_question.json
index a9663f3cd08565..36c8b3acd722e6 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_dns_question.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_dns_question.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Packetbeat - Looks for unusual DNS activity that could indicate command-and-control activity.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_server_domain.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_server_domain.json
index fd29b66160110d..3f3c137e8fd345 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_server_domain.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_server_domain.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Packetbeat - Looks for unusual HTTP or TLS destination domain activity that could indicate execution, persistence, command-and-control or data exfiltration activity.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_urls.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_urls.json
index c10dd74ac6ec12..afa430bd835f21 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_urls.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_urls.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Packetbeat - Looks for unusual web browsing URL activity that could indicate execution, persistence, command-and-control or data exfiltration activity.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_user_agent.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_user_agent.json
index 8c54ea747cd117..bb2d524b41c1f2 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_user_agent.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_packetbeat/ml/packetbeat_rare_user_agent.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Packetbeat - Looks for unusual HTTP user agent activity that could indicate execution, persistence, command-and-control or data exfiltration activity.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_rare_process_by_host_windows.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_rare_process_by_host_windows.json
index fdc6d38bb103e8..6b7e5dcf56f1f5 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_rare_process_by_host_windows.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_rare_process_by_host_windows.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Windows - Looks for processes that are unusual to a particular Windows host. Such unusual processes may indicate unauthorized software, malware, or persistence mechanisms.",
   "groups": [
     "endpoint",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_network_activity.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_network_activity.json
index 08e2df605c387b..04ee9912c15e3a 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_network_activity.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_network_activity.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Windows - Looks for unusual processes using the network which could indicate command-and-control, lateral movement, persistence, or data exfiltration activity.",
   "groups": [
     "endpoint",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_path_activity.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_path_activity.json
index f370980d5a6a80..d5c931b3c46e85 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_path_activity.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_path_activity.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Windows - Looks for activity in unusual paths that may indicate execution of malware or persistence mechanisms. Windows payloads often execute from user profile paths.",
   "groups": [
     "endpoint",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_process_all_hosts.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_process_all_hosts.json
index f099c277e46aaa..1474763cec7b95 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_process_all_hosts.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_process_all_hosts.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Windows - Looks for processes that are unusual to all Windows hosts. Such unusual processes may indicate execution of unauthorized software, malware, or persistence mechanisms.",
   "groups": [
     "endpoint",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_process_creation.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_process_creation.json
index f299ef5e3051f6..2966630fad878f 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_process_creation.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_process_creation.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Windows - Looks for unusual process relationships which may indicate execution of malware or persistence mechanisms.",
   "groups": [
     "endpoint",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_script.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_script.json
index d9b8b69cfa273e..b01641b2ef3add 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_script.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_script.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Windows - Looks for unusual powershell scripts that may indicate execution of malware, or persistence mechanisms.",
   "groups": [
     "endpoint",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_service.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_service.json
index 77e88567fc8ac3..9716c8365e317c 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_service.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_service.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "groups": [
     "endpoint",
     "event-log",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_user_name.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_user_name.json
index 6709ea75a1869d..eda4b768b53081 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_user_name.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_anomalous_user_name.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Windows - Rare and unusual users that are not normally active may indicate unauthorized changes or activity by an unauthorized user which may be credentialed access or lateral movement.",
   "groups": [
     "endpoint",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_metadata_process.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_metadata_process.json
index 93e1b716ff3004..ab4fd311d66460 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_metadata_process.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_metadata_process.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Windows - Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.",
   "groups": [
     "security",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_metadata_user.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_metadata_user.json
index 048b7927e72c1d..fe8a634d499214 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_metadata_user.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_metadata_user.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Windows - Looks for anomalous access to the metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.",
   "groups": [
     "endpoint",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_user_runas_event.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_user_runas_event.json
index 9db2159e18bc19..b95aa1144f4402 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_user_runas_event.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_user_runas_event.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Windows - Unusual user context switches can be due to privilege escalation.",
   "groups": [
     "endpoint",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_user_type10_remote_login.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_user_type10_remote_login.json
index 053a61ab04fd20..a6ec19401190fd 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_user_type10_remote_login.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_windows/ml/v3_windows_rare_user_type10_remote_login.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "description": "Security: Windows - Unusual RDP (remote desktop protocol) user logins can indicate account takeover or credentialed access.",
   "groups": [
     "endpoint",
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/ml/high_latency_by_geo.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/ml/high_latency_by_geo.json
index c4f06daf97d08c..98529de688e32c 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/ml/high_latency_by_geo.json
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/ml/high_latency_by_geo.json
@@ -1,5 +1,4 @@
 {
-  "job_type": "anomaly_detector",
   "groups": ["uptime"],
   "description": "Uptime Heartbeat: Identify periods of increased latency across geographical regions.",
   "analysis_config": {

From f7a1ce95a91700e2c70dd26bb47488c9f38f27c9 Mon Sep 17 00:00:00 2001
From: Mark Hopkin <mark.hopkin@elastic.co>
Date: Tue, 24 Jan 2023 12:38:25 +0000
Subject: [PATCH 49/54] [Fleet] Use optimistic locking when updating
 `installed_es` on input package policy creation (#148883)

## Summary

Part of #145529

When creating an input package policy, we now create index templates and
ingest pipelines. As part of this operation we have to update
installed_es on the installation saved object, there is a risk of lost
updates if multiple package policies are created at the same time, to
combat this i have used the in built saved object optimistic
concurrency.

I have tested this locally, we do start see conflicts occur if I create
500 package policies in concurrent batches of 25, but I think we should
have a dedicated bulk endpoint if we want to handle more than that.

I haven't pushed the automated tests as they take a few minutes to run
and I don't think there is a big enough benefit to running them as part
of CI every time.

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../server/services/epm/packages/install.ts   | 93 +++++++++++++++----
 1 file changed, 75 insertions(+), 18 deletions(-)

diff --git a/x-pack/plugins/fleet/server/services/epm/packages/install.ts b/x-pack/plugins/fleet/server/services/epm/packages/install.ts
index a16b0c28cff813..cf00ec4e3aed1d 100644
--- a/x-pack/plugins/fleet/server/services/epm/packages/install.ts
+++ b/x-pack/plugins/fleet/server/services/epm/packages/install.ts
@@ -15,11 +15,14 @@ import type {
   SavedObjectsClientContract,
   Logger,
 } from '@kbn/core/server';
+import { SavedObjectsErrorHelpers } from '@kbn/core/server';
 
 import { DEFAULT_SPACE_ID } from '@kbn/spaces-plugin/common/constants';
 
 import pRetry from 'p-retry';
 
+import { uniqBy } from 'lodash';
+
 import { isPackagePrerelease, getNormalizedDataStreams } from '../../../../common/services';
 
 import { FLEET_INSTALL_FORMAT_VERSION } from '../../../constants/fleet_es_assets';
@@ -797,15 +800,10 @@ export const updateEsAssetReferences = async (
     return true;
   });
 
-  const deduplicatedAssets =
-    [...withAssetsRemoved, ...assetsToAdd].reduce((acc, currentAsset) => {
-      const foundAsset = acc.find((asset: EsAssetReference) => asset.id === currentAsset.id);
-      if (!foundAsset) {
-        return acc.concat([currentAsset]);
-      } else {
-        return acc;
-      }
-    }, [] as EsAssetReference[]) || [];
+  const deduplicatedAssets = uniqBy(
+    [...withAssetsRemoved, ...assetsToAdd],
+    ({ type, id }) => `${type}-${id}`
+  );
 
   const {
     attributes: { installed_es: updatedAssets },
@@ -832,6 +830,49 @@ export const updateEsAssetReferences = async (
 
   return updatedAssets ?? [];
 };
+/**
+ * Utility function for adding assets the installed_es field of a package
+ * uses optimistic concurrency control to prevent missed updates
+ */
+export const optimisticallyAddEsAssetReferences = async (
+  savedObjectsClient: SavedObjectsClientContract,
+  pkgName: string,
+  assetsToAdd: EsAssetReference[]
+): Promise<EsAssetReference[]> => {
+  const addEsAssets = async () => {
+    const so = await savedObjectsClient.get<Installation>(PACKAGES_SAVED_OBJECT_TYPE, pkgName);
+
+    const installedEs = so.attributes.installed_es ?? [];
+
+    const deduplicatedAssets = uniqBy(
+      [...installedEs, ...assetsToAdd],
+      ({ type, id }) => `${type}-${id}`
+    );
+
+    const {
+      attributes: { installed_es: updatedAssets },
+    } = await savedObjectsClient.update<Installation>(
+      PACKAGES_SAVED_OBJECT_TYPE,
+      pkgName,
+      {
+        installed_es: deduplicatedAssets,
+      },
+      {
+        version: so.version,
+      }
+    );
+
+    return updatedAssets ?? [];
+  };
+
+  const onlyRetryConflictErrors = (err: Error) => {
+    if (!SavedObjectsErrorHelpers.isConflictError(err)) {
+      throw err;
+    }
+  };
+
+  return pRetry(addEsAssets, { retries: 10, onFailedAttempt: onlyRetryConflictErrors });
+};
 
 export async function ensurePackagesCompletedInstall(
   savedObjectsClient: SavedObjectsClientContract,
@@ -910,15 +951,31 @@ export async function installIndexTemplatesAndPipelines({
   // conditions on updating the installed_es field at the same time
   // These must be saved before we actually attempt to install the templates or pipelines so that we know what to
   // cleanup in the case that a single asset fails to install.
-  const newEsReferences = await updateEsAssetReferences(
-    savedObjectsClient,
-    packageInfo.name,
-    esReferences,
-    {
-      assetsToRemove: onlyForDataStreams ? [] : preparedIndexTemplates.assetsToRemove,
-      assetsToAdd: [...preparedIngestPipelines.assetsToAdd, ...preparedIndexTemplates.assetsToAdd],
-    }
-  );
+  let newEsReferences: EsAssetReference[] = [];
+
+  if (onlyForDataStreams) {
+    // if onlyForDataStreams is present that means we are in create package policy flow
+    // not install flow, meaning we do not have a lock on the installation SO
+    // so we need to use optimistic concurrency control
+    newEsReferences = await optimisticallyAddEsAssetReferences(
+      savedObjectsClient,
+      packageInfo.name,
+      [...preparedIngestPipelines.assetsToAdd, ...preparedIndexTemplates.assetsToAdd]
+    );
+  } else {
+    newEsReferences = await updateEsAssetReferences(
+      savedObjectsClient,
+      packageInfo.name,
+      esReferences,
+      {
+        assetsToRemove: preparedIndexTemplates.assetsToRemove,
+        assetsToAdd: [
+          ...preparedIngestPipelines.assetsToAdd,
+          ...preparedIndexTemplates.assetsToAdd,
+        ],
+      }
+    );
+  }
 
   // Install index templates and ingest pipelines in parallel since they typically take the longest
   const [installedTemplates] = await Promise.all([

From cfee703139b89086f6919e9d03768c72aa403006 Mon Sep 17 00:00:00 2001
From: Rudolf Meijering <skaapgif@gmail.com>
Date: Tue, 24 Jan 2023 13:49:30 +0100
Subject: [PATCH 50/54] Bump elasticsearch-js to 8.6.0-canary.3 (#148521)

## Summary

Bump elasticsearch-js to 8.6.0-canary.3 to unblock
https://github.com/elastic/kibana/issues/145653

The updated version of elasticsearch-js comes with some type changes
that causes typescript type checking to fail. I've fixed the type errors
that were obvious/easy but left todo's for some types which were harder
for me to figure out. If any of these todo's are in your team's code,
please contribute directly to the branch to fix them.


### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to
identify risks that should be tested prior to the change/feature
release.

When forming the risk matrix, consider some of the following examples
and how they may potentially impact the change:

| Risk | Probability | Severity | Mitigation/Notes |

|---------------------------|-------------|----------|-------------------------|
| Multiple Spaces&mdash;unexpected behavior in non-default Kibana Space.
| Low | High | Integration tests will verify that all features are still
supported in non-default Kibana Space and when user switches between
spaces. |
| Multiple nodes&mdash;Elasticsearch polling might have race conditions
when multiple Kibana nodes are polling for the same tasks. | High | Low
| Tasks are idempotent, so executing them multiple times will not result
in logical error, but will degrade performance. To test for this case we
add plenty of unit tests around this logic and document manual testing
procedure. |
| Code should gracefully handle cases when feature X or plugin Y are
disabled. | Medium | High | Unit tests will verify that any feature flag
or plugin combination still results in our service operational. |
| [See more potential risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) |


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Thom Heymann <thom.heymann@elastic.co>
Co-authored-by: weltenwort <stuermer@weltenwort.de>
---
 package.json                                  |  2 +-
 .../src/lib/point_in_time_finder.ts           |  6 +--
 .../src/lib/search_dsl/search_dsl.ts          |  2 +-
 .../src/apis/find.ts                          |  6 +--
 .../validation/log_entry_rate_indices.ts      |  3 +-
 .../common/http_api/shared/es_request.ts      | 52 +++++++++++++++++++
 .../infra/common/http_api/shared/index.ts     |  1 +
 .../lib/adapters/framework/adapter_types.ts   |  7 +--
 .../framework/kibana_framework_adapter.ts     | 12 -----
 .../routes/log_analysis/validation/indices.ts |  4 +-
 .../license_management/server/lib/license.ts  |  7 +--
 .../api/license/register_license_route.ts     |  2 +-
 .../items/write_list_items_to_stream.ts       |  8 +--
 .../rollup/server/collectors/helpers.ts       |  3 +-
 .../tests/anonymous/login.ts                  |  3 +-
 yarn.lock                                     | 48 ++++++++++-------
 16 files changed, 109 insertions(+), 57 deletions(-)
 create mode 100644 x-pack/plugins/infra/common/http_api/shared/es_request.ts

diff --git a/package.json b/package.json
index b9a9b3b1e338c2..72682515edd056 100644
--- a/package.json
+++ b/package.json
@@ -105,7 +105,7 @@
     "@elastic/apm-rum-react": "^1.4.2",
     "@elastic/charts": "51.3.0",
     "@elastic/datemath": "5.0.3",
-    "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@8.5.0-canary.1",
+    "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@8.6.0-canary.3",
     "@elastic/ems-client": "8.3.3",
     "@elastic/eui": "73.0.0",
     "@elastic/filesaver": "1.1.2",
diff --git a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/point_in_time_finder.ts b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/point_in_time_finder.ts
index 7dffbbdaa356fe..834a64552a1ec9 100644
--- a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/point_in_time_finder.ts
+++ b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/point_in_time_finder.ts
@@ -75,7 +75,7 @@ export class PointInTimeFinder<T = unknown, A = unknown>
     await this.open();
 
     let lastResultsCount: number;
-    let lastHitSortValue: estypes.Id[] | undefined;
+    let lastHitSortValue: estypes.SortResults | undefined;
     do {
       const results = await this.findNext({
         findOptions: this.#findOptions,
@@ -142,7 +142,7 @@ export class PointInTimeFinder<T = unknown, A = unknown>
   }: {
     findOptions: SavedObjectsFindOptions;
     id?: string;
-    searchAfter?: estypes.Id[];
+    searchAfter?: estypes.SortResults;
   }) {
     try {
       return await this.#client.find<T, A>(
@@ -167,7 +167,7 @@ export class PointInTimeFinder<T = unknown, A = unknown>
     }
   }
 
-  private getLastHitSortValue(res: SavedObjectsFindResponse): estypes.Id[] | undefined {
+  private getLastHitSortValue(res: SavedObjectsFindResponse): estypes.SortResults | undefined {
     if (res.saved_objects.length < 1) {
       return undefined;
     }
diff --git a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/search_dsl/search_dsl.ts b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/search_dsl/search_dsl.ts
index bcc705da1282d2..5af44df7172eba 100644
--- a/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/search_dsl/search_dsl.ts
+++ b/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/search_dsl/search_dsl.ts
@@ -25,7 +25,7 @@ interface GetSearchDslOptions {
   defaultSearchOperator?: SearchOperator;
   searchFields?: string[];
   rootSearchFields?: string[];
-  searchAfter?: estypes.Id[];
+  searchAfter?: estypes.SortResults;
   sortField?: string;
   sortOrder?: estypes.SortOrder;
   namespaces?: string[];
diff --git a/packages/core/saved-objects/core-saved-objects-api-server/src/apis/find.ts b/packages/core/saved-objects/core-saved-objects-api-server/src/apis/find.ts
index 8e754d26533c34..5c570437541619 100644
--- a/packages/core/saved-objects/core-saved-objects-api-server/src/apis/find.ts
+++ b/packages/core/saved-objects/core-saved-objects-api-server/src/apis/find.ts
@@ -9,7 +9,7 @@
 import type {
   SortOrder,
   AggregationsAggregationContainer,
-  Id as EsId,
+  SortResults,
 } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import type { SavedObject } from '@kbn/core-saved-objects-common';
 
@@ -68,7 +68,7 @@ export interface SavedObjectsFindOptions {
   /**
    * Use the sort values from the previous page to retrieve the next page of results.
    */
-  searchAfter?: EsId[];
+  searchAfter?: SortResults;
   /**
    * The fields to perform the parsed query against. Unlike the `searchFields` argument, these are expected to be root fields and will not
    * be modified. If used in conjunction with `searchFields`, both are concatenated together.
@@ -176,7 +176,7 @@ export interface SavedObjectsFindResult<T = unknown> extends SavedObject<T> {
    * await savedObjectsClient.closePointInTime(page2.pit_id);
    * ```
    */
-  sort?: string[];
+  sort?: SortResults;
 }
 
 /**
diff --git a/x-pack/plugins/infra/common/http_api/log_analysis/validation/log_entry_rate_indices.ts b/x-pack/plugins/infra/common/http_api/log_analysis/validation/log_entry_rate_indices.ts
index a6a7a9996d2601..73b88e052398af 100644
--- a/x-pack/plugins/infra/common/http_api/log_analysis/validation/log_entry_rate_indices.ts
+++ b/x-pack/plugins/infra/common/http_api/log_analysis/validation/log_entry_rate_indices.ts
@@ -6,6 +6,7 @@
  */
 
 import * as rt from 'io-ts';
+import { mappingRuntimeFieldRT } from '../../shared/es_request';
 
 export const LOG_ANALYSIS_VALIDATE_INDICES_PATH =
   '/api/infra/log_analysis/validation/log_entry_rate_indices';
@@ -26,7 +27,7 @@ export const validationIndicesRequestPayloadRT = rt.type({
   data: rt.type({
     fields: rt.array(validationIndicesFieldSpecificationRT),
     indices: rt.array(rt.string),
-    runtimeMappings: rt.UnknownRecord,
+    runtimeMappings: rt.record(rt.string, mappingRuntimeFieldRT),
   }),
 });
 
diff --git a/x-pack/plugins/infra/common/http_api/shared/es_request.ts b/x-pack/plugins/infra/common/http_api/shared/es_request.ts
new file mode 100644
index 00000000000000..f0583876569be6
--- /dev/null
+++ b/x-pack/plugins/infra/common/http_api/shared/es_request.ts
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as rt from 'io-ts';
+
+const scriptBaseRT = rt.partial({
+  params: rt.record(rt.string, rt.any),
+});
+
+const inlineScriptRT = rt.intersection([
+  scriptBaseRT,
+  rt.partial({
+    lang: rt.string,
+    options: rt.record(rt.string, rt.string),
+  }),
+  rt.type({
+    source: rt.string,
+  }),
+]);
+
+const storedScriptIdRT = rt.intersection([
+  scriptBaseRT,
+  rt.type({
+    id: rt.string,
+  }),
+]);
+
+const scriptRT = rt.union([inlineScriptRT, rt.string, storedScriptIdRT]);
+
+export const mappingRuntimeFieldTypeRT = rt.keyof({
+  boolean: null,
+  date: null,
+  double: null,
+  geo_point: null,
+  ip: null,
+  keyword: null,
+  long: null,
+});
+
+export const mappingRuntimeFieldRT = rt.intersection([
+  rt.partial({
+    format: rt.string,
+    script: scriptRT,
+  }),
+  rt.type({
+    type: mappingRuntimeFieldTypeRT,
+  }),
+]);
diff --git a/x-pack/plugins/infra/common/http_api/shared/index.ts b/x-pack/plugins/infra/common/http_api/shared/index.ts
index da113cb16abd2b..a869e96144a754 100644
--- a/x-pack/plugins/infra/common/http_api/shared/index.ts
+++ b/x-pack/plugins/infra/common/http_api/shared/index.ts
@@ -6,6 +6,7 @@
  */
 
 export * from './errors';
+export * from './es_request';
 export * from './metric_statistics';
 export * from './time_range';
 export * from './timing';
diff --git a/x-pack/plugins/infra/server/lib/adapters/framework/adapter_types.ts b/x-pack/plugins/infra/server/lib/adapters/framework/adapter_types.ts
index 55b847d33f87dc..29d9656bc040f8 100644
--- a/x-pack/plugins/infra/server/lib/adapters/framework/adapter_types.ts
+++ b/x-pack/plugins/infra/server/lib/adapters/framework/adapter_types.ts
@@ -50,7 +50,7 @@ export interface CallWithRequestParams extends estypes.RequestBase {
   allow_no_indices?: boolean;
   size?: number;
   terminate_after?: number;
-  fields?: string | string[];
+  fields?: estypes.Fields;
   path?: string;
   query?: string | object;
   track_total_hits?: boolean | number;
@@ -92,11 +92,6 @@ export interface InfraDatabaseMultiResponse<Hit, Aggregation> extends InfraDatab
   responses: Array<InfraDatabaseSearchResponse<Hit, Aggregation>>;
 }
 
-export interface InfraDatabaseFieldCapsResponse extends InfraDatabaseResponse {
-  indices: string[];
-  fields: InfraFieldsResponse;
-}
-
 export interface InfraDatabaseGetIndicesAliasResponse {
   [indexName: string]: {
     aliases: {
diff --git a/x-pack/plugins/infra/server/lib/adapters/framework/kibana_framework_adapter.ts b/x-pack/plugins/infra/server/lib/adapters/framework/kibana_framework_adapter.ts
index 7c0f59d2c80733..5c6cde7480c7f1 100644
--- a/x-pack/plugins/infra/server/lib/adapters/framework/kibana_framework_adapter.ts
+++ b/x-pack/plugins/infra/server/lib/adapters/framework/kibana_framework_adapter.ts
@@ -16,7 +16,6 @@ import { InfraConfig } from '../../../plugin';
 import type { InfraPluginRequestHandlerContext } from '../../../types';
 import {
   CallWithRequestParams,
-  InfraDatabaseFieldCapsResponse,
   InfraDatabaseGetIndicesAliasResponse,
   InfraDatabaseGetIndicesResponse,
   InfraDatabaseMultiResponse,
@@ -88,11 +87,6 @@ export class KibanaFramework {
     endpoint: 'msearch',
     options?: CallWithRequestParams
   ): Promise<InfraDatabaseMultiResponse<Hit, Aggregation>>;
-  callWithRequest(
-    requestContext: InfraPluginRequestHandlerContext,
-    endpoint: 'fieldCaps',
-    options?: CallWithRequestParams
-  ): Promise<InfraDatabaseFieldCapsResponse>;
   callWithRequest(
     requestContext: InfraPluginRequestHandlerContext,
     endpoint: 'indices.existsAlias',
@@ -118,7 +112,6 @@ export class KibanaFramework {
     endpoint: string,
     options?: CallWithRequestParams
   ): Promise<InfraDatabaseSearchResponse>;
-
   public async callWithRequest(
     requestContext: InfraPluginRequestHandlerContext,
     endpoint: string,
@@ -162,11 +155,6 @@ export class KibanaFramework {
           ...frozenIndicesParams,
         } as estypes.MsearchRequest);
         break;
-      case 'fieldCaps':
-        apiResult = elasticsearch.client.asCurrentUser.fieldCaps({
-          ...params,
-        });
-        break;
       case 'indices.existsAlias':
         apiResult = elasticsearch.client.asCurrentUser.indices.existsAlias({
           ...params,
diff --git a/x-pack/plugins/infra/server/routes/log_analysis/validation/indices.ts b/x-pack/plugins/infra/server/routes/log_analysis/validation/indices.ts
index 4fd7096db06ebf..6b7293e4c85594 100644
--- a/x-pack/plugins/infra/server/routes/log_analysis/validation/indices.ts
+++ b/x-pack/plugins/infra/server/routes/log_analysis/validation/indices.ts
@@ -42,7 +42,9 @@ export const initValidateLogAnalysisIndicesRoute = ({ framework }: InfraBackendL
       // Query each pattern individually, to map correctly the errors
       await Promise.all(
         indices.map(async (index) => {
-          const fieldCaps = await framework.callWithRequest(requestContext, 'fieldCaps', {
+          const fieldCaps = await (
+            await requestContext.core
+          ).elasticsearch.client.asCurrentUser.fieldCaps({
             allow_no_indices: true,
             fields: fields.map((field) => field.name),
             ignore_unavailable: true,
diff --git a/x-pack/plugins/license_management/server/lib/license.ts b/x-pack/plugins/license_management/server/lib/license.ts
index 557d9122e967ce..2d4d1b70e6446e 100644
--- a/x-pack/plugins/license_management/server/lib/license.ts
+++ b/x-pack/plugins/license_management/server/lib/license.ts
@@ -5,6 +5,7 @@
  * 2.0.
  */
 
+import { LicenseLicense } from '@elastic/elasticsearch/lib/api/types';
 import { IScopedClusterClient } from '@kbn/core/server';
 import { LicensingPluginStart } from '@kbn/licensing-plugin/server';
 
@@ -12,13 +13,13 @@ interface PutLicenseArg {
   acknowledge: boolean;
   client: IScopedClusterClient;
   licensing: LicensingPluginStart;
-  license: { [key: string]: any };
+  licenses: LicenseLicense[];
 }
 
-export async function putLicense({ acknowledge, client, licensing, license }: PutLicenseArg) {
+export async function putLicense({ acknowledge, client, licensing, licenses }: PutLicenseArg) {
   try {
     const response = await client.asCurrentUser.license.post({
-      body: license,
+      licenses,
       acknowledge,
     });
     const { acknowledged, license_status: licenseStatus } = response;
diff --git a/x-pack/plugins/license_management/server/routes/api/license/register_license_route.ts b/x-pack/plugins/license_management/server/routes/api/license/register_license_route.ts
index 0a9bbacaff4d5a..a9a7ef596b3a75 100644
--- a/x-pack/plugins/license_management/server/routes/api/license/register_license_route.ts
+++ b/x-pack/plugins/license_management/server/routes/api/license/register_license_route.ts
@@ -33,7 +33,7 @@ export function registerLicenseRoute({
             acknowledge: Boolean(req.query.acknowledge),
             client,
             licensing,
-            license: req.body,
+            licenses: [req.body.license as any],
           }),
         });
       } catch (error) {
diff --git a/x-pack/plugins/lists/server/services/items/write_list_items_to_stream.ts b/x-pack/plugins/lists/server/services/items/write_list_items_to_stream.ts
index e59ac23b9d445e..8c375a3c178e2c 100644
--- a/x-pack/plugins/lists/server/services/items/write_list_items_to_stream.ts
+++ b/x-pack/plugins/lists/server/services/items/write_list_items_to_stream.ts
@@ -65,7 +65,7 @@ export interface WriteNextResponseOptions {
   esClient: ElasticsearchClient;
   listItemIndex: string;
   stream: PassThrough;
-  searchAfter: string[] | undefined;
+  searchAfter: estypes.SortResults | undefined;
   stringToAppend: string | null | undefined;
 }
 
@@ -76,7 +76,7 @@ export const writeNextResponse = async ({
   listItemIndex,
   searchAfter,
   stringToAppend,
-}: WriteNextResponseOptions): Promise<string[] | undefined> => {
+}: WriteNextResponseOptions): Promise<estypes.SortResults | undefined> => {
   const response = await getResponse({
     esClient,
     listId,
@@ -96,7 +96,7 @@ export const getSearchAfterFromResponse = <T>({
   response,
 }: {
   response: estypes.SearchResponse<T>;
-}): string[] | undefined =>
+}): estypes.SortResults | undefined =>
   response.hits.hits.length > 0
     ? response.hits.hits[response.hits.hits.length - 1].sort
     : undefined;
@@ -104,7 +104,7 @@ export const getSearchAfterFromResponse = <T>({
 export interface GetResponseOptions {
   esClient: ElasticsearchClient;
   listId: string;
-  searchAfter: undefined | string[];
+  searchAfter: estypes.SortResults | undefined;
   listItemIndex: string;
   size?: number;
 }
diff --git a/x-pack/plugins/rollup/server/collectors/helpers.ts b/x-pack/plugins/rollup/server/collectors/helpers.ts
index 27dc3aaf89c547..e1158133c77e29 100644
--- a/x-pack/plugins/rollup/server/collectors/helpers.ts
+++ b/x-pack/plugins/rollup/server/collectors/helpers.ts
@@ -6,6 +6,7 @@
  */
 import { get } from 'lodash';
 import { ElasticsearchClient } from '@kbn/core/server';
+import { estypes } from '@elastic/elasticsearch';
 
 // elasticsearch index.max_result_window default value
 const ES_MAX_RESULT_WINDOW_DEFAULT_VALUE = 1000;
@@ -63,7 +64,7 @@ const getSavedObjectsList = async ({
   filter,
 }: {
   esClient: ElasticsearchClient;
-  searchAfter: string[] | undefined;
+  searchAfter: estypes.SortResults | undefined;
   kibanaIndex: string;
   filterPath: string[];
   filter: ESFilterProps;
diff --git a/x-pack/test/security_api_integration/tests/anonymous/login.ts b/x-pack/test/security_api_integration/tests/anonymous/login.ts
index fe211fae7f7ffc..7a8a4110c8fc80 100644
--- a/x-pack/test/security_api_integration/tests/anonymous/login.ts
+++ b/x-pack/test/security_api_integration/tests/anonymous/login.ts
@@ -168,9 +168,8 @@ export default function ({ getService }: FtrProviderContext) {
         expect(apiResponse.body.statusCode).to.be(401);
         expect(apiResponse.body.error).to.be('Unauthorized');
         expect(apiResponse.body.message).to.include.string(
-          '[security_exception] Reason: unable to authenticate user [dummy_hacker] for REST request [/_security/_authenticate]'
+          'unable to authenticate user [dummy_hacker] for REST request [/_security/_authenticate]'
         );
-
         expect(apiResponse.headers['set-cookie']).to.be(undefined);
       });
     });
diff --git a/yarn.lock b/yarn.lock
index eb2f9402c68e32..3bcf0a089a78d3 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1503,12 +1503,12 @@
   dependencies:
     "@elastic/ecs-helpers" "^1.1.0"
 
-"@elastic/elasticsearch@npm:@elastic/elasticsearch-canary@8.5.0-canary.1":
-  version "8.5.0-canary.1"
-  resolved "https://registry.yarnpkg.com/@elastic/elasticsearch-canary/-/elasticsearch-canary-8.5.0-canary.1.tgz#3e2f40bc2e58d4f1c1cc391b2d594db59c5e0cd8"
-  integrity sha512-WmiK5A04tUwpAdbPeLo9ONV/T6foYYa1EjGQFxTPmEPLyY9s0B14o1JAJ7OnzQe9qmDahSJksSA1xLr0LdutmA==
+"@elastic/elasticsearch@npm:@elastic/elasticsearch-canary@8.6.0-canary.3":
+  version "8.6.0-canary.3"
+  resolved "https://registry.yarnpkg.com/@elastic/elasticsearch-canary/-/elasticsearch-canary-8.6.0-canary.3.tgz#dc518f5ae4bb502b08ff70e4d86fa7b859b3cbe3"
+  integrity sha512-NvTZrRT/d5mJZ46pDlbgdKVIhA7ac504IGVaf7OV/7wHDmXjm8d/cG2UeQd8v37zMplGq2/853uFWGlXXjD0lQ==
   dependencies:
-    "@elastic/transport" "^8.2.0"
+    "@elastic/transport" "^8.3.1"
     tslib "^2.4.0"
 
 "@elastic/ems-client@8.3.3":
@@ -1680,17 +1680,17 @@
     undici "^5.11.0"
     yaml "^2.1.3"
 
-"@elastic/transport@^8.2.0":
-  version "8.2.0"
-  resolved "https://registry.yarnpkg.com/@elastic/transport/-/transport-8.2.0.tgz#f292cb79c918a36268dd853431e41f13544814ad"
-  integrity sha512-H/HmefMNQfLiBSVTmNExu2lYs5EzwipUnQB53WLr17RCTDaQX0oOLHcWpDsbKQSRhDAMPPzp5YZsZMJxuxPh7A==
+"@elastic/transport@^8.3.1":
+  version "8.3.1"
+  resolved "https://registry.yarnpkg.com/@elastic/transport/-/transport-8.3.1.tgz#e7569d7df35b03108ea7aa886113800245faa17f"
+  integrity sha512-jv/Yp2VLvv5tSMEOF8iGrtL2YsYHbpf4s+nDsItxUTLFTzuJGpnsB/xBlfsoT2kAYEnWHiSJuqrbRcpXEI/SEQ==
   dependencies:
     debug "^4.3.4"
     hpagent "^1.0.0"
     ms "^2.1.3"
     secure-json-parse "^2.4.0"
     tslib "^2.4.0"
-    undici "^5.1.1"
+    undici "^5.5.1"
 
 "@emotion/babel-plugin-jsx-pragmatic@^0.2.0":
   version "0.2.0"
@@ -15982,9 +15982,9 @@ hpack.js@^2.1.6:
     wbuf "^1.1.0"
 
 hpagent@^1.0.0:
-  version "1.0.0"
-  resolved "https://registry.yarnpkg.com/hpagent/-/hpagent-1.0.0.tgz#c68f68b3df845687dbdc4896546713ce09cc6bee"
-  integrity sha512-SCleE2Uc1bM752ymxg8QXYGW0TWtAV4ZW3TqH1aOnyi6T6YW2xadCcclm5qeVjvMvfQ2RKNtZxO7uVb9CTPt1A==
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/hpagent/-/hpagent-1.2.0.tgz#0ae417895430eb3770c03443456b8d90ca464903"
+  integrity sha512-A91dYTeIB6NoXG+PxTQpCCDDnfHsW9kc06Lvpu1TEe9gnd6ZFeiBoRO9JvzEv6xK7EX97/dUE8g/vBMTqTS3CA==
 
 html-element-map@^1.2.0:
   version "1.2.0"
@@ -24535,9 +24535,9 @@ scss-tokenizer@^0.4.3:
     source-map "^0.7.3"
 
 secure-json-parse@^2.4.0:
-  version "2.4.0"
-  resolved "https://registry.yarnpkg.com/secure-json-parse/-/secure-json-parse-2.4.0.tgz#5aaeaaef85c7a417f76271a4f5b0cc3315ddca85"
-  integrity sha512-Q5Z/97nbON5t/L/sH6mY2EacfjVGwrCcSi5D3btRO2GZ8pf1K1UN7Z9H5J57hjVU2Qzxr1xO+FmBhOvEkzCMmg==
+  version "2.6.0"
+  resolved "https://registry.yarnpkg.com/secure-json-parse/-/secure-json-parse-2.6.0.tgz#95d89f84adf32d76ff7800e68a673b129fe918b0"
+  integrity sha512-B9osKohb6L+EZ6Kve3wHKfsAClzOC/iISA2vSuCe5Jx5NAKiwitfxx8ZKYapHXr0sYRj7UZInT7pLb3rp2Yx6A==
 
 seedrandom@^3.0.5:
   version "3.0.5"
@@ -26627,11 +26627,16 @@ tslib@^1.10.0, tslib@^1.8.1, tslib@^1.9.0, tslib@^1.9.3:
   resolved "https://registry.yarnpkg.com/tslib/-/tslib-1.13.0.tgz#c881e13cc7015894ed914862d276436fa9a47043"
   integrity sha512-i/6DQjL8Xf3be4K/E6Wgpekn5Qasl1usyw++dAA35Ue5orEn65VIxOA+YvNNl9HV3qv70T7CNwjODHZrLwvd1Q==
 
-tslib@^2.0.0, tslib@^2.0.1, tslib@^2.0.3, tslib@^2.1.0, tslib@^2.2.0, tslib@^2.3.1, tslib@^2.4.0, tslib@~2.4.0:
+tslib@^2.0.0, tslib@^2.0.1, tslib@^2.0.3, tslib@^2.1.0, tslib@^2.2.0, tslib@^2.3.1, tslib@~2.4.0:
   version "2.4.0"
   resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.4.0.tgz#7cecaa7f073ce680a05847aa77be941098f36dc3"
   integrity sha512-d6xOpEDfsi2CZVlPQzGeux8XMwLT9hssAsaPYExaQMuYskwb+x1x7J371tWlbBdWHroy99KnVB6qIkUbs5X3UQ==
 
+tslib@^2.4.0:
+  version "2.4.1"
+  resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.4.1.tgz#0d0bfbaac2880b91e22df0768e55be9753a5b17e"
+  integrity sha512-tGyy4dAjRIEwI7BzsB0lynWgOpfqjUdq91XXAlIWD2OwKBH7oCl/GZG/HT4BOHrTlPMOASlMQ7veyTqpmRcrNA==
+
 tslib@~2.1.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.1.0.tgz#da60860f1c2ecaa5703ab7d39bc05b6bf988b97a"
@@ -26802,13 +26807,20 @@ unc-path-regex@^0.1.2:
   resolved "https://registry.yarnpkg.com/unc-path-regex/-/unc-path-regex-0.1.2.tgz#e73dd3d7b0d7c5ed86fbac6b0ae7d8c6a69d50fa"
   integrity sha1-5z3T17DXxe2G+6xrCufYxqadUPo=
 
-undici@^5.1.1, undici@^5.11.0:
+undici@^5.11.0:
   version "5.11.0"
   resolved "https://registry.yarnpkg.com/undici/-/undici-5.11.0.tgz#1db25f285821828fc09d3804b9e2e934ae86fc13"
   integrity sha512-oWjWJHzFet0Ow4YZBkyiJwiK5vWqEYoH7BINzJAJOLedZ++JpAlCbUktW2GQ2DS2FpKmxD/JMtWUUWl1BtghGw==
   dependencies:
     busboy "^1.6.0"
 
+undici@^5.5.1:
+  version "5.14.0"
+  resolved "https://registry.yarnpkg.com/undici/-/undici-5.14.0.tgz#1169d0cdee06a4ffdd30810f6228d57998884d00"
+  integrity sha512-yJlHYw6yXPPsuOH0x2Ib1Km61vu4hLiRRQoafs+WUgX1vO64vgnxiCEN9dpIrhZyHFsai3F0AEj4P9zy19enEQ==
+  dependencies:
+    busboy "^1.6.0"
+
 unfetch@^4.2.0:
   version "4.2.0"
   resolved "https://registry.yarnpkg.com/unfetch/-/unfetch-4.2.0.tgz#7e21b0ef7d363d8d9af0fb929a5555f6ef97a3be"

From cb599840e3cc3eeafa14354d65b99ccb282e1e7d Mon Sep 17 00:00:00 2001
From: ofiriro3 <ofiriro3@Gmail.com>
Date: Tue, 24 Jan 2023 14:50:54 +0200
Subject: [PATCH 51/54] [Cloud Posture] - Deprecate csp rule remove migration
 object (#148530)

---
 ...grations_state_action_machine.test.ts.snap | 30 +++++++++++++
 .../src/core/unused_types.ts                  |  2 +
 .../src/initial_state.test.ts                 |  5 +++
 .../migrations/check_registered_types.test.ts |  1 -
 .../common/constants.ts                       |  1 -
 .../common/schemas/csp_finding.ts             |  4 +-
 .../common/schemas/csp_rule.ts                | 42 -------------------
 .../common/schemas/csp_rule_template.ts       |  6 +--
 ...adata.ts => csp_rule_template_metadata.ts} |  4 +-
 .../common/schemas/csp_rules_configuration.ts | 16 -------
 .../common/schemas/index.ts                   |  4 +-
 .../cloud_security_posture/common/types.ts    |  6 +--
 .../pages/rules/rules_container.test.tsx      |  8 ++--
 .../public/pages/rules/rules_container.tsx    |  4 +-
 .../public/pages/rules/rules_table.tsx        |  2 +-
 .../public/pages/rules/test_subjects.ts       |  2 +-
 .../public/pages/rules/use_csp_rules.ts       |  4 +-
 .../routes/benchmarks/benchmarks.test.ts      |  2 +-
 .../server/saved_objects/mappings.ts          | 33 ---------------
 .../saved_objects/migrations/csp_rule.ts      | 42 -------------------
 .../migrations/csp_rule_template.ts           |  8 ++--
 .../server/saved_objects/migrations/index.ts  |  1 -
 .../server/saved_objects/saved_objects.ts     | 36 ++--------------
 .../translations/translations/fr-FR.json      |  1 -
 .../translations/translations/ja-JP.json      |  1 -
 .../translations/translations/zh-CN.json      |  1 -
 26 files changed, 67 insertions(+), 199 deletions(-)
 delete mode 100644 x-pack/plugins/cloud_security_posture/common/schemas/csp_rule.ts
 rename x-pack/plugins/cloud_security_posture/common/schemas/{csp_rule_metadata.ts => csp_rule_template_metadata.ts} (85%)
 delete mode 100644 x-pack/plugins/cloud_security_posture/common/schemas/csp_rules_configuration.ts
 delete mode 100644 x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule.ts

diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/__snapshots__/migrations_state_action_machine.test.ts.snap b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/__snapshots__/migrations_state_action_machine.test.ts.snap
index 4e19c9bf626902..b0c7fd0f372897 100644
--- a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/__snapshots__/migrations_state_action_machine.test.ts.snap
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/__snapshots__/migrations_state_action_machine.test.ts.snap
@@ -46,6 +46,11 @@ Object {
                         "type": "cases-sub-case",
                       },
                     },
+                    Object {
+                      "term": Object {
+                        "type": "csp_rule",
+                      },
+                    },
                     Object {
                       "term": Object {
                         "type": "file-upload-telemetry",
@@ -227,6 +232,11 @@ Object {
                         "type": "cases-sub-case",
                       },
                     },
+                    Object {
+                      "term": Object {
+                        "type": "csp_rule",
+                      },
+                    },
                     Object {
                       "term": Object {
                         "type": "file-upload-telemetry",
@@ -412,6 +422,11 @@ Object {
                         "type": "cases-sub-case",
                       },
                     },
+                    Object {
+                      "term": Object {
+                        "type": "csp_rule",
+                      },
+                    },
                     Object {
                       "term": Object {
                         "type": "file-upload-telemetry",
@@ -601,6 +616,11 @@ Object {
                         "type": "cases-sub-case",
                       },
                     },
+                    Object {
+                      "term": Object {
+                        "type": "csp_rule",
+                      },
+                    },
                     Object {
                       "term": Object {
                         "type": "file-upload-telemetry",
@@ -832,6 +852,11 @@ Object {
                         "type": "cases-sub-case",
                       },
                     },
+                    Object {
+                      "term": Object {
+                        "type": "csp_rule",
+                      },
+                    },
                     Object {
                       "term": Object {
                         "type": "file-upload-telemetry",
@@ -1024,6 +1049,11 @@ Object {
                         "type": "cases-sub-case",
                       },
                     },
+                    Object {
+                      "term": Object {
+                        "type": "csp_rule",
+                      },
+                    },
                     Object {
                       "term": Object {
                         "type": "file-upload-telemetry",
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/unused_types.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/unused_types.ts
index 7dbcf2c270ba47..60ace4e28de0ed 100644
--- a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/unused_types.ts
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/core/unused_types.ts
@@ -39,6 +39,8 @@ export const REMOVED_TYPES: string[] = [
   'ui-counter',
   // Deprecated, no longer used since 7.13 https://github.com/elastic/kibana/pull/94923/files
   'application_usage_transactional',
+  // Deprecated, no longer used since 8.7 https://github.com/elastic/kibana/pull/148530
+  'csp_rule',
 ].sort();
 
 // When migrating from the outdated index we use a read query which excludes
diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/initial_state.test.ts b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/initial_state.test.ts
index 35d22e69f724e5..ee99e599a998a3 100644
--- a/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/initial_state.test.ts
+++ b/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/initial_state.test.ts
@@ -83,6 +83,11 @@ describe('createInitialState', () => {
                   "type": "cases-sub-case",
                 },
               },
+              Object {
+                "term": Object {
+                  "type": "csp_rule",
+                },
+              },
               Object {
                 "term": Object {
                   "type": "file-upload-telemetry",
diff --git a/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts b/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
index 569e8b81afd2dc..5f148325d6f5aa 100644
--- a/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
+++ b/src/core/server/integration_tests/saved_objects/migrations/check_registered_types.test.ts
@@ -80,7 +80,6 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "connector_token": "fa5301aa5a2914795d3b1b82d0a49939444009da",
         "core-usage-stats": "f40a213da2c597b0de94e364a4326a5a1baa4ca9",
         "csp-rule-template": "d6104585d0b032355c64a7dbf2a834163351cb1c",
-        "csp_rule": "d2bb53ea5d2bdfba1a835ad8956dfcd2b2c32e19",
         "dashboard": "7e37790f802b39c852f905c010e13674e893105a",
         "endpoint:user-artifact": "f94c250a52b30d0a2d32635f8b4c5bdabd1e25c0",
         "endpoint:user-artifact-manifest": "8c14d49a385d5d1307d956aa743ec78de0b2be88",
diff --git a/x-pack/plugins/cloud_security_posture/common/constants.ts b/x-pack/plugins/cloud_security_posture/common/constants.ts
index 794ec8b9122944..7cc587df5d499a 100644
--- a/x-pack/plugins/cloud_security_posture/common/constants.ts
+++ b/x-pack/plugins/cloud_security_posture/common/constants.ts
@@ -41,7 +41,6 @@ export const INTERNAL_FEATURE_FLAGS = {
   showFindingsGroupBy: true,
 } as const;
 
-export const CSP_RULE_SAVED_OBJECT_TYPE = 'csp_rule';
 export const CSP_RULE_TEMPLATE_SAVED_OBJECT_TYPE = 'csp-rule-template';
 
 export const CLOUDBEAT_VANILLA = 'cloudbeat/cis_k8s'; // Integration input
diff --git a/x-pack/plugins/cloud_security_posture/common/schemas/csp_finding.ts b/x-pack/plugins/cloud_security_posture/common/schemas/csp_finding.ts
index af99c609832d6c..27690c714c0ced 100644
--- a/x-pack/plugins/cloud_security_posture/common/schemas/csp_finding.ts
+++ b/x-pack/plugins/cloud_security_posture/common/schemas/csp_finding.ts
@@ -7,7 +7,7 @@
 
 // TODO: this needs to be defined in a versioned schema
 import type { EcsEvent } from '@kbn/ecs';
-import type { CspRuleMetadata } from './csp_rule_metadata';
+import type { CspRuleTemplateMetadata } from './csp_rule_template_metadata';
 
 export interface CspFinding {
   '@timestamp': string;
@@ -19,7 +19,7 @@ export interface CspFinding {
   };
   result: CspFindingResult;
   resource: CspFindingResource;
-  rule: CspRuleMetadata;
+  rule: CspRuleTemplateMetadata;
   host: CspFindingHost;
   event: EcsEvent;
   agent: CspFindingAgent;
diff --git a/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule.ts b/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule.ts
deleted file mode 100644
index 13e237ef5637bc..00000000000000
--- a/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { schema as rt, TypeOf } from '@kbn/config-schema';
-import { cspRuleMetadataSchema } from './csp_rule_metadata';
-
-export const cspRuleSchemaV830 = rt.object({
-  audit: rt.string(),
-  benchmark: rt.object({ name: rt.string(), version: rt.string() }),
-  default_value: rt.nullable(rt.string()),
-  description: rt.string(),
-  enabled: rt.boolean(),
-  id: rt.string(),
-  impact: rt.nullable(rt.string()),
-  muted: rt.boolean(),
-  name: rt.string(),
-  package_policy_id: rt.string(),
-  policy_id: rt.string(),
-  profile_applicability: rt.string(),
-  rationale: rt.string(),
-  references: rt.nullable(rt.string()),
-  rego_rule_id: rt.string(),
-  remediation: rt.string(),
-  section: rt.string(),
-  tags: rt.arrayOf(rt.string()),
-  version: rt.string(),
-});
-
-export const cspRuleSchemaV840 = rt.object({
-  enabled: rt.boolean(),
-  metadata: cspRuleMetadataSchema,
-  muted: rt.boolean(),
-  package_policy_id: rt.string(),
-  policy_id: rt.string(),
-});
-
-export type CspRuleV830 = TypeOf<typeof cspRuleSchemaV830>;
-export type CspRuleV840 = TypeOf<typeof cspRuleSchemaV840>;
-export type CspRule = CspRuleV840;
diff --git a/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_template.ts b/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_template.ts
index c1c92f7bd690d2..d2ccff064eb58f 100644
--- a/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_template.ts
+++ b/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_template.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 import { schema as rt, TypeOf } from '@kbn/config-schema';
-import { cspRuleMetadataSchema } from './csp_rule_metadata';
+import { cspRuleTemplateMetadataSchema } from './csp_rule_template_metadata';
 
 export const cspRuleTemplateSchemaV830 = rt.object({
   audit: rt.string(),
@@ -29,12 +29,12 @@ export const cspRuleTemplateSchemaV830 = rt.object({
 
 export const cspRuleTemplateSchemaV840 = rt.object({
   enabled: rt.boolean(),
-  metadata: cspRuleMetadataSchema,
+  metadata: cspRuleTemplateMetadataSchema,
   muted: rt.boolean(),
 });
 
 export const cspRuleTemplateSchemaV870 = rt.object({
-  metadata: cspRuleMetadataSchema,
+  metadata: cspRuleTemplateMetadataSchema,
 });
 
 export type CspRuleTemplateV830 = TypeOf<typeof cspRuleTemplateSchemaV830>;
diff --git a/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_metadata.ts b/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_template_metadata.ts
similarity index 85%
rename from x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_metadata.ts
rename to x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_template_metadata.ts
index 40d84e95243371..aa6c8347b82155 100644
--- a/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_metadata.ts
+++ b/x-pack/plugins/cloud_security_posture/common/schemas/csp_rule_template_metadata.ts
@@ -6,7 +6,7 @@
  */
 import { schema as rt, TypeOf } from '@kbn/config-schema';
 
-export const cspRuleMetadataSchema = rt.object({
+export const cspRuleTemplateMetadataSchema = rt.object({
   audit: rt.string(),
   benchmark: rt.object({
     name: rt.string(),
@@ -29,4 +29,4 @@ export const cspRuleMetadataSchema = rt.object({
   version: rt.string(),
 });
 
-export type CspRuleMetadata = TypeOf<typeof cspRuleMetadataSchema>;
+export type CspRuleTemplateMetadata = TypeOf<typeof cspRuleTemplateMetadataSchema>;
diff --git a/x-pack/plugins/cloud_security_posture/common/schemas/csp_rules_configuration.ts b/x-pack/plugins/cloud_security_posture/common/schemas/csp_rules_configuration.ts
deleted file mode 100644
index 13726e1f34ea68..00000000000000
--- a/x-pack/plugins/cloud_security_posture/common/schemas/csp_rules_configuration.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-import { schema as rt, TypeOf } from '@kbn/config-schema';
-
-// cspRulesConfigSchema has to match the 'RuntimeCfg' struct in https://github.com/elastic/cloudbeat/blob/main/config/config.go#L45-L51
-export const cspRulesConfigSchema = rt.object({
-  runtime_cfg: rt.object({
-    activated_rules: rt.recordOf(rt.string(), rt.arrayOf(rt.string())),
-  }),
-});
-
-export type CspRulesConfiguration = TypeOf<typeof cspRulesConfigSchema>;
diff --git a/x-pack/plugins/cloud_security_posture/common/schemas/index.ts b/x-pack/plugins/cloud_security_posture/common/schemas/index.ts
index 5b681a5450c269..9b6034b4489f52 100644
--- a/x-pack/plugins/cloud_security_posture/common/schemas/index.ts
+++ b/x-pack/plugins/cloud_security_posture/common/schemas/index.ts
@@ -5,7 +5,5 @@
  * 2.0.
  */
 
-export * from './csp_rule';
-export * from './csp_rule_metadata';
+export * from './csp_rule_template_metadata';
 export * from './csp_rule_template';
-export * from './csp_rules_configuration';
diff --git a/x-pack/plugins/cloud_security_posture/common/types.ts b/x-pack/plugins/cloud_security_posture/common/types.ts
index 797cb5ddc86c42..a922d363d9dbc7 100644
--- a/x-pack/plugins/cloud_security_posture/common/types.ts
+++ b/x-pack/plugins/cloud_security_posture/common/types.ts
@@ -7,7 +7,7 @@
 
 import type { PackagePolicy, AgentPolicy } from '@kbn/fleet-plugin/common';
 import { SUPPORTED_CLOUDBEAT_INPUTS, SUPPORTED_POLICY_TEMPLATES } from './constants';
-import type { CspRuleMetadata } from './schemas/csp_rule_metadata';
+import type { CspRuleTemplateMetadata } from './schemas/csp_rule_template_metadata';
 
 export type Evaluation = 'passed' | 'failed' | 'NA';
 /** number between 1-100 */
@@ -100,8 +100,8 @@ export interface Benchmark {
   rules_count: number;
 }
 
-export type BenchmarkId = CspRuleMetadata['benchmark']['id'];
-export type BenchmarkName = CspRuleMetadata['benchmark']['name'];
+export type BenchmarkId = CspRuleTemplateMetadata['benchmark']['id'];
+export type BenchmarkName = CspRuleTemplateMetadata['benchmark']['name'];
 
 // Fleet Integration types
 export type PostureInput = typeof SUPPORTED_CLOUDBEAT_INPUTS[number];
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_container.test.tsx b/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_container.test.tsx
index 66c6a820b99eb5..3311fd8b81fb21 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_container.test.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_container.test.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 import { RulesContainer } from './rules_container';
 import { render, screen } from '@testing-library/react';
 import { QueryClient } from '@tanstack/react-query';
-import { useFindCspRules, type RuleSavedObject } from './use_csp_rules';
+import { useFindCspRuleTemplates, type RuleSavedObject } from './use_csp_rules';
 import * as TEST_SUBJECTS from './test_subjects';
 import { Chance } from 'chance';
 import { TestProvider } from '../../test/test_provider';
@@ -19,8 +19,8 @@ import { coreMock } from '@kbn/core/public/mocks';
 const chance = new Chance();
 
 jest.mock('./use_csp_rules', () => ({
-  useFindCspRules: jest.fn(),
-  useBulkUpdateCspRules: jest.fn(),
+  useFindCspRuleTemplates: jest.fn(),
+  useBulkUpdateCspRuleTemplates: jest.fn(),
 }));
 
 jest.mock('react-router-dom', () => ({
@@ -103,7 +103,7 @@ describe('<RulesContainer />', () => {
     const Wrapper = getWrapper();
     const rule1 = getRuleMock({ enabled: true });
 
-    (useFindCspRules as jest.Mock).mockReturnValue({
+    (useFindCspRuleTemplates as jest.Mock).mockReturnValue({
       status: 'success',
       data: {
         total: 1,
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_container.tsx b/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_container.tsx
index 1f0d4ae84be9e9..6351071bc496f9 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_container.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_container.tsx
@@ -11,7 +11,7 @@ import { extractErrorMessage, isNonNullable } from '../../../common/utils/helper
 import { RulesTable } from './rules_table';
 import { RulesTableHeader } from './rules_table_header';
 import {
-  useFindCspRules,
+  useFindCspRuleTemplates,
   type RuleSavedObject,
   type RulesQuery,
   type RulesQueryResult,
@@ -74,7 +74,7 @@ export const RulesContainer = () => {
     perPage: pageSize || 10,
   });
 
-  const { data, status, error } = useFindCspRules(
+  const { data, status, error } = useFindCspRuleTemplates(
     {
       filter: rulesQuery.filter,
       search: rulesQuery.search,
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_table.tsx b/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_table.tsx
index 9dca77a4d017cc..968cece8b40ee8 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_table.tsx
+++ b/x-pack/plugins/cloud_security_posture/public/pages/rules/rules_table.tsx
@@ -54,7 +54,7 @@ export const RulesTable = ({
   };
 
   const rowProps = (row: RuleSavedObject) => ({
-    ['data-test-subj']: TEST_SUBJECTS.getCspRulesTableRowItemTestId(row.id),
+    ['data-test-subj']: TEST_SUBJECTS.getCspRuleTemplatesTableRowItemTestId(row.id),
     style: { background: row.id === selectedRuleId ? euiTheme.colors.highlight : undefined },
     onClick: (e: MouseEvent) => {
       const tag = (e.target as HTMLDivElement).tagName;
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/rules/test_subjects.ts b/x-pack/plugins/cloud_security_posture/public/pages/rules/test_subjects.ts
index a40ccff5b5e6e3..dbbc6877e2dcfa 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/rules/test_subjects.ts
+++ b/x-pack/plugins/cloud_security_posture/public/pages/rules/test_subjects.ts
@@ -13,5 +13,5 @@ export const CSP_RULES_TABLE = 'csp_rules_table';
 export const CSP_RULES_TABLE_ROW_ITEM_NAME = 'csp_rules_table_row_item_name';
 export const CSP_RULES_FLYOUT_CONTAINER = 'csp_rules_flyout_container';
 
-export const getCspRulesTableRowItemTestId = (id: string) =>
+export const getCspRuleTemplatesTableRowItemTestId = (id: string) =>
   `${CSP_RULES_TABLE_ROW_ITEM_NAME}_${id}`;
diff --git a/x-pack/plugins/cloud_security_posture/public/pages/rules/use_csp_rules.ts b/x-pack/plugins/cloud_security_posture/public/pages/rules/use_csp_rules.ts
index 3e9f6594a7f4d9..818dbeba76c704 100644
--- a/x-pack/plugins/cloud_security_posture/public/pages/rules/use_csp_rules.ts
+++ b/x-pack/plugins/cloud_security_posture/public/pages/rules/use_csp_rules.ts
@@ -24,9 +24,9 @@ export type RuleSavedObject = Omit<
 export type RulesQuery = Required<
   Pick<SavedObjectsFindOptions, 'search' | 'page' | 'perPage' | 'filter'>
 >;
-export type RulesQueryResult = ReturnType<typeof useFindCspRules>;
+export type RulesQueryResult = ReturnType<typeof useFindCspRuleTemplates>;
 
-export const useFindCspRules = (
+export const useFindCspRuleTemplates = (
   { search, page, perPage, filter }: RulesQuery,
   packagePolicyId: string
 ) => {
diff --git a/x-pack/plugins/cloud_security_posture/server/routes/benchmarks/benchmarks.test.ts b/x-pack/plugins/cloud_security_posture/server/routes/benchmarks/benchmarks.test.ts
index 656d34462464b6..d8b432bb0391ed 100644
--- a/x-pack/plugins/cloud_security_posture/server/routes/benchmarks/benchmarks.test.ts
+++ b/x-pack/plugins/cloud_security_posture/server/routes/benchmarks/benchmarks.test.ts
@@ -258,7 +258,7 @@ describe('benchmarks API', () => {
       });
     });
 
-    describe('test addPackagePolicyCspRules', () => {
+    describe('test addPackagePolicyCspRuleTemplates', () => {
       it('should retrieve the rules count by the filtered benchmark type', async () => {
         const benchmark = 'cis_k8s';
         mockSoClient.find.mockResolvedValueOnce({
diff --git a/x-pack/plugins/cloud_security_posture/server/saved_objects/mappings.ts b/x-pack/plugins/cloud_security_posture/server/saved_objects/mappings.ts
index f0b21b1cb98060..445e839d416281 100644
--- a/x-pack/plugins/cloud_security_posture/server/saved_objects/mappings.ts
+++ b/x-pack/plugins/cloud_security_posture/server/saved_objects/mappings.ts
@@ -7,39 +7,6 @@
 
 import { SavedObjectsTypeMappingDefinition } from '@kbn/core/server';
 
-export const cspRuleSavedObjectMapping: SavedObjectsTypeMappingDefinition = {
-  dynamic: false,
-  properties: {
-    metadata: {
-      type: 'object',
-      properties: {
-        name: {
-          type: 'keyword',
-          fields: {
-            text: {
-              type: 'text',
-            },
-          },
-        },
-      },
-    },
-    package_policy_id: {
-      type: 'keyword',
-    },
-    policy_id: {
-      type: 'keyword',
-    },
-    enabled: {
-      type: 'boolean',
-      fields: {
-        keyword: {
-          type: 'keyword',
-        },
-      },
-    },
-  },
-};
-
 export const cspRuleTemplateSavedObjectMapping: SavedObjectsTypeMappingDefinition = {
   dynamic: false,
   properties: {
diff --git a/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule.ts b/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule.ts
deleted file mode 100644
index 1ebb4199231e9f..00000000000000
--- a/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule.ts
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import {
-  SavedObjectMigrationMap,
-  SavedObjectUnsanitizedDoc,
-  SavedObjectMigrationContext,
-} from '@kbn/core/server';
-import { CspRuleV830, CspRuleV840 } from '../../../common/schemas/csp_rule';
-
-function migrateCspRuleMetadata(
-  doc: SavedObjectUnsanitizedDoc<CspRuleV830>,
-  context: SavedObjectMigrationContext
-): SavedObjectUnsanitizedDoc<CspRuleV840> {
-  // eslint-disable-next-line @typescript-eslint/naming-convention
-  const { enabled, muted, package_policy_id, policy_id, benchmark, ...metadata } = doc.attributes;
-
-  return {
-    ...doc,
-    attributes: {
-      enabled,
-      muted,
-      package_policy_id,
-      policy_id,
-      metadata: {
-        ...metadata,
-        benchmark: { ...benchmark, id: 'cis_k8s', rule_number: '' },
-        impact: metadata.impact || undefined,
-        default_value: metadata.default_value || undefined,
-        references: metadata.references || undefined,
-      },
-    },
-  };
-}
-
-export const cspRuleMigrations: SavedObjectMigrationMap = {
-  '8.4.0': migrateCspRuleMetadata,
-};
diff --git a/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule_template.ts b/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule_template.ts
index bd46457c76281c..10f693e9ea7c3f 100644
--- a/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule_template.ts
+++ b/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/csp_rule_template.ts
@@ -16,7 +16,7 @@ import {
   CspRuleTemplateV870,
 } from '../../../common/schemas/csp_rule_template';
 
-function migrateCspRuleMetadata(
+function migrateCspRuleTemplatesToV840(
   doc: SavedObjectUnsanitizedDoc<CspRuleTemplateV830>,
   context: SavedObjectMigrationContext
 ): SavedObjectUnsanitizedDoc<CspRuleTemplateV840> {
@@ -37,7 +37,7 @@ function migrateCspRuleMetadata(
   };
 }
 
-function migrateCspRuleTemplateDeprecateState(
+function migrateCspRuleTemplatesToV870(
   doc: SavedObjectUnsanitizedDoc<CspRuleTemplateV840>,
   context: SavedObjectMigrationContext
 ): SavedObjectUnsanitizedDoc<CspRuleTemplateV870> {
@@ -50,6 +50,6 @@ function migrateCspRuleTemplateDeprecateState(
 }
 
 export const cspRuleTemplateMigrations: SavedObjectMigrationMap = {
-  '8.4.0': migrateCspRuleMetadata,
-  '8.7.0': migrateCspRuleTemplateDeprecateState,
+  '8.4.0': migrateCspRuleTemplatesToV840,
+  '8.7.0': migrateCspRuleTemplatesToV870,
 };
diff --git a/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/index.ts b/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/index.ts
index 01120e57d4efbd..991b7469a91291 100644
--- a/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/index.ts
+++ b/x-pack/plugins/cloud_security_posture/server/saved_objects/migrations/index.ts
@@ -5,5 +5,4 @@
  * 2.0.
  */
 
-export * from './csp_rule';
 export * from './csp_rule_template';
diff --git a/x-pack/plugins/cloud_security_posture/server/saved_objects/saved_objects.ts b/x-pack/plugins/cloud_security_posture/server/saved_objects/saved_objects.ts
index 29c25e4789aec3..92b709db1825cc 100644
--- a/x-pack/plugins/cloud_security_posture/server/saved_objects/saved_objects.ts
+++ b/x-pack/plugins/cloud_security_posture/server/saved_objects/saved_objects.ts
@@ -5,47 +5,19 @@
  * 2.0.
  */
 
-import { i18n } from '@kbn/i18n';
 import { SavedObjectsServiceSetup } from '@kbn/core/server';
-import { cspRuleSavedObjectMapping, cspRuleTemplateSavedObjectMapping } from './mappings';
-import { cspRuleMigrations, cspRuleTemplateMigrations } from './migrations';
+import { cspRuleTemplateSavedObjectMapping } from './mappings';
+import { cspRuleTemplateMigrations } from './migrations';
 import {
-  cspRuleSchemaV830,
-  cspRuleSchemaV840,
   cspRuleTemplateSchemaV830,
   cspRuleTemplateSchemaV840,
-  CspRuleTemplate,
-  CspRule,
   cspRuleTemplateSchemaV870,
+  CspRuleTemplate,
 } from '../../common/schemas';
 
-import {
-  CSP_RULE_SAVED_OBJECT_TYPE,
-  CSP_RULE_TEMPLATE_SAVED_OBJECT_TYPE,
-} from '../../common/constants';
+import { CSP_RULE_TEMPLATE_SAVED_OBJECT_TYPE } from '../../common/constants';
 
 export function setupSavedObjects(savedObjects: SavedObjectsServiceSetup) {
-  savedObjects.registerType<CspRule>({
-    name: CSP_RULE_SAVED_OBJECT_TYPE,
-    hidden: false,
-    namespaceType: 'agnostic',
-    management: {
-      importableAndExportable: true,
-      visibleInManagement: true,
-      getTitle: (savedObject) =>
-        `${i18n.translate('xpack.csp.cspSettings.rules', {
-          defaultMessage: `CSP Security Rules - `,
-        })} ${savedObject.attributes.metadata.benchmark.name} ${
-          savedObject.attributes.metadata.benchmark.version
-        } ${savedObject.attributes.metadata.name}`,
-    },
-    schemas: {
-      '8.3.0': cspRuleSchemaV830,
-      '8.4.0': cspRuleSchemaV840,
-    },
-    migrations: cspRuleMigrations,
-    mappings: cspRuleSavedObjectMapping,
-  });
   savedObjects.registerType<CspRuleTemplate>({
     name: CSP_RULE_TEMPLATE_SAVED_OBJECT_TYPE,
     hidden: false,
diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json
index a178a7b0014fae..fd10f3281b25b9 100644
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@@ -10172,7 +10172,6 @@
     "xpack.csp.createPackagePolicy.customAssetsTab.rulesViewLabel": "Afficher les règles CSP ",
     "xpack.csp.cspEvaluationBadge.failLabel": "Échec",
     "xpack.csp.cspEvaluationBadge.passLabel": "Réussite",
-    "xpack.csp.cspSettings.rules": "Règles de sécurité du CSP - ",
     "xpack.csp.dashboard.benchmarkSection.clusterTitleTooltip.clusterPrefixTitle": "Afficher tous les résultats pour ",
     "xpack.csp.dashboard.benchmarkSection.defaultClusterTitle": "ID cluster",
     "xpack.csp.dashboard.benchmarkSection.manageRulesButton": "Gérer les règles",
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 3cfdf2f6d90936..f7fe9e893d3d66 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -10161,7 +10161,6 @@
     "xpack.csp.createPackagePolicy.customAssetsTab.rulesViewLabel": "CSPルールを表示 ",
     "xpack.csp.cspEvaluationBadge.failLabel": "失敗",
     "xpack.csp.cspEvaluationBadge.passLabel": "合格",
-    "xpack.csp.cspSettings.rules": "CSPセキュリティルール - ",
     "xpack.csp.dashboard.benchmarkSection.clusterTitleTooltip.clusterPrefixTitle": "すべての調査結果を表示 ",
     "xpack.csp.dashboard.benchmarkSection.defaultClusterTitle": "クラスターID",
     "xpack.csp.dashboard.benchmarkSection.manageRulesButton": "ルールの管理",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index 6f7c68de2494cf..64b94583cc67f6 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -10176,7 +10176,6 @@
     "xpack.csp.createPackagePolicy.customAssetsTab.rulesViewLabel": "查看 CSP 规则 ",
     "xpack.csp.cspEvaluationBadge.failLabel": "失败",
     "xpack.csp.cspEvaluationBadge.passLabel": "通过",
-    "xpack.csp.cspSettings.rules": "CSP 安全规则 - ",
     "xpack.csp.dashboard.benchmarkSection.clusterTitleTooltip.clusterPrefixTitle": "显示以下所有结果 ",
     "xpack.csp.dashboard.benchmarkSection.defaultClusterTitle": "集群 ID",
     "xpack.csp.dashboard.benchmarkSection.manageRulesButton": "管理规则",

From 09c11131271bec1b794d5a472294e6e125116f4d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez=20Haro?=
 <alejandro.haro@elastic.co>
Date: Tue, 24 Jan 2023 15:03:37 +0100
Subject: [PATCH 52/54] [FTRs] Execution Context: fix no data flakiness
 (#149406)

Resolves https://github.com/elastic/kibana/issues/112102
---
 .../tests/browser.ts                          | 520 ++++++++++--------
 1 file changed, 283 insertions(+), 237 deletions(-)

diff --git a/x-pack/test/functional_execution_context/tests/browser.ts b/x-pack/test/functional_execution_context/tests/browser.ts
index 1265fa205f7bc7..085fae8ed0d6a0 100644
--- a/x-pack/test/functional_execution_context/tests/browser.ts
+++ b/x-pack/test/functional_execution_context/tests/browser.ts
@@ -10,7 +10,7 @@ import type { FtrProviderContext } from '../ftr_provider_context';
 import { assertLogContains, forceSyncLogFile, isExecutionContextLog } from '../test_utils';
 
 export default function ({ getService, getPageObjects }: FtrProviderContext) {
-  const PageObjects = getPageObjects(['common', 'dashboard', 'header', 'home']);
+  const PageObjects = getPageObjects(['common', 'dashboard', 'header', 'home', 'timePicker']);
   const retry = getService('retry');
 
   describe('Browser apps', () => {
@@ -33,6 +33,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
     describe('discover app', () => {
       before(async () => {
         await PageObjects.common.navigateToApp('discover');
+        await PageObjects.timePicker.setCommonlyUsedTime('Last_7 days');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await forceSyncLogFile();
       });
@@ -48,56 +49,62 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
           });
       }
 
-      it('propagates context for Discover', async () => {
-        await assertLogContains({
-          description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-          predicate: (record) =>
-            Boolean(record.http?.request?.id?.includes('kibana:application:discover')),
-          retry,
+      describe('propagates context for Discover', () => {
+        it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
+          await assertLogContains({
+            description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
+            predicate: (record) =>
+              Boolean(record.http?.request?.id?.includes('kibana:application:discover')),
+            retry,
+          });
         });
 
-        await assertLogContains({
-          description: 'execution context propagates to Kibana logs (fetch documents)',
-          predicate: checkExecutionContextEntry({
-            type: 'application',
-            name: 'discover',
-            url: '/app/discover',
-            child: {
+        it('propagates to Kibana logs (fetch documents)', async () => {
+          await assertLogContains({
+            description: 'execution context propagates to Kibana logs (fetch documents)',
+            predicate: checkExecutionContextEntry({
+              type: 'application',
               name: 'discover',
               url: '/app/discover',
-              type: 'application',
-              page: 'app',
-              id: 'new',
-              description: 'fetch documents',
-            },
-          }),
-          retry,
+              child: {
+                name: 'discover',
+                url: '/app/discover',
+                type: 'application',
+                page: 'app',
+                id: 'new',
+                description: 'fetch documents',
+              },
+            }),
+            retry,
+          });
         });
 
-        await assertLogContains({
-          description:
-            'execution context propagates to Kibana logs (fetch chart data and total hits)',
-          predicate: checkExecutionContextEntry({
-            type: 'application',
-            name: 'discover',
-            url: '/app/discover',
-            child: {
+        it('propagates to Kibana logs (fetch chart data and total hits)', async () => {
+          await assertLogContains({
+            description:
+              'execution context propagates to Kibana logs (fetch chart data and total hits)',
+            predicate: checkExecutionContextEntry({
+              type: 'application',
               name: 'discover',
               url: '/app/discover',
-              type: 'application',
-              page: 'app',
-              id: 'new',
-              description: 'fetch chart data and total hits',
               child: {
-                type: 'lens',
-                name: 'lnsXY',
-                id: 'unifiedHistogramLensComponent',
-                description: 'Edit visualization',
-                url: '/app/lens#/edit_by_value',
+                name: 'discover',
+                url: '/app/discover',
+                type: 'application',
+                page: 'app',
+                id: 'new',
+                description: 'fetch chart data and total hits',
+                child: {
+                  type: 'lens',
+                  name: 'lnsXY',
+                  id: 'unifiedHistogramLensComponent',
+                  description: 'Edit visualization',
+                  url: '/app/lens#/edit_by_value',
+                },
               },
-            },
-          }),
-          retry,
+            }),
+            retry,
+          });
         });
       });
     });
@@ -106,6 +113,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       before(async () => {
         await PageObjects.common.navigateToApp('dashboard');
         await PageObjects.dashboard.loadSavedDashboard('[Flights] Global Flight Dashboard');
+        await PageObjects.timePicker.setCommonlyUsedTime('Last_7 days');
         await PageObjects.dashboard.waitForRenderComplete();
         await PageObjects.header.waitUntilLoadingHasFinished();
         await forceSyncLogFile();
@@ -156,15 +164,175 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       }
 
       describe('propagates context for Lens visualizations', () => {
-        it('lnsXY', async () => {
+        describe('lnsXY', () => {
+          it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
+            await assertLogContains({
+              description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
+              predicate: checkHttpRequestId(
+                'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsXY:086ac2e9-dd16-4b45-92b8-1e43ff7e3f65'
+              ),
+              retry,
+            });
+          });
+
+          it('propagates to Kibana logs', async () => {
+            await assertLogContains({
+              description: 'execution context propagates to Kibana logs',
+              predicate: checkExecutionContextEntry({
+                type: 'application',
+                name: 'dashboards',
+                url: '/app/dashboards',
+                child: {
+                  name: 'dashboards',
+                  url: '/app/dashboards',
+                  type: 'dashboard',
+                  page: 'app',
+                  id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
+                  description: '[Flights] Global Flight Dashboard',
+                  child: {
+                    type: 'lens',
+                    name: 'lnsXY',
+                    id: '086ac2e9-dd16-4b45-92b8-1e43ff7e3f65',
+                    description: '[Flights] Flight count',
+                    url: '/app/lens#/edit_by_value',
+                  },
+                },
+              }),
+              retry,
+            });
+          });
+        });
+
+        describe('lnsMetric', () => {
+          it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
+            await assertLogContains({
+              description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
+              predicate: checkHttpRequestId(
+                'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsLegacyMetric:b766e3b8-4544-46ed-99e6-9ecc4847e2a2'
+              ),
+              retry,
+            });
+          });
+
+          it('propagates to Kibana logs', async () => {
+            await assertLogContains({
+              description: 'execution context propagates to Kibana logs',
+              predicate: checkExecutionContextEntry({
+                name: 'dashboards',
+                url: '/app/dashboards',
+                type: 'application',
+                child: {
+                  name: 'dashboards',
+                  url: '/app/dashboards',
+                  type: 'dashboard',
+                  page: 'app',
+                  id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
+                  description: '[Flights] Global Flight Dashboard',
+                  child: {
+                    type: 'lens',
+                    name: 'lnsLegacyMetric',
+                    id: 'b766e3b8-4544-46ed-99e6-9ecc4847e2a2',
+                    description: '',
+                    url: '/app/lens#/edit_by_value',
+                  },
+                },
+              }),
+              retry,
+            });
+          });
+        });
+
+        describe('lnsDatatable', () => {
+          it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
+            await assertLogContains({
+              description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
+              predicate: checkHttpRequestId(
+                'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsDatatable:fb86b32f-fb7a-45cf-9511-f366fef51bbd'
+              ),
+              retry,
+            });
+          });
+
+          it('propagates to Kibana logs', async () => {
+            await assertLogContains({
+              description: 'execution context propagates to Kibana logs',
+              predicate: checkExecutionContextEntry({
+                name: 'dashboards',
+                url: '/app/dashboards',
+                type: 'application',
+                child: {
+                  name: 'dashboards',
+                  url: '/app/dashboards',
+                  type: 'dashboard',
+                  page: 'app',
+                  id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
+                  description: '[Flights] Global Flight Dashboard',
+                  child: {
+                    type: 'lens',
+                    name: 'lnsDatatable',
+                    id: 'fb86b32f-fb7a-45cf-9511-f366fef51bbd',
+                    description: 'Cities by delay, cancellation',
+                    url: '/app/lens#/edit_by_value',
+                  },
+                },
+              }),
+              retry,
+            });
+          });
+        });
+
+        describe('lnsPie', () => {
+          it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
+            await assertLogContains({
+              description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
+              predicate: checkHttpRequestId(
+                'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsPie:5d53db36-2d5a-4adc-af7b-cec4c1a294e0'
+              ),
+              retry,
+            });
+          });
+
+          it('propagates to Kibana logs', async () => {
+            await assertLogContains({
+              description: 'execution context propagates to Kibana logs',
+              predicate: checkExecutionContextEntry({
+                name: 'dashboards',
+                url: '/app/dashboards',
+                type: 'application',
+                child: {
+                  name: 'dashboards',
+                  url: '/app/dashboards',
+                  type: 'dashboard',
+                  page: 'app',
+                  id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
+                  description: '[Flights] Global Flight Dashboard',
+                  child: {
+                    type: 'lens',
+                    name: 'lnsPie',
+                    id: '5d53db36-2d5a-4adc-af7b-cec4c1a294e0',
+                    description: '[Flights] Delay Type',
+                    url: '/app/lens#/edit_by_value',
+                  },
+                },
+              }),
+              retry,
+            });
+          });
+        });
+      });
+
+      describe('propagates context for built-in Discover', () => {
+        it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
           await assertLogContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
             predicate: checkHttpRequestId(
-              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsXY:086ac2e9-dd16-4b45-92b8-1e43ff7e3f65'
+              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;search:discover:571aaf70-4c88-11e8-b3d7-01146121b73d'
             ),
             retry,
           });
+        });
 
+        it('propagates to Kibana logs', async () => {
           await assertLogContains({
             description: 'execution context propagates to Kibana logs',
             predicate: checkExecutionContextEntry({
@@ -172,69 +340,69 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
               name: 'dashboards',
               url: '/app/dashboards',
               child: {
+                type: 'dashboard',
                 name: 'dashboards',
                 url: '/app/dashboards',
-                type: 'dashboard',
                 page: 'app',
                 id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
                 description: '[Flights] Global Flight Dashboard',
                 child: {
-                  type: 'lens',
-                  name: 'lnsXY',
-                  id: '086ac2e9-dd16-4b45-92b8-1e43ff7e3f65',
-                  description: '[Flights] Flight count',
-                  url: '/app/lens#/edit_by_value',
+                  type: 'search',
+                  name: 'discover',
+                  id: '571aaf70-4c88-11e8-b3d7-01146121b73d',
+                  description: '[Flights] Flight Log',
+                  url: '/app/discover#/view/571aaf70-4c88-11e8-b3d7-01146121b73d',
                 },
               },
             }),
             retry,
           });
         });
+      });
 
-        it('lnsMetric', async () => {
+      describe('propagates context for TSVB visualizations', () => {
+        it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
           await assertLogContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-            predicate: checkHttpRequestId(
-              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsLegacyMetric:b766e3b8-4544-46ed-99e6-9ecc4847e2a2'
-            ),
+            predicate: checkHttpRequestId('agg_based:metrics:bcb63b50-4c89-11e8-b3d7-01146121b73d'),
             retry,
           });
+        });
 
+        it('propagates to Kibana logs', async () => {
           await assertLogContains({
             description: 'execution context propagates to Kibana logs',
             predicate: checkExecutionContextEntry({
               name: 'dashboards',
               url: '/app/dashboards',
               type: 'application',
+              page: 'app',
+              description: '[Flights] Global Flight Dashboard',
               child: {
-                name: 'dashboards',
-                url: '/app/dashboards',
-                type: 'dashboard',
-                page: 'app',
-                id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
-                description: '[Flights] Global Flight Dashboard',
-                child: {
-                  type: 'lens',
-                  name: 'lnsLegacyMetric',
-                  id: 'b766e3b8-4544-46ed-99e6-9ecc4847e2a2',
-                  description: '',
-                  url: '/app/lens#/edit_by_value',
-                },
+                type: 'agg_based',
+                name: 'metrics',
+                id: 'bcb63b50-4c89-11e8-b3d7-01146121b73d',
+                description: '[Flights] Delays & Cancellations',
+                url: '/app/visualize#/edit/bcb63b50-4c89-11e8-b3d7-01146121b73d',
               },
             }),
             retry,
           });
         });
+      });
 
-        it('lnsDatatable', async () => {
+      describe('propagates context for Vega visualizations', () => {
+        it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
           await assertLogContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
             predicate: checkHttpRequestId(
-              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsDatatable:fb86b32f-fb7a-45cf-9511-f366fef51bbd'
+              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:vega:ed78a660-53a0-11e8-acbd-0be0ad9d822b'
             ),
             retry,
           });
+        });
 
+        it('propagates to Kibana logs', async () => {
           await assertLogContains({
             description: 'execution context propagates to Kibana logs',
             predicate: checkExecutionContextEntry({
@@ -249,26 +417,31 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                 id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
                 description: '[Flights] Global Flight Dashboard',
                 child: {
-                  type: 'lens',
-                  name: 'lnsDatatable',
-                  id: 'fb86b32f-fb7a-45cf-9511-f366fef51bbd',
-                  description: 'Cities by delay, cancellation',
-                  url: '/app/lens#/edit_by_value',
+                  type: 'agg_based',
+                  name: 'vega',
+                  id: 'ed78a660-53a0-11e8-acbd-0be0ad9d822b',
+                  description: '[Flights] Airport Connections (Hover Over Airport)',
+                  url: '/app/visualize#/edit/ed78a660-53a0-11e8-acbd-0be0ad9d822b',
                 },
               },
             }),
             retry,
           });
         });
+      });
 
-        it('lnsPie', async () => {
+      describe('propagates context for Tag Cloud visualization', () => {
+        it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
           await assertLogContains({
             description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
             predicate: checkHttpRequestId(
-              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;lens:lnsPie:5d53db36-2d5a-4adc-af7b-cec4c1a294e0'
+              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:tagcloud:293b5a30-4c8f-11e8-b3d7-01146121b73d'
             ),
             retry,
           });
+        });
+
+        it('propagates to Kibana logs', async () => {
           await assertLogContains({
             description: 'execution context propagates to Kibana logs',
             predicate: checkExecutionContextEntry({
@@ -283,11 +456,11 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
                 id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
                 description: '[Flights] Global Flight Dashboard',
                 child: {
-                  type: 'lens',
-                  name: 'lnsPie',
-                  id: '5d53db36-2d5a-4adc-af7b-cec4c1a294e0',
-                  description: '[Flights] Delay Type',
-                  url: '/app/lens#/edit_by_value',
+                  type: 'agg_based',
+                  name: 'tagcloud',
+                  id: '293b5a30-4c8f-11e8-b3d7-01146121b73d',
+                  description: '[Flights] Destination Weather',
+                  url: '/app/visualize#/edit/293b5a30-4c8f-11e8-b3d7-01146121b73d',
                 },
               },
             }),
@@ -296,169 +469,42 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         });
       });
 
-      it('propagates context for built-in Discover', async () => {
-        await assertLogContains({
-          description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-          predicate: checkHttpRequestId(
-            'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;search:discover:571aaf70-4c88-11e8-b3d7-01146121b73d'
-          ),
-          retry,
-        });
-        await assertLogContains({
-          description: 'execution context propagates to Kibana logs',
-          predicate: checkExecutionContextEntry({
-            type: 'application',
-            name: 'dashboards',
-            url: '/app/dashboards',
-            child: {
-              type: 'dashboard',
-              name: 'dashboards',
-              url: '/app/dashboards',
-              page: 'app',
-              id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
-              description: '[Flights] Global Flight Dashboard',
-              child: {
-                type: 'search',
-                name: 'discover',
-                id: '571aaf70-4c88-11e8-b3d7-01146121b73d',
-                description: '[Flights] Flight Log',
-                url: '/app/discover#/view/571aaf70-4c88-11e8-b3d7-01146121b73d',
-              },
-            },
-          }),
-          retry,
-        });
-      });
-
-      it('propagates context for TSVB visualizations', async () => {
-        await assertLogContains({
-          description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-          predicate: checkHttpRequestId('agg_based:metrics:bcb63b50-4c89-11e8-b3d7-01146121b73d'),
-          retry,
-        });
-
-        await assertLogContains({
-          description: 'execution context propagates to Kibana logs',
-          predicate: checkExecutionContextEntry({
-            name: 'dashboards',
-            url: '/app/dashboards',
-            type: 'application',
-            page: 'app',
-            description: '[Flights] Global Flight Dashboard',
-            child: {
-              type: 'agg_based',
-              name: 'metrics',
-              id: 'bcb63b50-4c89-11e8-b3d7-01146121b73d',
-              description: '[Flights] Delays & Cancellations',
-              url: '/app/visualize#/edit/bcb63b50-4c89-11e8-b3d7-01146121b73d',
-            },
-          }),
-          retry,
-        });
-      });
-
-      it('propagates context for Vega visualizations', async () => {
-        await assertLogContains({
-          description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-          predicate: checkHttpRequestId(
-            'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:vega:ed78a660-53a0-11e8-acbd-0be0ad9d822b'
-          ),
-          retry,
-        });
-
-        await assertLogContains({
-          description: 'execution context propagates to Kibana logs',
-          predicate: checkExecutionContextEntry({
-            name: 'dashboards',
-            url: '/app/dashboards',
-            type: 'application',
-            child: {
-              name: 'dashboards',
-              url: '/app/dashboards',
-              type: 'dashboard',
-              page: 'app',
-              id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
-              description: '[Flights] Global Flight Dashboard',
-              child: {
-                type: 'agg_based',
-                name: 'vega',
-                id: 'ed78a660-53a0-11e8-acbd-0be0ad9d822b',
-                description: '[Flights] Airport Connections (Hover Over Airport)',
-                url: '/app/visualize#/edit/ed78a660-53a0-11e8-acbd-0be0ad9d822b',
-              },
-            },
-          }),
-          retry,
-        });
-      });
-
-      it('propagates context for Tag Cloud visualization', async () => {
-        await assertLogContains({
-          description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-          predicate: checkHttpRequestId(
-            'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:tagcloud:293b5a30-4c8f-11e8-b3d7-01146121b73d'
-          ),
-          retry,
-        });
-
-        await assertLogContains({
-          description: 'execution context propagates to Kibana logs',
-          predicate: checkExecutionContextEntry({
-            name: 'dashboards',
-            url: '/app/dashboards',
-            type: 'application',
-            child: {
-              name: 'dashboards',
-              url: '/app/dashboards',
-              type: 'dashboard',
-              page: 'app',
-              id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
-              description: '[Flights] Global Flight Dashboard',
-              child: {
-                type: 'agg_based',
-                name: 'tagcloud',
-                id: '293b5a30-4c8f-11e8-b3d7-01146121b73d',
-                description: '[Flights] Destination Weather',
-                url: '/app/visualize#/edit/293b5a30-4c8f-11e8-b3d7-01146121b73d',
-              },
-            },
-          }),
-          retry,
-        });
-      });
-
-      it('propagates context for Vertical bar visualization', async () => {
-        await assertLogContains({
-          description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
-          predicate: checkHttpRequestId(
-            'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:histogram:9886b410-4c8b-11e8-b3d7-01146121b73d'
-          ),
-          retry,
+      describe('propagates context for Vertical bar visualization', () => {
+        it('propagates to Elasticsearch via "x-opaque-id" header', async () => {
+          await assertLogContains({
+            description: 'execution context propagates to Elasticsearch via "x-opaque-id" header',
+            predicate: checkHttpRequestId(
+              'dashboard:dashboards:7adfa750-4c81-11e8-b3d7-01146121b73d;agg_based:histogram:9886b410-4c8b-11e8-b3d7-01146121b73d'
+            ),
+            retry,
+          });
         });
 
-        await assertLogContains({
-          description: 'execution context propagates to Kibana logs',
-          predicate: checkExecutionContextEntry({
-            type: 'application',
-            name: 'dashboards',
-            url: '/app/dashboards',
-            child: {
-              type: 'dashboard',
+        it('propagates to Kibana logs', async () => {
+          await assertLogContains({
+            description: 'execution context propagates to Kibana logs',
+            predicate: checkExecutionContextEntry({
+              type: 'application',
               name: 'dashboards',
               url: '/app/dashboards',
-              page: 'app',
-              id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
-              description: '[Flights] Global Flight Dashboard',
               child: {
-                type: 'agg_based',
-                name: 'histogram',
-                id: '9886b410-4c8b-11e8-b3d7-01146121b73d',
-                description: '[Flights] Delay Buckets',
-                url: '/app/visualize#/edit/9886b410-4c8b-11e8-b3d7-01146121b73d',
+                type: 'dashboard',
+                name: 'dashboards',
+                url: '/app/dashboards',
+                page: 'app',
+                id: '7adfa750-4c81-11e8-b3d7-01146121b73d',
+                description: '[Flights] Global Flight Dashboard',
+                child: {
+                  type: 'agg_based',
+                  name: 'histogram',
+                  id: '9886b410-4c8b-11e8-b3d7-01146121b73d',
+                  description: '[Flights] Delay Buckets',
+                  url: '/app/visualize#/edit/9886b410-4c8b-11e8-b3d7-01146121b73d',
+                },
               },
-            },
-          }),
-          retry,
+            }),
+            retry,
+          });
         });
       });
     });

From 1dc5748d5d7df2aa00d28d0771c23c25a79e34ad Mon Sep 17 00:00:00 2001
From: Shahzad <shahzad31comp@gmail.com>
Date: Tue, 24 Jan 2023 15:20:53 +0100
Subject: [PATCH 53/54] [Synthetics] Errors list active state (#149387)

Fixes https://github.com/elastic/kibana/issues/145373
---
 .../common/runtime_types/ping/ping.ts         |   9 ++
 .../hooks/use_monitor_errors.tsx              |  16 ++-
 .../monitor_details_last_run.tsx              |  17 ++-
 .../monitor_errors/errors_list.tsx            | 132 ++++++++++++------
 .../monitor_errors/errors_tab_content.tsx     |   4 +-
 .../monitor_errors/monitor_errors.tsx         |   4 +-
 6 files changed, 124 insertions(+), 58 deletions(-)

diff --git a/x-pack/plugins/synthetics/common/runtime_types/ping/ping.ts b/x-pack/plugins/synthetics/common/runtime_types/ping/ping.ts
index 7fb0a799605a8c..b15c47070911f8 100644
--- a/x-pack/plugins/synthetics/common/runtime_types/ping/ping.ts
+++ b/x-pack/plugins/synthetics/common/runtime_types/ping/ping.ts
@@ -242,7 +242,16 @@ export const PingType = t.intersection([
   }),
 ]);
 
+export const PingStateType = t.type({
+  timestamp: t.string,
+  '@timestamp': t.string,
+  monitor: MonitorType,
+  docId: t.string,
+  state: ErrorStateCodec,
+  error: PingErrorType,
+});
 export type Ping = t.TypeOf<typeof PingType>;
+export type PingState = t.TypeOf<typeof PingStateType>;
 
 export const PingStatusType = t.intersection([
   t.type({
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/hooks/use_monitor_errors.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/hooks/use_monitor_errors.tsx
index dd8f9b9ff7c7b2..dcecbb5f9df8a4 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/hooks/use_monitor_errors.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/hooks/use_monitor_errors.tsx
@@ -5,10 +5,10 @@
  * 2.0.
  */
 
-import { useEsSearch } from '@kbn/observability-plugin/public';
+import { useEsSearch, useTimeZone } from '@kbn/observability-plugin/public';
 import { useParams } from 'react-router-dom';
 import { useMemo } from 'react';
-import { Ping } from '../../../../../../common/runtime_types';
+import { PingState } from '../../../../../../common/runtime_types';
 import {
   EXCLUDE_RUN_ONCE_FILTER,
   SUMMARY_FILTER,
@@ -24,6 +24,8 @@ export function useMonitorErrors(monitorIdArg?: string) {
 
   const { dateRangeStart, dateRangeEnd } = useGetUrlParams();
 
+  const timeZone = useTimeZone();
+
   const { data, loading } = useEsSearch(
     {
       index: SYNTHETICS_INDEX_PATTERN,
@@ -39,6 +41,7 @@ export function useMonitorErrors(monitorIdArg?: string) {
                   '@timestamp': {
                     gte: dateRangeStart,
                     lte: dateRangeEnd,
+                    time_zone: timeZone,
                   },
                 },
               },
@@ -55,18 +58,18 @@ export function useMonitorErrors(monitorIdArg?: string) {
             ],
           },
         },
-        sort: [{ '@timestamp': 'desc' }],
+        sort: [{ 'state.started_at': 'desc' }],
         aggs: {
           errorStates: {
             terms: {
               field: 'state.id',
-              size: 1000,
+              size: 10000,
             },
             aggs: {
               summary: {
                 top_hits: {
                   size: 1,
-                  _source: ['error', 'state', 'monitor'],
+                  _source: ['error', 'state', 'monitor', '@timestamp'],
                   sort: [{ '@timestamp': 'desc' }],
                 },
               },
@@ -81,12 +84,13 @@ export function useMonitorErrors(monitorIdArg?: string) {
 
   return useMemo(() => {
     const errorStates = (data?.aggregations?.errorStates.buckets ?? []).map((loc) => {
-      return loc.summary.hits.hits?.[0]._source as Ping;
+      return loc.summary.hits.hits?.[0]._source as PingState;
     });
 
     return {
       errorStates,
       loading,
+      data,
     };
   }, [data, loading]);
 }
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_details_last_run.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_details_last_run.tsx
index 311f1b49b8e798..4fe7c9a2ecefd1 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_details_last_run.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_details_last_run.tsx
@@ -6,7 +6,7 @@
  */
 import React, { ReactElement } from 'react';
 import moment from 'moment';
-import { EuiDescriptionList, EuiLoadingContent } from '@elastic/eui';
+import { EuiDescriptionList, EuiLoadingContent, EuiToolTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
 import { useMonitorLatestPing } from './hooks/use_monitor_latest_ping';
@@ -21,7 +21,20 @@ export const MonitorDetailsLastRun: React.FC = () => {
     description = <EuiLoadingContent lines={1} />;
   }
 
-  return <EuiDescriptionList listItems={[{ title: LAST_RUN_LABEL, description }]} />;
+  return (
+    <EuiDescriptionList
+      listItems={[
+        {
+          title: LAST_RUN_LABEL,
+          description: (
+            <EuiToolTip content={moment(latestPing?.timestamp).format('LLL')} position="bottom">
+              <>{description}</>
+            </EuiToolTip>
+          ),
+        },
+      ]}
+    />
+  );
 };
 
 const LAST_RUN_LABEL = i18n.translate('xpack.synthetics.monitorLastRun.lastRunLabel', {
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_list.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_list.tsx
index b7b801b5a1b9ab..7533b7307d616b 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_list.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_list.tsx
@@ -6,34 +6,39 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import React, { MouseEvent, useMemo, useState } from 'react';
-import { EuiBasicTable, EuiSpacer, EuiText } from '@elastic/eui';
+import React, { MouseEvent, useMemo } from 'react';
+import {
+  EuiSpacer,
+  EuiText,
+  EuiInMemoryTable,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiBadge,
+} from '@elastic/eui';
 import { useHistory, useParams } from 'react-router-dom';
+import moment from 'moment';
 import { ErrorDetailsLink } from '../../common/links/error_details_link';
 import { useSelectedLocation } from '../hooks/use_selected_location';
 import { useKibanaDateFormat } from '../../../../../hooks/use_kibana_date_format';
-import { Ping } from '../../../../../../common/runtime_types';
+import { Ping, PingState } from '../../../../../../common/runtime_types';
 import { useErrorFailedStep } from '../hooks/use_error_failed_step';
 import {
   formatTestDuration,
   formatTestRunAt,
 } from '../../../utils/monitor_test_result/test_time_formats';
 
-export const ErrorsList = ({ errorStates, loading }: { errorStates: Ping[]; loading: boolean }) => {
-  const [pageIndex, setPageIndex] = useState(0);
-  const [pageSize, setPageSize] = useState(10);
-  const [sortField, setSortField] = useState('@timestamp');
-  const [sortDirection, setSortDirection] = useState<'asc' | 'desc'>('desc');
-
+export const ErrorsList = ({
+  errorStates,
+  loading,
+}: {
+  errorStates: PingState[];
+  loading: boolean;
+}) => {
   const { monitorId } = useParams<{ monitorId: string }>();
 
-  const items = errorStates.slice(pageIndex * pageSize, pageIndex * pageSize + pageSize);
-
   const checkGroups = useMemo(() => {
-    const currentPage = errorStates.slice(pageIndex * pageSize, pageIndex * pageSize + pageSize);
-
-    return currentPage.map((error) => error.monitor.check_group!);
-  }, [errorStates, pageIndex, pageSize]);
+    return errorStates.map((error) => error.monitor.check_group!);
+  }, [errorStates]);
 
   const { failedSteps } = useErrorFailedStep(checkGroups);
 
@@ -47,26 +52,52 @@ export const ErrorsList = ({ errorStates, loading }: { errorStates: Ping[]; load
 
   const columns = [
     {
-      field: '@timestamp',
+      field: 'item.state.started_at',
       name: TIMESTAMP_LABEL,
-      sortable: true,
-      render: (value: string, item: Ping) => {
-        return (
+      sortable: (a: PingState) => {
+        return moment(a.state.started_at).valueOf();
+      },
+      render: (value: string, item: PingState) => {
+        const link = (
           <ErrorDetailsLink
             configId={monitorId}
             stateId={item.state?.id!}
             label={formatTestRunAt(item.state!.started_at, format)}
           />
         );
+        const isActive = isActiveState(item);
+        if (!isActive) {
+          return link;
+        }
+
+        return (
+          <EuiFlexGroup gutterSize="m" alignItems="center">
+            <EuiFlexItem grow={false}>{link}</EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiBadge iconType="clock" iconSide="right">
+                Active
+              </EuiBadge>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        );
       },
     },
     {
       field: 'monitor.check_group',
       name: !isBrowserType ? ERROR_MESSAGE_LABEL : FAILED_STEP_LABEL,
       truncateText: true,
-      render: (value: string, item: Ping) => {
+      sortable: (a: PingState) => {
+        const failedStep = failedSteps.find(
+          (step) => step.monitor.check_group === a.monitor.check_group
+        );
+        if (!failedStep) {
+          return a.monitor.check_group;
+        }
+        return failedStep.synthetics?.step?.name;
+      },
+      render: (value: string, item: PingState) => {
         if (!isBrowserType) {
-          return <EuiText size="s">{item.error?.message ?? '--'}</EuiText>;
+          return <EuiText size="s">{item.error.message ?? '--'}</EuiText>;
         }
         const failedStep = failedSteps.find((step) => step.monitor.check_group === value);
         if (!failedStep) {
@@ -83,22 +114,32 @@ export const ErrorsList = ({ errorStates, loading }: { errorStates: Ping[]; load
       field: 'state.duration_ms',
       name: ERROR_DURATION_LABEL,
       align: 'right' as const,
-      render: (value: number) => <EuiText>{formatTestDuration(value, true)}</EuiText>,
+      sortable: true,
+      render: (value: number, item: PingState) => {
+        const isActive = isActiveState(item);
+        let activeDuration = 0;
+        if (item.monitor.timespan) {
+          const diff = moment(item.monitor.timespan.lt).diff(
+            moment(item.monitor.timespan.gte),
+            'millisecond'
+          );
+          if (isActive) {
+            const currentDiff = moment().diff(item['@timestamp']);
+
+            activeDuration = currentDiff < diff ? currentDiff : diff;
+          } else {
+            activeDuration = diff;
+          }
+        }
+        return <EuiText>{formatTestDuration(value + activeDuration, true)}</EuiText>;
+      },
     },
   ];
 
-  const pagination = {
-    pageIndex,
-    pageSize,
-    totalItemCount: errorStates.length,
-    pageSizeOptions: [3, 5, 8],
-  };
-
   const getRowProps = (item: Ping) => {
     const { state } = item;
     if (state?.id) {
       return {
-        height: '85px',
         'data-test-subj': `row-${state.id}`,
         onClick: (evt: MouseEvent) => {
           history.push(
@@ -112,29 +153,19 @@ export const ErrorsList = ({ errorStates, loading }: { errorStates: Ping[]; load
   return (
     <div>
       <EuiSpacer />
-      <EuiBasicTable
+      <EuiInMemoryTable
         tableCaption={ERRORS_LIST_LABEL}
         loading={loading}
-        items={items}
+        items={errorStates}
         columns={columns}
-        pagination={pagination}
+        rowProps={getRowProps}
+        pagination={{ pageSizeOptions: [5, 10, 20, 50, 100] }}
         sorting={{
           sort: {
-            field: sortField as keyof Ping,
-            direction: sortDirection,
+            field: 'item.state.started_at',
+            direction: 'desc',
           },
         }}
-        onChange={({ page = {}, sort = {} }) => {
-          const { index: pIndex, size: pSize } = page;
-
-          const { field: sField, direction: sDirection } = sort;
-
-          setPageIndex(pIndex!);
-          setPageSize(pSize!);
-          setSortField(sField!);
-          setSortDirection(sDirection!);
-        }}
-        rowProps={getRowProps}
       />
     </div>
   );
@@ -154,6 +185,15 @@ export const getErrorDetailsUrl = ({
   return `${basePath}/app/synthetics/monitor/${configId}/errors/${stateId}?locationId=${locationId}`;
 };
 
+const isActiveState = (item: PingState) => {
+  const timestamp = item['@timestamp'];
+  const interval = moment(item.monitor.timespan?.lt).diff(
+    moment(item.monitor.timespan?.gte),
+    'milliseconds'
+  );
+  return moment().diff(moment(timestamp), 'milliseconds') < interval;
+};
+
 const ERRORS_LIST_LABEL = i18n.translate('xpack.synthetics.errorsList.label', {
   defaultMessage: 'Errors list',
 });
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_tab_content.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_tab_content.tsx
index 8317614ef889be..d7b1c3357f6069 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_tab_content.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_tab_content.tsx
@@ -8,7 +8,7 @@
 import React from 'react';
 import { EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { Ping } from '../../../../../../common/runtime_types';
+import { PingState } from '../../../../../../common/runtime_types';
 import { PanelWithTitle } from '../../common/components/panel_with_title';
 import { MonitorErrorsCount } from '../monitor_summary/monitor_errors_count';
 import { FailedTestsCount } from './failed_tests_count';
@@ -21,7 +21,7 @@ export const ErrorsTabContent = ({
   errorStates,
   loading,
 }: {
-  errorStates: Ping[];
+  errorStates: PingState[];
   loading: boolean;
 }) => {
   const { dateRangeStart, dateRangeEnd } = useGetUrlParams();
diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/monitor_errors.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/monitor_errors.tsx
index b92c8c8fdd7d60..527033f16c7cef 100644
--- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/monitor_errors.tsx
+++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/monitor_errors.tsx
@@ -20,9 +20,9 @@ import { SyntheticsDatePicker } from '../../common/date_picker/synthetics_date_p
 import { ErrorsTabContent } from './errors_tab_content';
 
 export const MonitorErrors = () => {
-  const { errorStates, loading } = useMonitorErrors();
+  const { errorStates, loading, data } = useMonitorErrors();
 
-  const initialLoading = loading && errorStates.length === 0;
+  const initialLoading = loading && !data;
 
   const emptyState = !loading && errorStates.length === 0;
 

From 048a65dc09b910fe558a5494416db58a1d4b8605 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=B8ren=20Louv-Jansen?= <soren.louv@elastic.co>
Date: Tue, 24 Jan 2023 15:30:23 +0100
Subject: [PATCH 54/54] [APM] Allow calling `createInternalESClient` without
 `context` (#149320)

---
 .../create_es_client/call_async_with_debug.ts | 32 ++++-----
 .../create_apm_event_client/index.ts          |  1 -
 .../create_internal_es_client/index.ts        | 70 ++++++++++++++-----
 .../fleet/register_fleet_policy_callbacks.ts  | 23 +++---
 .../plugins/apm/server/routes/fleet/route.ts  |  4 +-
 .../settings/agent_configuration/route.ts     | 14 ++--
 .../routes/settings/custom_link/route.ts      | 10 +--
 x-pack/plugins/apm/tsconfig.json              |  1 +
 8 files changed, 96 insertions(+), 59 deletions(-)

diff --git a/x-pack/plugins/apm/server/lib/helpers/create_es_client/call_async_with_debug.ts b/x-pack/plugins/apm/server/lib/helpers/create_es_client/call_async_with_debug.ts
index a401acafd01d92..c1c89d5b906b66 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_es_client/call_async_with_debug.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_es_client/call_async_with_debug.ts
@@ -23,7 +23,6 @@ export async function callAsyncWithDebug<T>({
   getDebugMessage,
   debug,
   request,
-  requestType,
   requestParams,
   operationName,
   isCalledWithInternalUser,
@@ -31,8 +30,7 @@ export async function callAsyncWithDebug<T>({
   cb: () => Promise<T>;
   getDebugMessage: () => { body: string; title: string };
   debug: boolean;
-  request: KibanaRequest;
-  requestType: string;
+  request?: KibanaRequest;
   requestParams: Record<string, any>;
   operationName: string;
   isCalledWithInternalUser: boolean; // only allow inspection of queries that were retrieved with credentials of the end user
@@ -70,19 +68,21 @@ export async function callAsyncWithDebug<T>({
     console.log(body);
     console.log(`\n`);
 
-    const inspectableEsQueries = inspectableEsQueriesMap.get(request);
-    if (!isCalledWithInternalUser && inspectableEsQueries) {
-      inspectableEsQueries.push(
-        getInspectResponse({
-          esError,
-          esRequestParams: requestParams,
-          esRequestStatus,
-          esResponse: res,
-          kibanaRequest: request,
-          operationName,
-          startTime,
-        })
-      );
+    if (request) {
+      const inspectableEsQueries = inspectableEsQueriesMap.get(request);
+      if (!isCalledWithInternalUser && inspectableEsQueries) {
+        inspectableEsQueries.push(
+          getInspectResponse({
+            esError,
+            esRequestParams: requestParams,
+            esRequestStatus,
+            esResponse: res,
+            kibanaRequest: request,
+            operationName,
+            startTime,
+          })
+        );
+      }
     }
   }
 
diff --git a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts
index b41d416b92a7aa..870a7971c2e9e8 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_apm_event_client/index.ts
@@ -124,7 +124,6 @@ export class APMEventClient {
       isCalledWithInternalUser: false,
       debug: this.debug,
       request: this.request,
-      requestType,
       operationName,
       requestParams: params,
       cb: () => {
diff --git a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_internal_es_client/index.ts b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_internal_es_client/index.ts
index f48971588a050d..d1cd9054fbac1c 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_internal_es_client/index.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_es_client/create_internal_es_client/index.ts
@@ -8,6 +8,9 @@
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { unwrapEsResponse } from '@kbn/observability-plugin/server';
 import type { ESSearchResponse, ESSearchRequest } from '@kbn/es-types';
+import { SavedObjectsClientContract } from '@kbn/core-saved-objects-api-server';
+import { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
+import { APMConfig } from '../../../..';
 import { APMRouteHandlerResources } from '../../../../routes/typings';
 import {
   callAsyncWithDebug,
@@ -20,48 +23,75 @@ import { getApmIndices } from '../../../../routes/settings/apm_indices/get_apm_i
 export type APMIndexDocumentParams<T> = estypes.IndexRequest<T>;
 
 export type APMInternalESClient = Awaited<
-  ReturnType<typeof createInternalESClient>
+  ReturnType<typeof createInternalESClientWithContext>
 >;
 
-export async function createInternalESClient({
-  context,
+export async function createInternalESClientWithContext({
   debug,
-  request,
   config,
-}: Pick<APMRouteHandlerResources, 'context' | 'request' | 'config'> & {
+  request,
+  context,
+}: {
   debug: boolean;
+  config: APMConfig;
+  request: APMRouteHandlerResources['request'];
+  context: APMRouteHandlerResources['context'];
 }) {
   const coreContext = await context.core;
   const { asInternalUser } = coreContext.elasticsearch.client;
   const savedObjectsClient = coreContext.savedObjects.client;
 
+  return createInternalESClient({
+    debug,
+    config,
+    request,
+    savedObjectsClient,
+    elasticsearchClient: asInternalUser,
+  });
+}
+
+export async function createInternalESClient({
+  debug,
+  config,
+  request,
+  savedObjectsClient,
+  elasticsearchClient,
+}: {
+  debug: boolean;
+  config: APMConfig;
+  request?: APMRouteHandlerResources['request'];
+  savedObjectsClient: SavedObjectsClientContract;
+  elasticsearchClient: ElasticsearchClient;
+}) {
   function callEs<T extends { body: any }>(
     operationName: string,
     {
-      cb,
+      makeRequestWithSignal,
       requestType,
       params,
     }: {
       requestType: string;
-      cb: (signal: AbortSignal) => Promise<T>;
+      makeRequestWithSignal: (signal: AbortSignal) => Promise<T>;
       params: Record<string, any>;
     }
   ) {
     return callAsyncWithDebug({
       cb: () => {
         const controller = new AbortController();
+        const res = makeRequestWithSignal(controller.signal);
         return unwrapEsResponse(
-          cancelEsRequestOnAbort(cb(controller.signal), request, controller)
+          request ? cancelEsRequestOnAbort(res, request, controller) : res
         );
       },
-      getDebugMessage: () => ({
-        title: getDebugTitle(request),
-        body: getDebugBody({ params, requestType, operationName }),
-      }),
+      getDebugMessage: () => {
+        return {
+          title: request ? getDebugTitle(request) : 'Internal request',
+          body: getDebugBody({ params, requestType, operationName }),
+        };
+      },
       debug,
       isCalledWithInternalUser: true,
       request,
-      requestType,
       requestParams: params,
       operationName,
     });
@@ -78,8 +108,8 @@ export async function createInternalESClient({
     ): Promise<ESSearchResponse<TDocument, TSearchRequest>> => {
       return callEs(operationName, {
         requestType: 'search',
-        cb: (signal) =>
-          asInternalUser.search(params, {
+        makeRequestWithSignal: (signal) =>
+          elasticsearchClient.search(params, {
             signal,
             meta: true,
           }) as Promise<{ body: any }>,
@@ -89,7 +119,8 @@ export async function createInternalESClient({
     index: <T>(operationName: string, params: APMIndexDocumentParams<T>) => {
       return callEs(operationName, {
         requestType: 'index',
-        cb: (signal) => asInternalUser.index(params, { signal, meta: true }),
+        makeRequestWithSignal: (signal) =>
+          elasticsearchClient.index(params, { signal, meta: true }),
         params,
       });
     },
@@ -99,7 +130,8 @@ export async function createInternalESClient({
     ): Promise<{ result: string }> => {
       return callEs(operationName, {
         requestType: 'delete',
-        cb: (signal) => asInternalUser.delete(params, { signal, meta: true }),
+        makeRequestWithSignal: (signal) =>
+          elasticsearchClient.delete(params, { signal, meta: true }),
         params,
       });
     },
@@ -109,8 +141,8 @@ export async function createInternalESClient({
     ) => {
       return callEs(operationName, {
         requestType: 'indices.create',
-        cb: (signal) =>
-          asInternalUser.indices.create(params, { signal, meta: true }),
+        makeRequestWithSignal: (signal) =>
+          elasticsearchClient.indices.create(params, { signal, meta: true }),
         params,
       });
     },
diff --git a/x-pack/plugins/apm/server/routes/fleet/register_fleet_policy_callbacks.ts b/x-pack/plugins/apm/server/routes/fleet/register_fleet_policy_callbacks.ts
index 2dfdb97f368869..9057ab065cacbb 100644
--- a/x-pack/plugins/apm/server/routes/fleet/register_fleet_policy_callbacks.ts
+++ b/x-pack/plugins/apm/server/routes/fleet/register_fleet_policy_callbacks.ts
@@ -14,14 +14,15 @@ import {
   PutPackagePolicyUpdateCallback,
 } from '@kbn/fleet-plugin/server';
 import { get } from 'lodash';
-import { APMPlugin, APMRouteHandlerResources } from '../..';
-import { createInternalESClient } from '../../lib/helpers/create_es_client/create_internal_es_client';
+import { APMConfig, APMPlugin, APMRouteHandlerResources } from '../..';
 import { decoratePackagePolicyWithAgentConfigAndSourceMap } from './merge_package_policy_with_apm';
 import { addApiKeysToPackagePolicyIfMissing } from './api_keys/add_api_keys_to_policies_if_missing';
 import {
   AGENT_CONFIG_API_KEY_PATH,
   SOURCE_MAP_API_KEY_PATH,
 } from './get_package_policy_decorators';
+import { createInternalESClient } from '../../lib/helpers/create_es_client/create_internal_es_client';
+import { getInternalSavedObjectsClient } from '../../lib/helpers/get_internal_saved_objects_client';
 
 export async function registerFleetPolicyCallbacks({
   logger,
@@ -43,12 +44,12 @@ export async function registerFleetPolicyCallbacks({
 
   fleetPluginStart.registerExternalCallback(
     'packagePolicyUpdate',
-    onPackagePolicyCreateOrUpdate({ fleetPluginStart, config })
+    onPackagePolicyCreateOrUpdate({ fleetPluginStart, config, coreStart })
   );
 
   fleetPluginStart.registerExternalCallback(
     'packagePolicyCreate',
-    onPackagePolicyCreateOrUpdate({ fleetPluginStart, config })
+    onPackagePolicyCreateOrUpdate({ fleetPluginStart, config, coreStart })
   );
 
   fleetPluginStart.registerExternalCallback(
@@ -144,23 +145,27 @@ function onPackagePolicyPostCreate({
 function onPackagePolicyCreateOrUpdate({
   fleetPluginStart,
   config,
+  coreStart,
 }: {
   fleetPluginStart: FleetStartContract;
-  config: NonNullable<APMPlugin['currentConfig']>;
+  config: APMConfig;
+  coreStart: CoreStart;
 }): PutPackagePolicyUpdateCallback & PostPackagePolicyCreateCallback {
-  return async (packagePolicy, context, request) => {
+  return async (packagePolicy) => {
     if (packagePolicy.package?.name !== 'apm') {
       return packagePolicy;
     }
 
+    const { asInternalUser } = coreStart.elasticsearch.client;
+    const savedObjectsClient = await getInternalSavedObjectsClient(coreStart);
     const internalESClient = await createInternalESClient({
-      context: context as any,
       debug: false,
-      request,
       config,
+      savedObjectsClient,
+      elasticsearchClient: asInternalUser,
     });
 
-    return await decoratePackagePolicyWithAgentConfigAndSourceMap({
+    return decoratePackagePolicyWithAgentConfigAndSourceMap({
       internalESClient,
       fleetPluginStart,
       packagePolicy,
diff --git a/x-pack/plugins/apm/server/routes/fleet/route.ts b/x-pack/plugins/apm/server/routes/fleet/route.ts
index d4e5d467d61a07..dbc2485eb843ec 100644
--- a/x-pack/plugins/apm/server/routes/fleet/route.ts
+++ b/x-pack/plugins/apm/server/routes/fleet/route.ts
@@ -26,7 +26,7 @@ import { getInternalSavedObjectsClient } from '../../lib/helpers/get_internal_sa
 import { createApmServerRoute } from '../apm_routes/create_apm_server_route';
 import { getLatestApmPackage } from './get_latest_apm_package';
 import { getJavaAgentVersionsFromRegistry } from './get_java_agent_versions';
-import { createInternalESClient } from '../../lib/helpers/create_es_client/create_internal_es_client';
+import { createInternalESClientWithContext } from '../../lib/helpers/create_es_client/create_internal_es_client';
 
 const hasFleetDataRoute = createApmServerRoute({
   endpoint: 'GET /internal/apm/fleet/has_apm_policies',
@@ -249,7 +249,7 @@ const createCloudApmPackagePolicyRoute = createApmServerRoute({
       throw Boom.forbidden(CLOUD_SUPERUSER_REQUIRED_MESSAGE);
     }
 
-    const internalESClient = await createInternalESClient({
+    const internalESClient = await createInternalESClientWithContext({
       context,
       request,
       debug: resources.params.query._inspect,
diff --git a/x-pack/plugins/apm/server/routes/settings/agent_configuration/route.ts b/x-pack/plugins/apm/server/routes/settings/agent_configuration/route.ts
index a631743db93752..4984b422ea2595 100644
--- a/x-pack/plugins/apm/server/routes/settings/agent_configuration/route.ts
+++ b/x-pack/plugins/apm/server/routes/settings/agent_configuration/route.ts
@@ -25,7 +25,7 @@ import {
 import { getSearchTransactionsEvents } from '../../../lib/helpers/transactions';
 import { syncAgentConfigsToApmPackagePolicies } from '../../fleet/sync_agent_configs_to_apm_package_policies';
 import { getApmEventClient } from '../../../lib/helpers/get_apm_event_client';
-import { createInternalESClient } from '../../../lib/helpers/create_es_client/create_internal_es_client';
+import { createInternalESClientWithContext } from '../../../lib/helpers/create_es_client/create_internal_es_client';
 
 // get list of configurations
 const agentConfigurationRoute = createApmServerRoute({
@@ -39,7 +39,7 @@ const agentConfigurationRoute = createApmServerRoute({
     >;
   }> => {
     const { context, request, params, config } = resources;
-    const internalESClient = await createInternalESClient({
+    const internalESClient = await createInternalESClientWithContext({
       context,
       request,
       debug: params.query._inspect,
@@ -68,7 +68,7 @@ const getSingleAgentConfigurationRoute = createApmServerRoute({
     const { name, environment, _inspect } = params.query;
     const service = { name, environment };
 
-    const internalESClient = await createInternalESClient({
+    const internalESClient = await createInternalESClientWithContext({
       context,
       request,
       debug: _inspect,
@@ -114,7 +114,7 @@ const deleteAgentConfigurationRoute = createApmServerRoute({
     } = resources;
     const { service } = params.body;
 
-    const internalESClient = await createInternalESClient({
+    const internalESClient = await createInternalESClientWithContext({
       context,
       request,
       debug: params.query._inspect,
@@ -179,7 +179,7 @@ const createOrUpdateAgentConfigurationRoute = createApmServerRoute({
     } = resources;
     const { body, query } = params;
 
-    const internalESClient = await createInternalESClient({
+    const internalESClient = await createInternalESClientWithContext({
       context,
       request,
       debug: params.query._inspect,
@@ -258,7 +258,7 @@ const agentConfigurationSearchRoute = createApmServerRoute({
       mark_as_applied_by_agent: markAsAppliedByAgent,
     } = params.body;
 
-    const internalESClient = await createInternalESClient({
+    const internalESClient = await createInternalESClientWithContext({
       context,
       request,
       debug: params.query._inspect,
@@ -323,7 +323,7 @@ const listAgentConfigurationEnvironmentsRoute = createApmServerRoute({
   }> => {
     const { context, request, params, config } = resources;
     const [internalESClient, apmEventClient] = await Promise.all([
-      createInternalESClient({
+      createInternalESClientWithContext({
         context,
         request,
         debug: params.query._inspect,
diff --git a/x-pack/plugins/apm/server/routes/settings/custom_link/route.ts b/x-pack/plugins/apm/server/routes/settings/custom_link/route.ts
index 87087409e32065..110e1fc0dc4841 100644
--- a/x-pack/plugins/apm/server/routes/settings/custom_link/route.ts
+++ b/x-pack/plugins/apm/server/routes/settings/custom_link/route.ts
@@ -19,7 +19,7 @@ import { getTransaction } from './get_transaction';
 import { listCustomLinks } from './list_custom_links';
 import { createApmServerRoute } from '../../apm_routes/create_apm_server_route';
 import { getApmEventClient } from '../../../lib/helpers/get_apm_event_client';
-import { createInternalESClient } from '../../../lib/helpers/create_es_client/create_internal_es_client';
+import { createInternalESClientWithContext } from '../../../lib/helpers/create_es_client/create_internal_es_client';
 
 const customLinkTransactionRoute = createApmServerRoute({
   endpoint: 'GET /internal/apm/settings/custom_links/transaction',
@@ -63,7 +63,7 @@ const listCustomLinksRoute = createApmServerRoute({
 
     const { query } = params;
 
-    const internalESClient = await createInternalESClient({
+    const internalESClient = await createInternalESClientWithContext({
       context,
       request,
       debug: resources.params.query._inspect,
@@ -94,7 +94,7 @@ const createCustomLinkRoute = createApmServerRoute({
       throw Boom.forbidden(INVALID_LICENSE);
     }
 
-    const internalESClient = await createInternalESClient({
+    const internalESClient = await createInternalESClientWithContext({
       context,
       request,
       debug: resources.params.query._inspect,
@@ -130,7 +130,7 @@ const updateCustomLinkRoute = createApmServerRoute({
       throw Boom.forbidden(INVALID_LICENSE);
     }
 
-    const internalESClient = await createInternalESClient({
+    const internalESClient = await createInternalESClientWithContext({
       context,
       request,
       debug: resources.params.query._inspect,
@@ -166,7 +166,7 @@ const deleteCustomLinkRoute = createApmServerRoute({
       throw Boom.forbidden(INVALID_LICENSE);
     }
 
-    const internalESClient = await createInternalESClient({
+    const internalESClient = await createInternalESClientWithContext({
       context,
       request,
       debug: resources.params.query._inspect,
diff --git a/x-pack/plugins/apm/tsconfig.json b/x-pack/plugins/apm/tsconfig.json
index 51a440ac249dad..2193b4c9bf5a7b 100644
--- a/x-pack/plugins/apm/tsconfig.json
+++ b/x-pack/plugins/apm/tsconfig.json
@@ -76,6 +76,7 @@
     "@kbn/babel-register",
     "@kbn/core-saved-objects-migration-server-internal",
     "@kbn/core-elasticsearch-server",
+    "@kbn/core-saved-objects-api-server",
   ],
   "exclude": [
     "target/**/*",