diff --git a/api_docs/apm.json b/api_docs/apm.json
index 1ef5a9f8ebfa64..626886953d803f 100644
--- a/api_docs/apm.json
+++ b/api_docs/apm.json
@@ -74,19 +74,11 @@
       "label": "ApmPluginSetup",
       "description": [],
       "signature": [
-        "{ ruleRegistry: ",
-        {
-          "pluginId": "observability",
-          "scope": "public",
-          "docId": "kibObservabilityPluginApi",
-          "section": "def-public.FormatterRuleRegistry",
-          "text": "FormatterRuleRegistry"
-        },
-        "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { readonly 'service.environment': { readonly type: \"keyword\"; }; readonly 'transaction.type': { readonly type: \"keyword\"; }; readonly 'processor.event': { readonly type: \"keyword\"; }; }>; }"
+        "{}"
       ],
       "source": {
         "path": "x-pack/plugins/apm/public/plugin.ts",
-        "lineNumber": 48
+        "lineNumber": 45
       },
       "deprecated": false,
       "lifecycle": "setup",
@@ -104,7 +96,7 @@
       ],
       "source": {
         "path": "x-pack/plugins/apm/public/plugin.ts",
-        "lineNumber": 51
+        "lineNumber": 47
       },
       "deprecated": false,
       "lifecycle": "start",
@@ -152,7 +144,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/apm/server/plugin.ts",
-          "lineNumber": 50
+          "lineNumber": 55
         },
         "deprecated": false,
         "children": [
@@ -168,7 +160,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/apm/server/plugin.ts",
-              "lineNumber": 60
+              "lineNumber": 65
             },
             "deprecated": false,
             "children": [
@@ -191,7 +183,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/apm/server/plugin.ts",
-                  "lineNumber": 60
+                  "lineNumber": 65
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -219,7 +211,7 @@
               "APMPluginStartDependencies",
               ", unknown>, plugins: Pick<",
               "APMPluginSetupDependencies",
-              ", \"data\" | \"security\" | \"home\" | \"features\" | \"ml\" | \"actions\" | \"usageCollection\" | \"cloud\" | \"observability\" | \"apmOss\" | \"licensing\" | \"spaces\" | \"taskManager\" | \"alerting\">) => { config$: ",
+              ", \"data\" | \"security\" | \"home\" | \"features\" | \"ml\" | \"actions\" | \"usageCollection\" | \"apmOss\" | \"licensing\" | \"observability\" | \"ruleRegistry\" | \"spaces\" | \"cloud\" | \"taskManager\" | \"alerting\">) => { config$: ",
               "Observable",
               "<{ 'apm_oss.transactionIndices': string; 'apm_oss.spanIndices': string; 'apm_oss.errorIndices': string; 'apm_oss.metricsIndices': string; 'apm_oss.sourcemapIndices': string; 'apm_oss.onboardingIndices': string; 'apm_oss.indexPattern': string; 'xpack.apm.serviceMapEnabled': boolean; 'xpack.apm.serviceMapFingerprintBucketSize': number; 'xpack.apm.serviceMapTraceIdBucketSize': number; 'xpack.apm.serviceMapFingerprintGlobalBucketSize': number; 'xpack.apm.serviceMapTraceIdGlobalBucketSize': number; 'xpack.apm.serviceMapMaxTracesPerRequest': number; 'xpack.apm.ui.enabled': boolean; 'xpack.apm.maxServiceEnvironments': number; 'xpack.apm.maxServiceSelection': number; 'xpack.apm.ui.maxTraceItems': number; 'xpack.apm.ui.transactionGroupBucketSize': number; 'xpack.apm.autocreateApmIndexPattern': boolean; 'xpack.apm.telemetryCollectionEnabled': boolean; 'xpack.apm.searchAggregatedTransactions': ",
               "SearchAggregatedTransactionSetting",
@@ -241,13 +233,11 @@
               "InferSearchResponseOf",
               "<TypeOfProcessorEvent<",
               "ValuesType",
-              "<TParams[\"apm\"][\"events\"]>>, ESSearchRequestOf<TParams>, {}>>; }>; ruleRegistry: ",
-              "RuleRegistry",
-              "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { readonly 'service.environment': { readonly type: \"keyword\"; }; readonly 'transaction.type': { readonly type: \"keyword\"; }; readonly 'processor.event': { readonly type: \"keyword\"; }; }>; }"
+              "<TParams[\"apm\"][\"events\"]>>, ESSearchRequestOf<TParams>, {}>>; }>; }"
             ],
             "source": {
               "path": "x-pack/plugins/apm/server/plugin.ts",
-              "lineNumber": 64
+              "lineNumber": 69
             },
             "deprecated": false,
             "children": [
@@ -272,7 +262,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/apm/server/plugin.ts",
-                  "lineNumber": 65
+                  "lineNumber": 70
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -287,11 +277,11 @@
                 "signature": [
                   "Pick<",
                   "APMPluginSetupDependencies",
-                  ", \"data\" | \"security\" | \"home\" | \"features\" | \"ml\" | \"actions\" | \"usageCollection\" | \"cloud\" | \"observability\" | \"apmOss\" | \"licensing\" | \"spaces\" | \"taskManager\" | \"alerting\">"
+                  ", \"data\" | \"security\" | \"home\" | \"features\" | \"ml\" | \"actions\" | \"usageCollection\" | \"apmOss\" | \"licensing\" | \"observability\" | \"ruleRegistry\" | \"spaces\" | \"cloud\" | \"taskManager\" | \"alerting\">"
                 ],
                 "source": {
                   "path": "x-pack/plugins/apm/server/plugin.ts",
-                  "lineNumber": 66
+                  "lineNumber": 71
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -319,7 +309,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/apm/server/plugin.ts",
-              "lineNumber": 200
+              "lineNumber": 269
             },
             "deprecated": false,
             "children": [
@@ -341,7 +331,7 @@
                 ],
                 "source": {
                   "path": "x-pack/plugins/apm/server/plugin.ts",
-                  "lineNumber": 200
+                  "lineNumber": 269
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -361,7 +351,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/apm/server/plugin.ts",
-              "lineNumber": 219
+              "lineNumber": 288
             },
             "deprecated": false,
             "children": [],
@@ -608,6 +598,30 @@
                 "section": "def-server.PluginStartContract",
                 "text": "PluginStartContract"
               },
+              ">; }; apmOss: { setup: ",
+              {
+                "pluginId": "apmOss",
+                "scope": "server",
+                "docId": "kibApmOssPluginApi",
+                "section": "def-server.APMOSSPluginSetup",
+                "text": "APMOSSPluginSetup"
+              },
+              "; start: () => Promise<undefined>; }; licensing: { setup: ",
+              {
+                "pluginId": "licensing",
+                "scope": "server",
+                "docId": "kibLicensingPluginApi",
+                "section": "def-server.LicensingPluginSetup",
+                "text": "LicensingPluginSetup"
+              },
+              "; start: () => Promise<",
+              {
+                "pluginId": "licensing",
+                "scope": "server",
+                "docId": "kibLicensingPluginApi",
+                "section": "def-server.LicensingPluginStart",
+                "text": "LicensingPluginStart"
+              },
               ">; }; observability: { setup: { getScopedAnnotationsClient: (requestContext: ",
               {
                 "pluginId": "core",
@@ -638,33 +652,9 @@
               "GetResponse",
               "<unknown>>; delete: (deleteParams: { id: string; }) => Promise<",
               "DeleteResponse",
-              ">; } | undefined>; ruleRegistry: ",
-              "RuleRegistry",
-              "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>; }; start: () => Promise<undefined>; }; apmOss: { setup: ",
-              {
-                "pluginId": "apmOss",
-                "scope": "server",
-                "docId": "kibApmOssPluginApi",
-                "section": "def-server.APMOSSPluginSetup",
-                "text": "APMOSSPluginSetup"
-              },
-              "; start: () => Promise<undefined>; }; licensing: { setup: ",
-              {
-                "pluginId": "licensing",
-                "scope": "server",
-                "docId": "kibLicensingPluginApi",
-                "section": "def-server.LicensingPluginSetup",
-                "text": "LicensingPluginSetup"
-              },
-              "; start: () => Promise<",
-              {
-                "pluginId": "licensing",
-                "scope": "server",
-                "docId": "kibLicensingPluginApi",
-                "section": "def-server.LicensingPluginStart",
-                "text": "LicensingPluginStart"
-              },
-              ">; }; security?: { setup: ",
+              ">; } | undefined>; }; start: () => Promise<undefined>; }; ruleRegistry: { setup: ",
+              "RuleDataPluginService",
+              "; start: () => Promise<void>; }; security?: { setup: ",
               {
                 "pluginId": "security",
                 "scope": "server",
@@ -722,14 +712,6 @@
                 "section": "def-server.UsageCollectionSetup",
                 "text": "UsageCollectionSetup"
               },
-              "; start: () => Promise<undefined>; } | undefined; cloud?: { setup: ",
-              {
-                "pluginId": "cloud",
-                "scope": "server",
-                "docId": "kibCloudPluginApi",
-                "section": "def-server.CloudSetup",
-                "text": "CloudSetup"
-              },
               "; start: () => Promise<undefined>; } | undefined; spaces?: { setup: ",
               {
                 "pluginId": "spaces",
@@ -746,7 +728,15 @@
                 "section": "def-server.SpacesPluginStart",
                 "text": "SpacesPluginStart"
               },
-              ">; } | undefined; taskManager?: { setup: ",
+              ">; } | undefined; cloud?: { setup: ",
+              {
+                "pluginId": "cloud",
+                "scope": "server",
+                "docId": "kibCloudPluginApi",
+                "section": "def-server.CloudSetup",
+                "text": "CloudSetup"
+              },
+              "; start: () => Promise<undefined>; } | undefined; taskManager?: { setup: ",
               {
                 "pluginId": "taskManager",
                 "scope": "server",
@@ -788,14 +778,19 @@
           },
           {
             "parentPluginId": "apm",
-            "id": "def-server.APMRouteHandlerResources.apmRuleRegistry",
+            "id": "def-server.APMRouteHandlerResources.ruleDataClient",
             "type": "Object",
             "tags": [],
-            "label": "apmRuleRegistry",
+            "label": "ruleDataClient",
             "description": [],
             "signature": [
-              "RuleRegistry",
-              "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { readonly 'service.environment': { readonly type: \"keyword\"; }; readonly 'transaction.type': { readonly type: \"keyword\"; }; readonly 'processor.event': { readonly type: \"keyword\"; }; }>"
+              {
+                "pluginId": "ruleRegistry",
+                "scope": "server",
+                "docId": "kibRuleRegistryPluginApi",
+                "section": "def-server.RuleDataClient",
+                "text": "RuleDataClient"
+              }
             ],
             "source": {
               "path": "x-pack/plugins/apm/server/routes/typings.ts",
@@ -1518,7 +1513,7 @@
           "TypeC",
           "<{ filterNames: ",
           "Type",
-          "<(\"host\" | \"location\" | \"browser\" | \"device\" | \"os\" | \"serviceName\" | \"agentName\" | \"containerId\" | \"podName\" | \"transactionResult\" | \"serviceVersion\" | \"transactionUrl\")[], string, unknown>; }>, ",
+          "<(\"host\" | \"location\" | \"browser\" | \"serviceName\" | \"agentName\" | \"containerId\" | \"podName\" | \"transactionResult\" | \"serviceVersion\" | \"transactionUrl\" | \"device\" | \"os\")[], string, unknown>; }>, ",
           "TypeC",
           "<{ uiFilters: ",
           "StringC",
@@ -1538,7 +1533,7 @@
             "section": "def-server.APMRouteHandlerResources",
             "text": "APMRouteHandlerResources"
           },
-          ", { localUiFilters: { options: any[]; name: \"host\" | \"location\" | \"browser\" | \"device\" | \"os\" | \"serviceName\" | \"agentName\" | \"containerId\" | \"podName\" | \"transactionResult\" | \"serviceVersion\" | \"transactionUrl\"; title: string; fieldName: string; }[]; }, ",
+          ", { localUiFilters: { options: any[]; name: \"host\" | \"location\" | \"browser\" | \"serviceName\" | \"agentName\" | \"containerId\" | \"podName\" | \"transactionResult\" | \"serviceVersion\" | \"transactionUrl\" | \"device\" | \"os\"; title: string; fieldName: string; }[]; }, ",
           "APMRouteCreateOptions",
           ">; } & { \"GET /api/apm/service-map\": ",
           "ServerRoute",
@@ -2346,7 +2341,7 @@
             "section": "def-server.APMRouteHandlerResources",
             "text": "APMRouteHandlerResources"
           },
-          ", { alerts: never; }, ",
+          ", { alerts: any[]; }, ",
           "APMRouteCreateOptions",
           ">; } & { \"GET /api/apm/traces/{traceId}\": ",
           "ServerRoute",
@@ -3628,7 +3623,7 @@
       "description": [],
       "source": {
         "path": "x-pack/plugins/apm/server/types.ts",
-        "lineNumber": 47
+        "lineNumber": 51
       },
       "deprecated": false,
       "children": [
@@ -3647,7 +3642,7 @@
           ],
           "source": {
             "path": "x-pack/plugins/apm/server/types.ts",
-            "lineNumber": 48
+            "lineNumber": 52
           },
           "deprecated": false
         },
@@ -3665,7 +3660,7 @@
           ],
           "source": {
             "path": "x-pack/plugins/apm/server/types.ts",
-            "lineNumber": 49
+            "lineNumber": 53
           },
           "deprecated": false,
           "returnComment": [],
@@ -3699,7 +3694,7 @@
           ],
           "source": {
             "path": "x-pack/plugins/apm/server/types.ts",
-            "lineNumber": 50
+            "lineNumber": 54
           },
           "deprecated": false,
           "returnComment": [],
@@ -3726,7 +3721,7 @@
               ],
               "source": {
                 "path": "x-pack/plugins/apm/server/types.ts",
-                "lineNumber": 50
+                "lineNumber": 54
               },
               "deprecated": false
             }
diff --git a/api_docs/cases.json b/api_docs/cases.json
index 772553091a0c08..28ec8c9d6fb5c2 100644
--- a/api_docs/cases.json
+++ b/api_docs/cases.json
@@ -318,7 +318,7 @@
               "{ authc: ",
               "AuthenticationServiceSetup",
               "; sessionTimeout: ",
-              "ISessionTimeout",
+              "SessionTimeout",
               "; license: Readonly<{ isLicenseAvailable: () => boolean; isEnabled: () => boolean; getType: () => \"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\" | undefined; getFeatures: () => ",
               "SecurityLicenseFeatures",
               "; features$: ",
@@ -427,7 +427,7 @@
           " & { security: { authc: ",
           "AuthenticationServiceSetup",
           "; sessionTimeout: ",
-          "ISessionTimeout",
+          "SessionTimeout",
           "; license: Readonly<{ isLicenseAvailable: () => boolean; isEnabled: () => boolean; getType: () => \"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\" | undefined; getFeatures: () => ",
           "SecurityLicenseFeatures",
           "; features$: ",
@@ -929,7 +929,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 35
+          "lineNumber": 36
         },
         "deprecated": false,
         "children": [
@@ -945,7 +945,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 35
+              "lineNumber": 36
             },
             "deprecated": false,
             "isRequired": true
@@ -962,7 +962,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 35
+              "lineNumber": 36
             },
             "deprecated": false,
             "isRequired": true
@@ -983,7 +983,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 31
+          "lineNumber": 32
         },
         "deprecated": false,
         "children": [
@@ -999,7 +999,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 31
+              "lineNumber": 32
             },
             "deprecated": false,
             "isRequired": true
@@ -1020,7 +1020,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 19
+          "lineNumber": 20
         },
         "deprecated": false,
         "children": [
@@ -1036,7 +1036,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 19
+              "lineNumber": 20
             },
             "deprecated": false,
             "isRequired": true
@@ -1057,7 +1057,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 47
+          "lineNumber": 48
         },
         "deprecated": false,
         "children": [
@@ -1073,7 +1073,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 47
+              "lineNumber": 48
             },
             "deprecated": false,
             "isRequired": true
@@ -1090,7 +1090,44 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 47
+              "lineNumber": 48
+            },
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "cases",
+        "id": "def-common.getCasesFromAlertsUrl",
+        "type": "Function",
+        "tags": [],
+        "label": "getCasesFromAlertsUrl",
+        "description": [],
+        "signature": [
+          "(alertId: string) => string"
+        ],
+        "source": {
+          "path": "x-pack/plugins/cases/common/api/helpers.ts",
+          "lineNumber": 52
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "cases",
+            "id": "def-common.getCasesFromAlertsUrl.$1",
+            "type": "string",
+            "tags": [],
+            "label": "alertId",
+            "description": [],
+            "signature": [
+              "string"
+            ],
+            "source": {
+              "path": "x-pack/plugins/cases/common/api/helpers.ts",
+              "lineNumber": 52
             },
             "deprecated": false,
             "isRequired": true
@@ -1111,7 +1148,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 39
+          "lineNumber": 40
         },
         "deprecated": false,
         "children": [
@@ -1127,7 +1164,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 39
+              "lineNumber": 40
             },
             "deprecated": false,
             "isRequired": true
@@ -1148,7 +1185,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 27
+          "lineNumber": 28
         },
         "deprecated": false,
         "children": [
@@ -1164,7 +1201,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 27
+              "lineNumber": 28
             },
             "deprecated": false,
             "isRequired": true
@@ -1181,7 +1218,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 27
+              "lineNumber": 28
             },
             "deprecated": false,
             "isRequired": true
@@ -1202,7 +1239,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 23
+          "lineNumber": 24
         },
         "deprecated": false,
         "children": [
@@ -1218,7 +1255,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 23
+              "lineNumber": 24
             },
             "deprecated": false,
             "isRequired": true
@@ -1239,7 +1276,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/cases/common/api/helpers.ts",
-          "lineNumber": 43
+          "lineNumber": 44
         },
         "deprecated": false,
         "children": [
@@ -1255,7 +1292,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 43
+              "lineNumber": 44
             },
             "deprecated": false,
             "isRequired": true
@@ -1272,7 +1309,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/cases/common/api/helpers.ts",
-              "lineNumber": 43
+              "lineNumber": 44
             },
             "deprecated": false,
             "isRequired": true
diff --git a/api_docs/core.json b/api_docs/core.json
index 899d85b157fa76..37439de2f206b4 100644
--- a/api_docs/core.json
+++ b/api_docs/core.json
@@ -9397,6 +9397,20 @@
                   "lineNumber": 67
                 }
               },
+              {
+                "plugin": "lists",
+                "link": {
+                  "path": "x-pack/plugins/lists/server/routes/read_privileges_route.ts",
+                  "lineNumber": 31
+                }
+              },
+              {
+                "plugin": "lists",
+                "link": {
+                  "path": "x-pack/plugins/lists/server/routes/read_privileges_route.ts",
+                  "lineNumber": 35
+                }
+              },
               {
                 "plugin": "securitySolution",
                 "link": {
@@ -9425,20 +9439,6 @@
                   "lineNumber": 39
                 }
               },
-              {
-                "plugin": "lists",
-                "link": {
-                  "path": "x-pack/plugins/lists/server/routes/read_privileges_route.ts",
-                  "lineNumber": 31
-                }
-              },
-              {
-                "plugin": "lists",
-                "link": {
-                  "path": "x-pack/plugins/lists/server/routes/read_privileges_route.ts",
-                  "lineNumber": 35
-                }
-              },
               {
                 "plugin": "beatsManagement",
                 "link": {
@@ -10314,7 +10314,7 @@
             "plugin": "fleet",
             "link": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 15
+              "lineNumber": 14
             }
           },
           {
@@ -10335,7 +10335,7 @@
             "plugin": "fleet",
             "link": {
               "path": "x-pack/plugins/fleet/target/types/server/plugin.d.ts",
-              "lineNumber": 83
+              "lineNumber": 84
             }
           }
         ],
@@ -15951,45 +15951,45 @@
         "removeBy": "7.16",
         "references": [
           {
-            "plugin": "securitySolution",
+            "plugin": "lists",
             "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
-              "lineNumber": 10
+              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
+              "lineNumber": 9
             }
           },
           {
-            "plugin": "securitySolution",
+            "plugin": "lists",
             "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
-              "lineNumber": 447
+              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
+              "lineNumber": 27
             }
           },
           {
-            "plugin": "securitySolution",
+            "plugin": "lists",
             "link": {
-              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
-              "lineNumber": 466
+              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
+              "lineNumber": 31
             }
           },
           {
-            "plugin": "lists",
+            "plugin": "securitySolution",
             "link": {
-              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
-              "lineNumber": 9
+              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
+              "lineNumber": 10
             }
           },
           {
-            "plugin": "lists",
+            "plugin": "securitySolution",
             "link": {
-              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
-              "lineNumber": 27
+              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
+              "lineNumber": 447
             }
           },
           {
-            "plugin": "lists",
+            "plugin": "securitySolution",
             "link": {
-              "path": "x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts",
-              "lineNumber": 31
+              "path": "x-pack/plugins/security_solution/server/lib/telemetry/sender.ts",
+              "lineNumber": 466
             }
           },
           {
@@ -22535,7 +22535,7 @@
         "label": "EcsEventCategory",
         "description": [],
         "signature": [
-          "\"host\" | \"database\" | \"package\" | \"session\" | \"file\" | \"network\" | \"process\" | \"registry\" | \"web\" | \"authentication\" | \"configuration\" | \"driver\" | \"iam\" | \"intrusion_detection\" | \"malware\""
+          "\"host\" | \"database\" | \"package\" | \"session\" | \"registry\" | \"network\" | \"web\" | \"file\" | \"process\" | \"authentication\" | \"configuration\" | \"driver\" | \"iam\" | \"intrusion_detection\" | \"malware\""
         ],
         "source": {
           "path": "node_modules/@kbn/logging/target/ecs/event.d.ts",
diff --git a/api_docs/core_application.json b/api_docs/core_application.json
index 2b1127f3197b2f..0ffdb0bc15c8df 100644
--- a/api_docs/core_application.json
+++ b/api_docs/core_application.json
@@ -1750,7 +1750,7 @@
                 "plugin": "lens",
                 "link": {
                   "path": "x-pack/plugins/lens/public/app_plugin/types.ts",
-                  "lineNumber": 75
+                  "lineNumber": 71
                 }
               },
               {
@@ -1771,7 +1771,7 @@
                 "plugin": "maps",
                 "link": {
                   "path": "x-pack/plugins/maps/public/routes/map_page/map_app/map_app.tsx",
-                  "lineNumber": 60
+                  "lineNumber": 59
                 }
               },
               {
@@ -1855,7 +1855,7 @@
                 "plugin": "maps",
                 "link": {
                   "path": "x-pack/plugins/maps/target/types/public/routes/map_page/map_app/map_app.d.ts",
-                  "lineNumber": 14
+                  "lineNumber": 13
                 }
               }
             ],
diff --git a/api_docs/data.json b/api_docs/data.json
index f70896d99485f5..1552f13d574a2b 100644
--- a/api_docs/data.json
+++ b/api_docs/data.json
@@ -10870,7 +10870,7 @@
                 ],
                 "source": {
                   "path": "src/plugins/data/public/actions/filters/create_filters_from_value_click.ts",
-                  "lineNumber": 120
+                  "lineNumber": 121
                 },
                 "deprecated": false
               }
@@ -20494,10 +20494,10 @@
               },
               {
                 "parentPluginId": "data",
-                "id": "def-public.search.aggs.Ipv4Address",
+                "id": "def-public.search.aggs.IpAddress",
                 "type": "Object",
                 "tags": [],
-                "label": "Ipv4Address",
+                "label": "IpAddress",
                 "description": [],
                 "signature": [
                   "typeof ",
@@ -20505,8 +20505,8 @@
                     "pluginId": "data",
                     "scope": "common",
                     "docId": "kibDataSearchPluginApi",
-                    "section": "def-common.Ipv4Address",
-                    "text": "Ipv4Address"
+                    "section": "def-common.IpAddress",
+                    "text": "IpAddress"
                   }
                 ],
                 "source": {
@@ -32939,10 +32939,10 @@
               },
               {
                 "parentPluginId": "data",
-                "id": "def-server.search.aggs.Ipv4Address",
+                "id": "def-server.search.aggs.IpAddress",
                 "type": "Object",
                 "tags": [],
-                "label": "Ipv4Address",
+                "label": "IpAddress",
                 "description": [],
                 "signature": [
                   "typeof ",
@@ -32950,8 +32950,8 @@
                     "pluginId": "data",
                     "scope": "common",
                     "docId": "kibDataSearchPluginApi",
-                    "section": "def-common.Ipv4Address",
-                    "text": "Ipv4Address"
+                    "section": "def-common.IpAddress",
+                    "text": "IpAddress"
                   }
                 ],
                 "source": {
diff --git a/api_docs/data_search.json b/api_docs/data_search.json
index 546390b9b345e0..854fbc5d54c7be 100644
--- a/api_docs/data_search.json
+++ b/api_docs/data_search.json
@@ -8389,45 +8389,10 @@
         "description": [],
         "source": {
           "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-          "lineNumber": 17
+          "lineNumber": 12
         },
         "deprecated": false,
         "children": [
-          {
-            "parentPluginId": "data",
-            "id": "def-common.CidrMask.initialAddress",
-            "type": "Object",
-            "tags": [],
-            "label": "initialAddress",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "data",
-                "scope": "common",
-                "docId": "kibDataSearchPluginApi",
-                "section": "def-common.Ipv4Address",
-                "text": "Ipv4Address"
-              }
-            ],
-            "source": {
-              "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-              "lineNumber": 18
-            },
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "data",
-            "id": "def-common.CidrMask.prefixLength",
-            "type": "number",
-            "tags": [],
-            "label": "prefixLength",
-            "description": [],
-            "source": {
-              "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-              "lineNumber": 19
-            },
-            "deprecated": false
-          },
           {
             "parentPluginId": "data",
             "id": "def-common.CidrMask.Unnamed",
@@ -8440,7 +8405,7 @@
             ],
             "source": {
               "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-              "lineNumber": 21
+              "lineNumber": 16
             },
             "deprecated": false,
             "children": [
@@ -8449,14 +8414,14 @@
                 "id": "def-common.CidrMask.Unnamed.$1",
                 "type": "string",
                 "tags": [],
-                "label": "mask",
+                "label": "cidr",
                 "description": [],
                 "signature": [
                   "string"
                 ],
                 "source": {
                   "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-                  "lineNumber": 21
+                  "lineNumber": 16
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -8476,7 +8441,7 @@
             ],
             "source": {
               "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-              "lineNumber": 33
+              "lineNumber": 55
             },
             "deprecated": false,
             "children": [],
@@ -8494,7 +8459,7 @@
             ],
             "source": {
               "path": "src/plugins/data/common/search/aggs/buckets/lib/cidr_mask.ts",
-              "lineNumber": 44
+              "lineNumber": 62
             },
             "deprecated": false,
             "children": [],
@@ -8888,20 +8853,20 @@
       },
       {
         "parentPluginId": "data",
-        "id": "def-common.Ipv4Address",
+        "id": "def-common.IpAddress",
         "type": "Class",
         "tags": [],
-        "label": "Ipv4Address",
+        "label": "IpAddress",
         "description": [],
         "source": {
-          "path": "src/plugins/data/common/search/aggs/utils/ipv4_address.ts",
-          "lineNumber": 22
+          "path": "src/plugins/data/common/search/aggs/utils/ip_address.ts",
+          "lineNumber": 15
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "data",
-            "id": "def-common.Ipv4Address.Unnamed",
+            "id": "def-common.IpAddress.Unnamed",
             "type": "Function",
             "tags": [],
             "label": "Constructor",
@@ -8910,24 +8875,24 @@
               "any"
             ],
             "source": {
-              "path": "src/plugins/data/common/search/aggs/utils/ipv4_address.ts",
-              "lineNumber": 25
+              "path": "src/plugins/data/common/search/aggs/utils/ip_address.ts",
+              "lineNumber": 18
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "data",
-                "id": "def-common.Ipv4Address.Unnamed.$1",
+                "id": "def-common.IpAddress.Unnamed.$1",
                 "type": "CompoundType",
                 "tags": [],
                 "label": "ipAddress",
                 "description": [],
                 "signature": [
-                  "React.ReactText"
+                  "string | number | number[]"
                 ],
                 "source": {
-                  "path": "src/plugins/data/common/search/aggs/utils/ipv4_address.ts",
-                  "lineNumber": 25
+                  "path": "src/plugins/data/common/search/aggs/utils/ip_address.ts",
+                  "lineNumber": 18
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -8937,7 +8902,7 @@
           },
           {
             "parentPluginId": "data",
-            "id": "def-common.Ipv4Address.toString",
+            "id": "def-common.IpAddress.toString",
             "type": "Function",
             "tags": [],
             "label": "toString",
@@ -8946,8 +8911,8 @@
               "() => string"
             ],
             "source": {
-              "path": "src/plugins/data/common/search/aggs/utils/ipv4_address.ts",
-              "lineNumber": 50
+              "path": "src/plugins/data/common/search/aggs/utils/ip_address.ts",
+              "lineNumber": 28
             },
             "deprecated": false,
             "children": [],
@@ -8955,17 +8920,17 @@
           },
           {
             "parentPluginId": "data",
-            "id": "def-common.Ipv4Address.valueOf",
+            "id": "def-common.IpAddress.valueOf",
             "type": "Function",
             "tags": [],
             "label": "valueOf",
             "description": [],
             "signature": [
-              "() => number"
+              "() => number | bigint"
             ],
             "source": {
-              "path": "src/plugins/data/common/search/aggs/utils/ipv4_address.ts",
-              "lineNumber": 60
+              "path": "src/plugins/data/common/search/aggs/utils/ip_address.ts",
+              "lineNumber": 36
             },
             "deprecated": false,
             "children": [],
diff --git a/api_docs/deprecations.mdx b/api_docs/deprecations.mdx
index 76cbb0728b2a38..1bcc9be043ffa6 100644
--- a/api_docs/deprecations.mdx
+++ b/api_docs/deprecations.mdx
@@ -155,10 +155,10 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.ts#L15](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/server/plugin.ts#L15) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.ts#L14](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/server/plugin.ts#L14) | - |
 | <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.ts#L189](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/server/plugin.ts#L189) | - |
 | <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.d.ts#L2](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/target/types/server/plugin.d.ts#L2) | - |
-| <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.d.ts#L83](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/target/types/server/plugin.d.ts#L83) | - |
+| <DocLink id="kibCorePluginApi" section="def-server.AsyncPlugin" text="AsyncPlugin"/> | [plugin.d.ts#L84](https://github.com/elastic/kibana/tree/master/x-pack/plugins/fleet/target/types/server/plugin.d.ts#L84) | - |
 
 
 
@@ -251,7 +251,6 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 | Deprecated API | Reference location | Remove By |
 | ---------------|-----------|-----------|
-| <DocLink id="kibSecuritySolutionPluginApi" section="def-common.formatErrors" text="formatErrors"/> | [siem_server_deps.ts#L24](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/siem_server_deps.ts#L24) | - |
 | <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L9](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts#L9) | 7.16 |
 | <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L27](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts#L27) | 7.16 |
 | <DocLink id="kibCorePluginApi" section="def-server.LegacyAPICaller" text="LegacyAPICaller"/> | [get_call_cluster.mock.ts#L31](https://github.com/elastic/kibana/tree/master/x-pack/plugins/lists/server/schemas/common/get_call_cluster.mock.ts#L31) | 7.16 |
diff --git a/api_docs/event_log.json b/api_docs/event_log.json
index 16d347d24afd28..1eb19bf6310de4 100644
--- a/api_docs/event_log.json
+++ b/api_docs/event_log.json
@@ -687,7 +687,7 @@
             "label": "logEvent",
             "description": [],
             "signature": [
-              "(properties: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
+              "(properties: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
             ],
             "source": {
               "path": "x-pack/plugins/event_log/server/types.ts",
@@ -703,7 +703,7 @@
                 "label": "properties",
                 "description": [],
                 "signature": [
-                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
                 ],
                 "source": {
                   "path": "x-pack/plugins/event_log/server/types.ts",
@@ -723,7 +723,7 @@
             "label": "startTiming",
             "description": [],
             "signature": [
-              "(event: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
+              "(event: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
             ],
             "source": {
               "path": "x-pack/plugins/event_log/server/types.ts",
@@ -739,7 +739,7 @@
                 "label": "event",
                 "description": [],
                 "signature": [
-                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
                 ],
                 "source": {
                   "path": "x-pack/plugins/event_log/server/types.ts",
@@ -759,7 +759,7 @@
             "label": "stopTiming",
             "description": [],
             "signature": [
-              "(event: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
+              "(event: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => void"
             ],
             "source": {
               "path": "x-pack/plugins/event_log/server/types.ts",
@@ -775,7 +775,7 @@
                 "label": "event",
                 "description": [],
                 "signature": [
-                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                  "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
                 ],
                 "source": {
                   "path": "x-pack/plugins/event_log/server/types.ts",
@@ -850,7 +850,7 @@
             "label": "data",
             "description": [],
             "signature": [
-              "(Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}> | undefined)[]"
+              "(Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}> | undefined)[]"
             ],
             "source": {
               "path": "x-pack/plugins/event_log/server/es/cluster_client_adapter.ts",
@@ -872,7 +872,7 @@
         "label": "IEvent",
         "description": [],
         "signature": [
-          "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+          "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
         ],
         "source": {
           "path": "x-pack/plugins/event_log/generated/schemas.ts",
@@ -889,7 +889,7 @@
         "label": "IValidatedEvent",
         "description": [],
         "signature": [
-          "Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}> | undefined"
+          "Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}> | undefined"
         ],
         "source": {
           "path": "x-pack/plugins/event_log/generated/schemas.ts",
@@ -1171,7 +1171,7 @@
           "label": "getLogger",
           "description": [],
           "signature": [
-            "(properties: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => ",
+            "(properties: DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined) => ",
             {
               "pluginId": "eventLog",
               "scope": "server",
@@ -1194,7 +1194,7 @@
               "label": "properties",
               "description": [],
               "signature": [
-                "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; hash?: string | undefined; provider?: string | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; uuid?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
+                "DeepPartial<DeepWriteable<Readonly<{ '@timestamp'?: string | undefined; kibana?: Readonly<{ saved_objects?: Readonly<{ type?: string | undefined; id?: string | undefined; rel?: string | undefined; namespace?: string | undefined; } & {}>[] | undefined; alerting?: Readonly<{ status?: string | undefined; instance_id?: string | undefined; action_group_id?: string | undefined; action_subgroup?: string | undefined; } & {}> | undefined; server_uuid?: string | undefined; } & {}> | undefined; user?: Readonly<{ name?: string | undefined; } & {}> | undefined; error?: Readonly<{ type?: string | undefined; id?: string | undefined; message?: string | undefined; code?: string | undefined; stack_trace?: string | undefined; } & {}> | undefined; message?: string | undefined; tags?: string[] | undefined; event?: Readonly<{ start?: string | undefined; type?: string[] | undefined; id?: string | undefined; url?: string | undefined; end?: string | undefined; category?: string[] | undefined; code?: string | undefined; action?: string | undefined; kind?: string | undefined; original?: string | undefined; severity?: number | undefined; created?: string | undefined; dataset?: string | undefined; duration?: number | undefined; hash?: string | undefined; ingested?: string | undefined; module?: string | undefined; outcome?: string | undefined; provider?: string | undefined; reason?: string | undefined; reference?: string | undefined; risk_score?: number | undefined; risk_score_norm?: number | undefined; sequence?: number | undefined; timezone?: string | undefined; } & {}> | undefined; rule?: Readonly<{ description?: string | undefined; id?: string | undefined; name?: string | undefined; version?: string | undefined; license?: string | undefined; category?: string | undefined; reference?: string | undefined; author?: string[] | undefined; ruleset?: string | undefined; uuid?: string | undefined; } & {}> | undefined; log?: Readonly<{ logger?: string | undefined; level?: string | undefined; } & {}> | undefined; ecs?: Readonly<{ version?: string | undefined; } & {}> | undefined; } & {}>>> | undefined"
               ],
               "source": {
                 "path": "x-pack/plugins/event_log/server/types.ts",
diff --git a/api_docs/fleet.json b/api_docs/fleet.json
index 6e2c159c87758b..38ea209ba61aba 100644
--- a/api_docs/fleet.json
+++ b/api_docs/fleet.json
@@ -4360,7 +4360,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/fleet/server/plugin.ts",
-          "lineNumber": 91
+          "lineNumber": 90
         },
         "deprecated": false,
         "children": [
@@ -4382,7 +4382,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 92
+              "lineNumber": 91
             },
             "deprecated": false
           },
@@ -4405,7 +4405,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 93
+              "lineNumber": 92
             },
             "deprecated": false
           },
@@ -4428,7 +4428,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 94
+              "lineNumber": 93
             },
             "deprecated": false
           },
@@ -4450,7 +4450,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 95
+              "lineNumber": 94
             },
             "deprecated": false
           },
@@ -4473,7 +4473,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 96
+              "lineNumber": 95
             },
             "deprecated": false
           },
@@ -4496,7 +4496,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/server/plugin.ts",
-              "lineNumber": 97
+              "lineNumber": 96
             },
             "deprecated": false
           }
@@ -4713,7 +4713,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/fleet/server/services/package_policy.ts",
-          "lineNumber": 650
+          "lineNumber": 651
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -5322,7 +5322,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/index.ts",
-          "lineNumber": 44
+          "lineNumber": 35
         },
         "deprecated": false,
         "returnComment": [],
@@ -5339,7 +5339,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/index.ts",
-              "lineNumber": 44
+              "lineNumber": 35
             },
             "deprecated": false
           }
@@ -7835,7 +7835,7 @@
             "label": "agents",
             "description": [],
             "signature": [
-              "{ enabled: boolean; tlsCheckDisabled: boolean; pollingRequestTimeout: number; maxConcurrentConnections: number; kibana: { host?: string | string[] | undefined; ca_sha256?: string | undefined; }; elasticsearch: { host?: string | undefined; ca_sha256?: string | undefined; }; fleet_server?: { hosts?: string[] | undefined; } | undefined; agentPolicyRolloutRateLimitIntervalMs: number; agentPolicyRolloutRateLimitRequestPerInterval: number; }"
+              "{ enabled: boolean; elasticsearch: { host?: string | undefined; ca_sha256?: string | undefined; }; fleet_server?: { hosts?: string[] | undefined; } | undefined; }"
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/index.ts",
@@ -7862,7 +7862,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/index.ts",
-              "lineNumber": 35
+              "lineNumber": 26
             },
             "deprecated": false
           },
@@ -7886,7 +7886,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/index.ts",
-              "lineNumber": 36
+              "lineNumber": 27
             },
             "deprecated": false
           }
@@ -13121,7 +13121,7 @@
             "label": "categories",
             "description": [],
             "signature": [
-              "(\"custom\" | \"security\" | \"monitoring\" | \"cloud\" | \"network\" | \"kubernetes\" | \"aws\" | \"azure\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"languages\" | \"message_queue\" | \"notification\" | \"os_system\" | \"productivity\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | undefined)[] | undefined"
+              "(\"custom\" | \"security\" | \"monitoring\" | \"cloud\" | \"kubernetes\" | \"aws\" | \"azure\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"languages\" | \"message_queue\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\" | undefined)[] | undefined"
             ],
             "source": {
               "path": "x-pack/plugins/fleet/common/types/models/package_spec.ts",
@@ -17458,7 +17458,7 @@
         "label": "PackageSpecCategory",
         "description": [],
         "signature": [
-          "\"custom\" | \"security\" | \"monitoring\" | \"cloud\" | \"network\" | \"kubernetes\" | \"aws\" | \"azure\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"languages\" | \"message_queue\" | \"notification\" | \"os_system\" | \"productivity\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\""
+          "\"custom\" | \"security\" | \"monitoring\" | \"cloud\" | \"kubernetes\" | \"aws\" | \"azure\" | \"config_management\" | \"containers\" | \"crm\" | \"datastore\" | \"elastic_stack\" | \"google_cloud\" | \"languages\" | \"message_queue\" | \"network\" | \"notification\" | \"os_system\" | \"productivity\" | \"support\" | \"ticketing\" | \"version_control\" | \"web\""
         ],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/models/package_spec.ts",
@@ -18025,7 +18025,7 @@
         ],
         "source": {
           "path": "x-pack/plugins/fleet/common/types/index.ts",
-          "lineNumber": 49
+          "lineNumber": 40
         },
         "deprecated": false,
         "initialIsOpen": false
diff --git a/api_docs/home.json b/api_docs/home.json
index e8b0aee3b512b1..bb7c203d5aea84 100644
--- a/api_docs/home.json
+++ b/api_docs/home.json
@@ -971,7 +971,7 @@
               "plugin": "apm",
               "link": {
                 "path": "x-pack/plugins/apm/public/plugin.ts",
-                "lineNumber": 86
+                "lineNumber": 82
               }
             }
           ]
diff --git a/api_docs/kibana_react.json b/api_docs/kibana_react.json
index baba7a9d9c3cd1..9e144147e6919d 100644
--- a/api_docs/kibana_react.json
+++ b/api_docs/kibana_react.json
@@ -683,7 +683,7 @@
         ],
         "source": {
           "path": "src/plugins/kibana_react/public/code_editor/index.tsx",
-          "lineNumber": 34
+          "lineNumber": 36
         },
         "deprecated": false,
         "children": [
@@ -701,7 +701,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/code_editor/index.tsx",
-              "lineNumber": 34
+              "lineNumber": 36
             },
             "deprecated": false,
             "isRequired": true
@@ -726,7 +726,7 @@
         ],
         "source": {
           "path": "src/plugins/kibana_react/public/code_editor/index.tsx",
-          "lineNumber": 48
+          "lineNumber": 50
         },
         "deprecated": false,
         "children": [
@@ -744,7 +744,7 @@
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/code_editor/index.tsx",
-              "lineNumber": 48
+              "lineNumber": 50
             },
             "deprecated": false,
             "isRequired": true
@@ -3715,7 +3715,9 @@
             "label": "onChange",
             "description": [],
             "signature": [
-              "(value: string) => void"
+              "(value: string, event: ",
+              "editor",
+              ".IModelContentChangedEvent) => void"
             ],
             "source": {
               "path": "src/plugins/kibana_react/public/url_template_editor/url_template_editor.tsx",
@@ -3736,6 +3738,23 @@
                   "lineNumber": 37
                 },
                 "deprecated": false
+              },
+              {
+                "parentPluginId": "kibanaReact",
+                "id": "def-public.event",
+                "type": "Object",
+                "tags": [],
+                "label": "event",
+                "description": [],
+                "signature": [
+                  "editor",
+                  ".IModelContentChangedEvent"
+                ],
+                "source": {
+                  "path": "src/plugins/kibana_react/public/code_editor/code_editor.tsx",
+                  "lineNumber": 37
+                },
+                "deprecated": false
               }
             ]
           },
@@ -3894,6 +3913,23 @@
         "deprecated": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "kibanaReact",
+        "id": "def-public.CodeEditorProps",
+        "type": "Type",
+        "tags": [],
+        "label": "CodeEditorProps",
+        "description": [],
+        "signature": [
+          "Props"
+        ],
+        "source": {
+          "path": "src/plugins/kibana_react/public/code_editor/index.tsx",
+          "lineNumber": 29
+        },
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "kibanaReact",
         "id": "def-public.KibanaPageTemplateProps",
diff --git a/api_docs/lens.json b/api_docs/lens.json
index c9cf05d851048c..0f4acd9b7110d4 100644
--- a/api_docs/lens.json
+++ b/api_docs/lens.json
@@ -720,7 +720,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/lens/public/types.ts",
-          "lineNumber": 358
+          "lineNumber": 363
         },
         "deprecated": false,
         "children": [
@@ -732,11 +732,11 @@
             "label": "dataType",
             "description": [],
             "signature": [
-              "\"string\" | \"number\" | \"boolean\" | \"date\" | \"ip\" | \"histogram\" | \"document\""
+              "\"string\" | \"number\" | \"boolean\" | \"date\" | \"ip\" | \"geo_point\" | \"geo_shape\" | \"histogram\" | \"document\""
             ],
             "source": {
               "path": "x-pack/plugins/lens/public/types.ts",
-              "lineNumber": 360
+              "lineNumber": 365
             },
             "deprecated": false
           },
@@ -749,7 +749,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/lens/public/types.ts",
-              "lineNumber": 363
+              "lineNumber": 368
             },
             "deprecated": false
           },
@@ -767,7 +767,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lens/public/types.ts",
-              "lineNumber": 369
+              "lineNumber": 374
             },
             "deprecated": false
           }
@@ -1705,11 +1705,11 @@
         "label": "DataType",
         "description": [],
         "signature": [
-          "\"string\" | \"number\" | \"boolean\" | \"date\" | \"ip\" | \"histogram\" | \"document\""
+          "\"string\" | \"number\" | \"boolean\" | \"date\" | \"ip\" | \"geo_point\" | \"geo_shape\" | \"histogram\" | \"document\""
         ],
         "source": {
           "path": "x-pack/plugins/lens/public/types.ts",
-          "lineNumber": 347
+          "lineNumber": 352
         },
         "deprecated": false,
         "initialIsOpen": false
diff --git a/api_docs/licensing.json b/api_docs/licensing.json
index 2e6ab12824c0c9..ea4d74e8914669 100644
--- a/api_docs/licensing.json
+++ b/api_docs/licensing.json
@@ -945,7 +945,7 @@
               "plugin": "security",
               "link": {
                 "path": "x-pack/plugins/security/public/plugin.tsx",
-                "lineNumber": 89
+                "lineNumber": 82
               }
             },
             {
@@ -3130,7 +3130,7 @@
               "plugin": "fleet",
               "link": {
                 "path": "x-pack/plugins/fleet/server/plugin.ts",
-                "lineNumber": 211
+                "lineNumber": 213
               }
             },
             {
diff --git a/api_docs/lists.json b/api_docs/lists.json
index d864291adb5629..bc0dcc7b2ca180 100644
--- a/api_docs/lists.json
+++ b/api_docs/lists.json
@@ -3502,7 +3502,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-          "lineNumber": 119
+          "lineNumber": 121
         },
         "deprecated": false,
         "children": [
@@ -3518,7 +3518,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 120
+              "lineNumber": 122
             },
             "deprecated": false
           },
@@ -3534,7 +3534,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 121
+              "lineNumber": 123
             },
             "deprecated": false
           },
@@ -3547,7 +3547,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 122
+              "lineNumber": 124
             },
             "deprecated": false
           },
@@ -3560,7 +3560,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 123
+              "lineNumber": 125
             },
             "deprecated": false
           },
@@ -3576,7 +3576,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 124
+              "lineNumber": 126
             },
             "deprecated": false
           },
@@ -3589,7 +3589,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 125
+              "lineNumber": 127
             },
             "deprecated": false
           },
@@ -3605,7 +3605,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 126
+              "lineNumber": 128
             },
             "deprecated": false
           },
@@ -3618,7 +3618,7 @@
             "description": [],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 127
+              "lineNumber": 129
             },
             "deprecated": false
           },
@@ -3634,7 +3634,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 128
+              "lineNumber": 130
             },
             "deprecated": false
           },
@@ -3650,7 +3650,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 129
+              "lineNumber": 131
             },
             "deprecated": false
           },
@@ -3666,7 +3666,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 130
+              "lineNumber": 132
             },
             "deprecated": false
           }
@@ -4197,7 +4197,7 @@
         "description": [],
         "source": {
           "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-          "lineNumber": 145
+          "lineNumber": 147
         },
         "deprecated": false,
         "children": [
@@ -4213,7 +4213,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 146
+              "lineNumber": 148
             },
             "deprecated": false
           },
@@ -4229,7 +4229,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 147
+              "lineNumber": 149
             },
             "deprecated": false
           },
@@ -4245,7 +4245,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 148
+              "lineNumber": 150
             },
             "deprecated": false
           },
@@ -4261,7 +4261,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 149
+              "lineNumber": 151
             },
             "deprecated": false
           },
@@ -4277,7 +4277,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 150
+              "lineNumber": 152
             },
             "deprecated": false
           },
@@ -4293,7 +4293,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 151
+              "lineNumber": 153
             },
             "deprecated": false
           },
@@ -4309,7 +4309,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 152
+              "lineNumber": 154
             },
             "deprecated": false
           },
@@ -4325,7 +4325,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 153
+              "lineNumber": 155
             },
             "deprecated": false
           },
@@ -4341,7 +4341,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 154
+              "lineNumber": 156
             },
             "deprecated": false
           },
@@ -4357,7 +4357,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 155
+              "lineNumber": 157
             },
             "deprecated": false
           },
@@ -4373,7 +4373,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 156
+              "lineNumber": 158
             },
             "deprecated": false
           },
@@ -4389,7 +4389,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts",
-              "lineNumber": 157
+              "lineNumber": 159
             },
             "deprecated": false
           }
@@ -4503,7 +4503,7 @@
           "ExceptionListTypeEnum"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/exception_list/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/exception_list/index.d.ts",
           "lineNumber": 14
         },
         "deprecated": false,
@@ -4520,7 +4520,7 @@
           "ListOperatorEnum"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/list_operator/index.d.ts",
           "lineNumber": 7
         },
         "deprecated": false,
@@ -4537,7 +4537,7 @@
           "ListOperatorTypeEnum"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/list_operator/index.d.ts",
           "lineNumber": 11
         },
         "deprecated": false,
@@ -4556,7 +4556,7 @@
           "{ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/comment/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/comment/index.d.ts",
           "lineNumber": 21
         },
         "deprecated": false,
@@ -4573,7 +4573,7 @@
           "({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/comment/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/comment/index.d.ts",
           "lineNumber": 20
         },
         "deprecated": false,
@@ -4590,7 +4590,7 @@
           "{ comment: string; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/create_comment/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/create_comment/index.d.ts",
           "lineNumber": 5
         },
         "deprecated": false,
@@ -4607,7 +4607,7 @@
           "{ comment: string; }[]"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/create_comment/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/create_comment/index.d.ts",
           "lineNumber": 9
         },
         "deprecated": false,
@@ -4753,7 +4753,7 @@
           "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"long\" | \"double\" | \"ip\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entries/index.d.ts",
           "lineNumber": 191
         },
         "deprecated": false,
@@ -4770,7 +4770,7 @@
           "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"long\" | \"double\" | \"ip\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entries/index.d.ts",
           "lineNumber": 79
         },
         "deprecated": false,
@@ -4787,7 +4787,7 @@
           "{ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_exist/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entries_exist/index.d.ts",
           "lineNumber": 12
         },
         "deprecated": false,
@@ -4804,7 +4804,7 @@
           "{ field: string; list: { id: string; type: \"boolean\" | \"date\" | \"text\" | \"keyword\" | \"long\" | \"double\" | \"ip\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_list/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entries_list/index.d.ts",
           "lineNumber": 40
         },
         "deprecated": false,
@@ -4821,7 +4821,7 @@
           "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entry_match/index.d.ts",
           "lineNumber": 13
         },
         "deprecated": false,
@@ -4838,7 +4838,7 @@
           "{ field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_any/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entry_match_any/index.d.ts",
           "lineNumber": 13
         },
         "deprecated": false,
@@ -4855,7 +4855,7 @@
           "{ field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_wildcard/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entry_match_wildcard/index.d.ts",
           "lineNumber": 13
         },
         "deprecated": false,
@@ -4872,7 +4872,7 @@
           "{ entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; }"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_nested/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entry_nested/index.d.ts",
           "lineNumber": 37
         },
         "deprecated": false,
@@ -4959,7 +4959,7 @@
           "\"endpoint\" | \"detection\" | \"endpoint_events\""
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/exception_list/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/exception_list/index.d.ts",
           "lineNumber": 12
         },
         "deprecated": false,
@@ -4976,7 +4976,7 @@
           "\"excluded\" | \"included\""
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/list_operator/index.d.ts",
           "lineNumber": 6
         },
         "deprecated": false,
@@ -5010,7 +5010,7 @@
           "\"single\" | \"agnostic\""
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/default_namespace/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/default_namespace/index.d.ts",
           "lineNumber": 6
         },
         "deprecated": false,
@@ -5027,7 +5027,7 @@
           "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/non_empty_nested_entries_array/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/non_empty_nested_entries_array/index.d.ts",
           "lineNumber": 62
         },
         "deprecated": false,
@@ -5044,7 +5044,7 @@
           "(\"windows\" | \"linux\" | \"macos\")[]"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/os_type/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/os_type/index.d.ts",
           "lineNumber": 9
         },
         "deprecated": false,
@@ -5061,7 +5061,7 @@
           "\"boolean\" | \"date\" | \"text\" | \"keyword\" | \"long\" | \"double\" | \"ip\" | \"date_nanos\" | \"geo_point\" | \"geo_shape\" | \"binary\" | \"short\" | \"date_range\" | \"ip_range\" | \"shape\" | \"integer\" | \"byte\" | \"float\" | \"half_float\" | \"integer_range\" | \"float_range\" | \"long_range\" | \"double_range\""
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/type/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/type/index.d.ts",
           "lineNumber": 56
         },
         "deprecated": false,
@@ -5118,7 +5118,7 @@
           "; }>>]>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/comment/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/comment/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5196,7 +5196,7 @@
           "<{ exists: null; }>; }>>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_exist/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entries_exist/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5230,7 +5230,7 @@
           "<{ list: null; }>; }>>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries_list/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entries_list/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5258,7 +5258,7 @@
           "<string, string, unknown>; }>>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entry_match/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5286,7 +5286,7 @@
           "<string[], string[], unknown>; }>>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_any/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entry_match_any/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5314,7 +5314,7 @@
           "<string, string, unknown>; }>>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_match_wildcard/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entry_match_wildcard/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5340,7 +5340,7 @@
           "<{ nested: null; }>; }>>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entry_nested/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entry_nested/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5422,7 +5422,7 @@
           "<string, string, unknown>; }>>]>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/entries/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/entries/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5602,7 +5602,7 @@
           "<{ detection: null; endpoint: null; endpoint_events: null; }>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/exception_list/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/exception_list/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5620,7 +5620,7 @@
           "<{ excluded: null; included: null; }>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/list_operator/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/list_operator/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5704,7 +5704,7 @@
           "<{ agnostic: null; single: null; }>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/default_namespace/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/default_namespace/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5756,7 +5756,7 @@
           "<{ exists: null; }>; }>>]>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/non_empty_nested_entries_array/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/non_empty_nested_entries_array/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5774,7 +5774,7 @@
           "<{ linux: null; macos: null; windows: null; }>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/os_type/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/os_type/index.d.ts",
           "lineNumber": 2
         },
         "deprecated": false,
@@ -5792,7 +5792,7 @@
           "<(\"windows\" | \"linux\" | \"macos\")[], (\"windows\" | \"linux\" | \"macos\")[] | undefined, unknown>"
         ],
         "source": {
-          "path": "node_modules/@kbn/securitysolution-io-ts-utils/target/list_types/os_type/index.d.ts",
+          "path": "node_modules/@kbn/securitysolution-io-ts-list-types/target/os_type/index.d.ts",
           "lineNumber": 8
         },
         "deprecated": false,
diff --git a/api_docs/monitoring.json b/api_docs/monitoring.json
index 5922304e0da82d..188e3f7b321001 100644
--- a/api_docs/monitoring.json
+++ b/api_docs/monitoring.json
@@ -173,7 +173,7 @@
         "signature": [
           "{ ui: { elasticsearch: ",
           "MonitoringElasticsearchConfig",
-          "; enabled: boolean; container: Readonly<{} & { logstash: Readonly<{} & { enabled: boolean; }>; elasticsearch: Readonly<{} & { enabled: boolean; }>; apm: Readonly<{} & { enabled: boolean; }>; }>; logs: Readonly<{} & { index: string; }>; metricbeat: Readonly<{} & { index: string; }>; ccs: Readonly<{} & { enabled: boolean; }>; max_bucket_size: number; min_interval_seconds: number; show_license_expiration: boolean; }; enabled: boolean; kibana: Readonly<{} & { collection: Readonly<{} & { enabled: boolean; interval: number; }>; }>; agent: Readonly<{} & { interval: string; }>; licensing: Readonly<{} & { api_polling_frequency: moment.Duration; }>; cluster_alerts: Readonly<{} & { enabled: boolean; allowedSpaces: string[]; email_notifications: Readonly<{} & { enabled: boolean; email_address: string; }>; }>; tests: Readonly<{} & { cloud_detector: Readonly<{} & { enabled: boolean; }>; }>; }"
+          "; enabled: boolean; container: Readonly<{} & { logstash: Readonly<{} & { enabled: boolean; }>; elasticsearch: Readonly<{} & { enabled: boolean; }>; apm: Readonly<{} & { enabled: boolean; }>; }>; logs: Readonly<{} & { index: string; }>; metricbeat: Readonly<{} & { index: string; }>; ccs: Readonly<{} & { enabled: boolean; }>; max_bucket_size: number; min_interval_seconds: number; show_license_expiration: boolean; }; enabled: boolean; kibana: Readonly<{} & { collection: Readonly<{} & { enabled: boolean; interval: number; }>; }>; licensing: Readonly<{} & { api_polling_frequency: moment.Duration; }>; agent: Readonly<{} & { interval: string; }>; cluster_alerts: Readonly<{} & { enabled: boolean; allowedSpaces: string[]; email_notifications: Readonly<{} & { enabled: boolean; email_address: string; }>; }>; tests: Readonly<{} & { cloud_detector: Readonly<{} & { enabled: boolean; }>; }>; }"
         ],
         "source": {
           "path": "x-pack/plugins/monitoring/server/config.ts",
diff --git a/api_docs/observability.json b/api_docs/observability.json
index f4826f427d36fb..33bec7fa210c54 100644
--- a/api_docs/observability.json
+++ b/api_docs/observability.json
@@ -1,41 +1,7 @@
 {
   "id": "observability",
   "client": {
-    "classes": [
-      {
-        "parentPluginId": "observability",
-        "id": "def-public.FormatterRuleRegistry",
-        "type": "Class",
-        "tags": [],
-        "label": "FormatterRuleRegistry",
-        "description": [],
-        "signature": [
-          {
-            "pluginId": "observability",
-            "scope": "public",
-            "docId": "kibObservabilityPluginApi",
-            "section": "def-public.FormatterRuleRegistry",
-            "text": "FormatterRuleRegistry"
-          },
-          "<TFieldMap> extends ",
-          {
-            "pluginId": "ruleRegistry",
-            "scope": "public",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-public.RuleRegistry",
-            "text": "RuleRegistry"
-          },
-          "<TFieldMap, FormattableRuleType<TFieldMap>>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/observability/public/rules/formatter_rule_registry.ts",
-          "lineNumber": 27
-        },
-        "deprecated": false,
-        "children": [],
-        "initialIsOpen": false
-      }
-    ],
+    "classes": [],
     "functions": [
       {
         "parentPluginId": "observability",
@@ -163,6 +129,33 @@
         "returnComment": [],
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "observability",
+        "id": "def-public.createObservabilityRuleTypeRegistryMock",
+        "type": "Function",
+        "tags": [],
+        "label": "createObservabilityRuleTypeRegistryMock",
+        "description": [],
+        "signature": [
+          "() => { register: (type: ",
+          {
+            "pluginId": "triggersActionsUi",
+            "scope": "public",
+            "docId": "kibTriggersActionsUiPluginApi",
+            "section": "def-public.AlertTypeModel",
+            "text": "AlertTypeModel"
+          },
+          "<any> & { format: Formatter; }) => void; getFormatter: (typeId: string) => Formatter | undefined; } & { registerFormatter: () => void; }"
+        ],
+        "source": {
+          "path": "x-pack/plugins/observability/public/rules/observability_rule_type_registry_mock.ts",
+          "lineNumber": 14
+        },
+        "deprecated": false,
+        "children": [],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "observability",
         "id": "def-public.FieldValueSuggestions",
@@ -894,7 +887,7 @@
         "label": "useUiTracker",
         "description": [],
         "signature": [
-          "({\n  app: defaultApp,\n}: { app?: \"apm\" | \"uptime\" | \"fleet\" | \"infra_metrics\" | \"infra_logs\" | \"synthetics\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined; }) => ({ app, metric, metricType }: ",
+          "({\n  app: defaultApp,\n}: { app?: \"apm\" | \"fleet\" | \"infra_metrics\" | \"infra_logs\" | \"uptime\" | \"synthetics\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined; }) => ({ app, metric, metricType }: ",
           {
             "pluginId": "observability",
             "scope": "public",
@@ -931,7 +924,7 @@
                 "label": "app",
                 "description": [],
                 "signature": [
-                  "\"apm\" | \"uptime\" | \"fleet\" | \"infra_metrics\" | \"infra_logs\" | \"synthetics\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined"
+                  "\"apm\" | \"fleet\" | \"infra_metrics\" | \"infra_logs\" | \"uptime\" | \"synthetics\" | \"observability-overview\" | \"stack_monitoring\" | \"ux\" | undefined"
                 ],
                 "source": {
                   "path": "x-pack/plugins/observability/public/hooks/use_track_metric.tsx",
@@ -2075,29 +2068,19 @@
           },
           {
             "parentPluginId": "observability",
-            "id": "def-public.ObservabilityPublicPluginsSetup.ruleRegistry",
+            "id": "def-public.ObservabilityPublicPluginsSetup.triggersActionsUi",
             "type": "Object",
             "tags": [],
-            "label": "ruleRegistry",
+            "label": "triggersActionsUi",
             "description": [],
             "signature": [
-              "{ registry: ",
-              {
-                "pluginId": "ruleRegistry",
-                "scope": "public",
-                "docId": "kibRuleRegistryPluginApi",
-                "section": "def-public.RuleRegistry",
-                "text": "RuleRegistry"
-              },
-              "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }, ",
               {
                 "pluginId": "triggersActionsUi",
                 "scope": "public",
                 "docId": "kibTriggersActionsUiPluginApi",
-                "section": "def-public.AlertTypeModel",
-                "text": "AlertTypeModel"
-              },
-              "<Record<string, unknown>>>; }"
+                "section": "def-public.TriggersAndActionsUIPublicPluginSetup",
+                "text": "TriggersAndActionsUIPublicPluginSetup"
+              }
             ],
             "source": {
               "path": "x-pack/plugins/observability/public/plugin.ts",
@@ -2167,6 +2150,28 @@
             },
             "deprecated": false
           },
+          {
+            "parentPluginId": "observability",
+            "id": "def-public.ObservabilityPublicPluginsStart.triggersActionsUi",
+            "type": "Object",
+            "tags": [],
+            "label": "triggersActionsUi",
+            "description": [],
+            "signature": [
+              {
+                "pluginId": "triggersActionsUi",
+                "scope": "public",
+                "docId": "kibTriggersActionsUiPluginApi",
+                "section": "def-public.TriggersAndActionsUIPublicPluginStart",
+                "text": "TriggersAndActionsUIPublicPluginStart"
+              }
+            ],
+            "source": {
+              "path": "x-pack/plugins/observability/public/plugin.ts",
+              "lineNumber": 48
+            },
+            "deprecated": false
+          },
           {
             "parentPluginId": "observability",
             "id": "def-public.ObservabilityPublicPluginsStart.data",
@@ -2185,7 +2190,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/observability/public/plugin.ts",
-              "lineNumber": 48
+              "lineNumber": 49
             },
             "deprecated": false
           },
@@ -2207,7 +2212,7 @@
             ],
             "source": {
               "path": "x-pack/plugins/observability/public/plugin.ts",
-              "lineNumber": 49
+              "lineNumber": 50
             },
             "deprecated": false
           }
@@ -2985,6 +2990,31 @@
         "deprecated": false,
         "initialIsOpen": false
       },
+      {
+        "parentPluginId": "observability",
+        "id": "def-public.ObservabilityRuleTypeRegistry",
+        "type": "Type",
+        "tags": [],
+        "label": "ObservabilityRuleTypeRegistry",
+        "description": [],
+        "signature": [
+          "{ register: (type: ",
+          {
+            "pluginId": "triggersActionsUi",
+            "scope": "public",
+            "docId": "kibTriggersActionsUiPluginApi",
+            "section": "def-public.AlertTypeModel",
+            "text": "AlertTypeModel"
+          },
+          "<any> & { format: Formatter; }) => void; getFormatter: (typeId: string) => Formatter | undefined; }"
+        ],
+        "source": {
+          "path": "x-pack/plugins/observability/public/rules/create_observability_rule_type_registry.ts",
+          "lineNumber": 31
+        },
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "observability",
         "id": "def-public.SectionLinkProps",
@@ -3104,19 +3134,19 @@
           "section": "def-public.DataHandler",
           "text": "DataHandler"
         },
-        "<T>) => void; }; ruleRegistry: ",
+        "<T>) => void; }; observabilityRuleTypeRegistry: { register: (type: ",
         {
-          "pluginId": "observability",
+          "pluginId": "triggersActionsUi",
           "scope": "public",
-          "docId": "kibObservabilityPluginApi",
-          "section": "def-public.FormatterRuleRegistry",
-          "text": "FormatterRuleRegistry"
+          "docId": "kibTriggersActionsUiPluginApi",
+          "section": "def-public.AlertTypeModel",
+          "text": "AlertTypeModel"
         },
-        "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>; isAlertingExperienceEnabled: () => boolean; }"
+        "<any> & { format: Formatter; }) => void; getFormatter: (typeId: string) => Formatter | undefined; }; isAlertingExperienceEnabled: () => boolean; }"
       ],
       "source": {
         "path": "x-pack/plugins/observability/public/plugin.ts",
-        "lineNumber": 37
+        "lineNumber": 38
       },
       "deprecated": false,
       "lifecycle": "setup",
@@ -3134,7 +3164,7 @@
       ],
       "source": {
         "path": "x-pack/plugins/observability/public/plugin.ts",
-        "lineNumber": 52
+        "lineNumber": 53
       },
       "deprecated": false,
       "lifecycle": "start",
@@ -3619,14 +3649,19 @@
           },
           {
             "parentPluginId": "observability",
-            "id": "def-server.ObservabilityRouteHandlerResources.ruleRegistry",
+            "id": "def-server.ObservabilityRouteHandlerResources.ruleDataClient",
             "type": "Object",
             "tags": [],
-            "label": "ruleRegistry",
+            "label": "ruleDataClient",
             "description": [],
             "signature": [
-              "RuleRegistry",
-              "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>"
+              {
+                "pluginId": "ruleRegistry",
+                "scope": "server",
+                "docId": "kibRuleRegistryPluginApi",
+                "section": "def-server.RuleDataClient",
+                "text": "RuleDataClient"
+              }
             ],
             "source": {
               "path": "x-pack/plugins/observability/server/routes/types.ts",
@@ -3840,7 +3875,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          ", any, ",
+          ", any[], ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -3902,30 +3937,6 @@
         "deprecated": false,
         "initialIsOpen": false
       },
-      {
-        "parentPluginId": "observability",
-        "id": "def-server.ObservabilityRuleRegistryClient",
-        "type": "Type",
-        "tags": [],
-        "label": "ObservabilityRuleRegistryClient",
-        "description": [],
-        "signature": [
-          {
-            "pluginId": "ruleRegistry",
-            "scope": "server",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-server.ScopedRuleRegistryClient",
-            "text": "ScopedRuleRegistryClient"
-          },
-          "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/observability/server/types.ts",
-          "lineNumber": 35
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
       {
         "parentPluginId": "observability",
         "id": "def-server.ObservabilityServerRouteRepository",
@@ -3977,7 +3988,7 @@
             "section": "def-server.ObservabilityRouteHandlerResources",
             "text": "ObservabilityRouteHandlerResources"
           },
-          ", any, ",
+          ", any[], ",
           {
             "pluginId": "observability",
             "scope": "server",
@@ -4083,13 +4094,11 @@
         "GetResponse",
         "<unknown>>; delete: (deleteParams: { id: string; }) => Promise<",
         "DeleteResponse",
-        ">; } | undefined>; ruleRegistry: ",
-        "RuleRegistry",
-        "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; } & { 'kibana.observability.evaluation.value': { type: \"scaled_float\"; scaling_factor: number; }; 'kibana.observability.evaluation.threshold': { type: \"scaled_float\"; scaling_factor: number; }; 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>; }"
+        ">; } | undefined>; }"
       ],
       "source": {
         "path": "x-pack/plugins/observability/server/plugin.ts",
-        "lineNumber": 22
+        "lineNumber": 21
       },
       "deprecated": false,
       "lifecycle": "setup",
diff --git a/api_docs/observability.mdx b/api_docs/observability.mdx
index 59a9b7f5504779..353e65b0fa0808 100644
--- a/api_docs/observability.mdx
+++ b/api_docs/observability.mdx
@@ -22,9 +22,6 @@ import observabilityObj from './observability.json';
 ### Functions
 <DocDefinitionList data={observabilityObj.client.functions}/>
 
-### Classes
-<DocDefinitionList data={observabilityObj.client.classes}/>
-
 ### Interfaces
 <DocDefinitionList data={observabilityObj.client.interfaces}/>
 
diff --git a/api_docs/reporting.json b/api_docs/reporting.json
index 5be16e04ae1e93..10dda8b9b851ab 100644
--- a/api_docs/reporting.json
+++ b/api_docs/reporting.json
@@ -982,9 +982,9 @@
                     "section": "def-server.PluginInitializerContext",
                     "text": "PluginInitializerContext"
                   },
-                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ port?: number | undefined; hostname?: string | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
                   "ByteSizeValue",
-                  "; useByteOrderMarkEncoding: boolean; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; }>>"
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; }>>"
                 ],
                 "source": {
                   "path": "x-pack/plugins/reporting/server/core.ts",
@@ -1935,9 +1935,9 @@
                     "section": "def-server.PluginInitializerContext",
                     "text": "PluginInitializerContext"
                   },
-                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ port?: number | undefined; hostname?: string | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+                  "<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
                   "ByteSizeValue",
-                  "; useByteOrderMarkEncoding: boolean; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; }>>"
+                  "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; }>>"
                 ],
                 "source": {
                   "path": "x-pack/plugins/reporting/server/plugin.ts",
@@ -2147,9 +2147,9 @@
             "section": "def-server.ReportingConfig",
             "text": "ReportingConfig"
           },
-          " extends Config<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; kibanaServer: Readonly<{ port?: number | undefined; hostname?: string | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
+          " extends Config<Readonly<{ encryptionKey?: string | undefined; } & { enabled: boolean; index: string; capture: Readonly<{} & { browser: Readonly<{} & { type: string; chromium: Readonly<{ inspect?: boolean | undefined; disableSandbox?: boolean | undefined; } & { proxy: Readonly<{ server?: string | undefined; bypass?: string[] | undefined; } & { enabled: boolean; }>; }>; autoDownload: boolean; }>; timeouts: Readonly<{} & { openUrl: number | moment.Duration; waitForElements: number | moment.Duration; renderComplete: number | moment.Duration; }>; networkPolicy: Readonly<{} & { enabled: boolean; rules: Readonly<{ host?: string | undefined; protocol?: string | undefined; } & { allow: boolean; }>[]; }>; zoom: number; viewport: Readonly<{} & { height: number; width: number; }>; loadDelay: number | moment.Duration; maxAttempts: number; }>; kibanaServer: Readonly<{ hostname?: string | undefined; port?: number | undefined; protocol?: string | undefined; } & {}>; queue: Readonly<{} & { timeout: number | moment.Duration; pollInterval: number | moment.Duration; indexInterval: string; pollEnabled: boolean; pollIntervalErrorMultiplier: number; }>; csv: Readonly<{} & { scroll: Readonly<{} & { size: number; duration: string; }>; checkForFormulas: boolean; escapeFormulaValues: boolean; enablePanelActionDownload: boolean; maxSizeBytes: number | ",
           "ByteSizeValue",
-          "; useByteOrderMarkEncoding: boolean; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; }>>"
+          "; useByteOrderMarkEncoding: boolean; }>; roles: Readonly<{} & { enabled: boolean; allow: string[]; }>; poll: Readonly<{} & { jobCompletionNotifier: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; jobsRefresh: Readonly<{} & { interval: number; intervalErrorMultiplier: number; }>; }>; }>>"
         ],
         "source": {
           "path": "x-pack/plugins/reporting/server/config/config.ts",
diff --git a/api_docs/rule_registry.json b/api_docs/rule_registry.json
index 17d2235fa88bde..63a50f8fbd42f5 100644
--- a/api_docs/rule_registry.json
+++ b/api_docs/rule_registry.json
@@ -1,49 +1,48 @@
 {
   "id": "ruleRegistry",
   "client": {
+    "classes": [],
+    "functions": [],
+    "interfaces": [],
+    "enums": [],
+    "misc": [],
+    "objects": []
+  },
+  "server": {
     "classes": [
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-public.RuleRegistry",
+        "id": "def-server.RuleDataClient",
         "type": "Class",
         "tags": [],
-        "label": "RuleRegistry",
+        "label": "RuleDataClient",
         "description": [],
         "signature": [
           {
             "pluginId": "ruleRegistry",
-            "scope": "public",
+            "scope": "server",
             "docId": "kibRuleRegistryPluginApi",
-            "section": "def-public.RuleRegistry",
-            "text": "RuleRegistry"
+            "section": "def-server.RuleDataClient",
+            "text": "RuleDataClient"
           },
-          "<TFieldMap, TRuleType>"
+          " implements ",
+          {
+            "pluginId": "ruleRegistry",
+            "scope": "server",
+            "docId": "kibRuleRegistryPluginApi",
+            "section": "def-server.IRuleDataClient",
+            "text": "IRuleDataClient"
+          }
         ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-          "lineNumber": 11
+          "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+          "lineNumber": 21
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.types",
-            "type": "Array",
-            "tags": [],
-            "label": "types",
-            "description": [],
-            "signature": [
-              "TRuleType[]"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.Unnamed",
+            "id": "def-server.RuleDataClient.Unnamed",
             "type": "Function",
             "tags": [],
             "label": "Constructor",
@@ -52,25 +51,24 @@
               "any"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 14
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+              "lineNumber": 22
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-public.RuleRegistry.Unnamed.$1",
+                "id": "def-server.RuleDataClient.Unnamed.$1",
                 "type": "Object",
                 "tags": [],
                 "label": "options",
                 "description": [],
                 "signature": [
-                  "RuleRegistryConstructorOptions",
-                  "<TFieldMap>"
+                  "RuleDataClientConstructorOptions"
                 ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-                  "lineNumber": 14
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                  "lineNumber": 22
                 },
                 "deprecated": false,
                 "isRequired": true
@@ -80,154 +78,152 @@
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.getTypes",
-            "type": "Function",
-            "tags": [],
-            "label": "getTypes",
-            "description": [],
-            "signature": [
-              "() => TRuleType[]"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 16
-            },
-            "deprecated": false,
-            "children": [],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.getTypeByRuleId",
+            "id": "def-server.RuleDataClient.getReader",
             "type": "Function",
             "tags": [],
-            "label": "getTypeByRuleId",
+            "label": "getReader",
             "description": [],
             "signature": [
-              "(id: string) => TRuleType | undefined"
+              "(options?: { namespace?: string | undefined; }) => ",
+              "RuleDataReader"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 20
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+              "lineNumber": 29
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-public.RuleRegistry.getTypeByRuleId.$1",
-                "type": "string",
+                "id": "def-server.RuleDataClient.getReader.$1.options",
+                "type": "Object",
                 "tags": [],
-                "label": "id",
+                "label": "options",
                 "description": [],
-                "signature": [
-                  "string"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-                  "lineNumber": 20
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                  "lineNumber": 29
                 },
                 "deprecated": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.RuleDataClient.getReader.$1.options.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                      "lineNumber": 29
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.registerType",
+            "id": "def-server.RuleDataClient.getWriter",
             "type": "Function",
             "tags": [],
-            "label": "registerType",
+            "label": "getWriter",
             "description": [],
             "signature": [
-              "(type: TRuleType) => void"
+              "(options?: { namespace?: string | undefined; }) => ",
+              "RuleDataWriter"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 24
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+              "lineNumber": 60
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-public.RuleRegistry.registerType.$1",
-                "type": "Uncategorized",
+                "id": "def-server.RuleDataClient.getWriter.$1.options",
+                "type": "Object",
                 "tags": [],
-                "label": "type",
+                "label": "options",
                 "description": [],
-                "signature": [
-                  "TRuleType"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-                  "lineNumber": 24
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                  "lineNumber": 60
                 },
                 "deprecated": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.RuleDataClient.getWriter.$1.options.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                      "lineNumber": 60
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.RuleRegistry.create",
+            "id": "def-server.RuleDataClient.createOrUpdateWriteTarget",
             "type": "Function",
             "tags": [],
-            "label": "create",
+            "label": "createOrUpdateWriteTarget",
             "description": [],
             "signature": [
-              "<TNextFieldMap extends ",
-              {
-                "pluginId": "ruleRegistry",
-                "scope": "common",
-                "docId": "kibRuleRegistryPluginApi",
-                "section": "def-common.FieldMap",
-                "text": "FieldMap"
-              },
-              ", TRuleRegistryInstance extends ",
-              {
-                "pluginId": "ruleRegistry",
-                "scope": "public",
-                "docId": "kibRuleRegistryPluginApi",
-                "section": "def-public.IRuleRegistry",
-                "text": "IRuleRegistry"
-              },
-              "<TFieldMap & TNextFieldMap, any, undefined> = ",
-              {
-                "pluginId": "ruleRegistry",
-                "scope": "public",
-                "docId": "kibRuleRegistryPluginApi",
-                "section": "def-public.IRuleRegistry",
-                "text": "IRuleRegistry"
-              },
-              "<TFieldMap & TNextFieldMap, TRuleType, undefined>>({ fieldMap, ctor }: { fieldMap: TNextFieldMap; ctor?: (new (options: ",
-              "RuleRegistryConstructorOptions",
-              "<TFieldMap & TNextFieldMap>) => TRuleRegistryInstance) | undefined; }) => any"
+              "({ namespace }: { namespace?: string | undefined; }) => Promise<void>"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-              "lineNumber": 33
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+              "lineNumber": 92
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-public.RuleRegistry.create.$1",
+                "id": "def-server.RuleDataClient.createOrUpdateWriteTarget.$1.namespace",
                 "type": "Object",
                 "tags": [],
-                "label": "{ fieldMap, ctor }",
+                "label": "{ namespace }",
                 "description": [],
-                "signature": [
-                  "{ fieldMap: TNextFieldMap; ctor?: (new (options: ",
-                  "RuleRegistryConstructorOptions",
-                  "<TFieldMap & TNextFieldMap>) => TRuleRegistryInstance) | undefined; }"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/index.ts",
-                  "lineNumber": 33
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                  "lineNumber": 92
                 },
                 "deprecated": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.RuleDataClient.createOrUpdateWriteTarget.$1.namespace.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/index.ts",
+                      "lineNumber": 92
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
             ],
             "returnComment": []
@@ -236,191 +232,451 @@
         "initialIsOpen": false
       }
     ],
-    "functions": [],
-    "interfaces": [
+    "functions": [
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-public.IRuleRegistry",
-        "type": "Interface",
+        "id": "def-server.createLifecycleRuleTypeFactory",
+        "type": "Function",
         "tags": [],
-        "label": "IRuleRegistry",
+        "label": "createLifecycleRuleTypeFactory",
         "description": [],
         "signature": [
+          "({ logger, ruleDataClient, }: { ruleDataClient: ",
           {
             "pluginId": "ruleRegistry",
-            "scope": "public",
+            "scope": "server",
             "docId": "kibRuleRegistryPluginApi",
-            "section": "def-public.IRuleRegistry",
-            "text": "IRuleRegistry"
+            "section": "def-server.RuleDataClient",
+            "text": "RuleDataClient"
+          },
+          "; logger: ",
+          "Logger",
+          "; }) => <TParams extends Record<string, unknown>, TAlertInstanceContext extends { [x: string]: unknown; }, TServices extends { alertWithLifecycle: LifecycleAlertService<TAlertInstanceContext>; }>(type: ",
+          "AlertTypeWithExecutor",
+          "<TParams, TAlertInstanceContext, TServices>) => { executor: (options: ",
+          {
+            "pluginId": "alerting",
+            "scope": "server",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-server.AlertExecutorOptions",
+            "text": "AlertExecutorOptions"
+          },
+          "<TParams, Record<string, unknown>, { [x: string]: unknown; }, TAlertInstanceContext, never> & { services: any; }) => Promise<{ wrapped: any; trackedAlerts: { [k: string]: { alertId: string; alertUuid: string; started: string; }; }; }>; id: string; name: string; validate?: { params?: ",
+          "AlertTypeParamsValidator",
+          "<TParams> | undefined; } | undefined; actionGroups: ",
+          {
+            "pluginId": "alerting",
+            "scope": "common",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-common.ActionGroup",
+            "text": "ActionGroup"
+          },
+          "<string>[]; defaultActionGroupId: string; recoveryActionGroup?: ",
+          {
+            "pluginId": "alerting",
+            "scope": "common",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-common.ActionGroup",
+            "text": "ActionGroup"
+          },
+          "<string> | undefined; producer: string; actionVariables?: { context?: ",
+          {
+            "pluginId": "alerting",
+            "scope": "common",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-common.ActionVariable",
+            "text": "ActionVariable"
+          },
+          "[] | undefined; state?: ",
+          {
+            "pluginId": "alerting",
+            "scope": "common",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-common.ActionVariable",
+            "text": "ActionVariable"
+          },
+          "[] | undefined; params?: ",
+          {
+            "pluginId": "alerting",
+            "scope": "common",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-common.ActionVariable",
+            "text": "ActionVariable"
           },
-          "<TFieldMap, TRuleType, TInstanceType>"
+          "[] | undefined; } | undefined; minimumLicenseRequired: \"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\"; }"
         ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-          "lineNumber": 47
+          "path": "x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts",
+          "lineNumber": 62
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.IRuleRegistry.create",
-            "type": "Function",
+            "id": "def-server.createLifecycleRuleTypeFactory.$1",
+            "type": "Object",
             "tags": [],
-            "label": "create",
+            "label": "{\n  logger,\n  ruleDataClient,\n}",
             "description": [],
             "signature": [
-              "<TNextFieldMap extends ",
-              {
-                "pluginId": "ruleRegistry",
-                "scope": "common",
-                "docId": "kibRuleRegistryPluginApi",
-                "section": "def-common.FieldMap",
-                "text": "FieldMap"
-              },
-              ", TRuleRegistryInstance extends ",
-              {
-                "pluginId": "ruleRegistry",
-                "scope": "public",
-                "docId": "kibRuleRegistryPluginApi",
-                "section": "def-public.IRuleRegistry",
-                "text": "IRuleRegistry"
-              },
-              "<TFieldMap & TNextFieldMap, any, undefined> = TInstanceType extends ",
+              "{ ruleDataClient: ",
               {
                 "pluginId": "ruleRegistry",
-                "scope": "public",
+                "scope": "server",
                 "docId": "kibRuleRegistryPluginApi",
-                "section": "def-public.IRuleRegistry",
-                "text": "IRuleRegistry"
+                "section": "def-server.RuleDataClient",
+                "text": "RuleDataClient"
               },
-              "<TFieldMap & TNextFieldMap, TRuleType, undefined> ? TInstanceType : ",
+              "; logger: ",
+              "Logger",
+              "; }"
+            ],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/server/utils/create_lifecycle_rule_type_factory.ts",
+              "lineNumber": 62
+            },
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "ruleRegistry",
+        "id": "def-server.getRuleExecutorData",
+        "type": "Function",
+        "tags": [],
+        "label": "getRuleExecutorData",
+        "description": [],
+        "signature": [
+          "(type: ",
+          "AlertTypeWithExecutor",
+          "<any, any, any>, options: ",
+          {
+            "pluginId": "alerting",
+            "scope": "server",
+            "docId": "kibAlertingPluginApi",
+            "section": "def-server.AlertExecutorOptions",
+            "text": "AlertExecutorOptions"
+          },
+          "<{}, Record<string, unknown>, { [x: string]: unknown; }, {}, never> & { services: {}; }) => { \"rule.id\": string; \"rule.uuid\": string; \"rule.category\": string; \"rule.name\": string; tags: string[]; \"kibana.rac.alert.producer\": string; }"
+        ],
+        "source": {
+          "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+          "lineNumber": 27
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.getRuleExecutorData.$1",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "type",
+            "description": [],
+            "signature": [
+              "AlertTypeWithExecutor",
+              "<any, any, any>"
+            ],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 28
+            },
+            "deprecated": false,
+            "isRequired": true
+          },
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.getRuleExecutorData.$2",
+            "type": "CompoundType",
+            "tags": [],
+            "label": "options",
+            "description": [],
+            "signature": [
               {
-                "pluginId": "ruleRegistry",
-                "scope": "public",
-                "docId": "kibRuleRegistryPluginApi",
-                "section": "def-public.IRuleRegistry",
-                "text": "IRuleRegistry"
+                "pluginId": "alerting",
+                "scope": "server",
+                "docId": "kibAlertingPluginApi",
+                "section": "def-server.AlertExecutorOptions",
+                "text": "AlertExecutorOptions"
               },
-              "<TFieldMap & TNextFieldMap, TRuleType, undefined>>(options: { fieldMap: TNextFieldMap; ctor?: (new (options: ",
-              "RuleRegistryConstructorOptions",
-              "<TFieldMap & TNextFieldMap>) => TRuleRegistryInstance) | undefined; }) => TRuleRegistryInstance"
+              "<{}, Record<string, unknown>, { [x: string]: unknown; }, {}, never> & { services: {}; }"
+            ],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 29
+            },
+            "deprecated": false,
+            "isRequired": true
+          }
+        ],
+        "returnComment": [],
+        "initialIsOpen": false
+      }
+    ],
+    "interfaces": [
+      {
+        "parentPluginId": "ruleRegistry",
+        "id": "def-server.IRuleDataClient",
+        "type": "Interface",
+        "tags": [],
+        "label": "IRuleDataClient",
+        "description": [],
+        "source": {
+          "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+          "lineNumber": 34
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.IRuleDataClient.getReader",
+            "type": "Function",
+            "tags": [],
+            "label": "getReader",
+            "description": [],
+            "signature": [
+              "(options?: { namespace?: string | undefined; } | undefined) => ",
+              "RuleDataReader"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-              "lineNumber": 52
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+              "lineNumber": 35
             },
             "deprecated": false,
-            "returnComment": [],
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-public.options",
+                "id": "def-server.IRuleDataClient.getReader.$1.options",
                 "type": "Object",
                 "tags": [],
                 "label": "options",
                 "description": [],
-                "signature": [
-                  "{ fieldMap: TNextFieldMap; ctor?: (new (options: ",
-                  "RuleRegistryConstructorOptions",
-                  "<TFieldMap & TNextFieldMap>) => TRuleRegistryInstance) | undefined; }"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-                  "lineNumber": 40
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                  "lineNumber": 35
                 },
-                "deprecated": false
+                "deprecated": false,
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.IRuleDataClient.getReader.$1.options.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                      "lineNumber": 35
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
-            ]
+            ],
+            "returnComment": []
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.IRuleRegistry.registerType",
+            "id": "def-server.IRuleDataClient.getWriter",
             "type": "Function",
             "tags": [],
-            "label": "registerType",
+            "label": "getWriter",
             "description": [],
             "signature": [
-              "(type: TRuleType) => void"
+              "(options?: { namespace?: string | undefined; } | undefined) => ",
+              "RuleDataWriter"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-              "lineNumber": 53
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+              "lineNumber": 36
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-public.IRuleRegistry.registerType.$1",
-                "type": "Uncategorized",
+                "id": "def-server.IRuleDataClient.getWriter.$1.options",
+                "type": "Object",
                 "tags": [],
-                "label": "type",
+                "label": "options",
                 "description": [],
-                "signature": [
-                  "TRuleType"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-                  "lineNumber": 53
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                  "lineNumber": 36
                 },
                 "deprecated": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.IRuleDataClient.getWriter.$1.options.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                      "lineNumber": 36
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
             ],
             "returnComment": []
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.IRuleRegistry.getTypeByRuleId",
+            "id": "def-server.IRuleDataClient.createOrUpdateWriteTarget",
             "type": "Function",
             "tags": [],
-            "label": "getTypeByRuleId",
+            "label": "createOrUpdateWriteTarget",
             "description": [],
             "signature": [
-              "(ruleId: string) => TRuleType"
+              "(options: { namespace?: string | undefined; }) => Promise<void>"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-              "lineNumber": 54
+              "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+              "lineNumber": 37
             },
             "deprecated": false,
             "children": [
               {
                 "parentPluginId": "ruleRegistry",
-                "id": "def-public.IRuleRegistry.getTypeByRuleId.$1",
-                "type": "string",
+                "id": "def-server.IRuleDataClient.createOrUpdateWriteTarget.$1.options",
+                "type": "Object",
                 "tags": [],
-                "label": "ruleId",
+                "label": "options",
                 "description": [],
-                "signature": [
-                  "string"
-                ],
                 "source": {
-                  "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-                  "lineNumber": 54
+                  "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                  "lineNumber": 37
                 },
                 "deprecated": false,
-                "isRequired": true
+                "children": [
+                  {
+                    "parentPluginId": "ruleRegistry",
+                    "id": "def-server.IRuleDataClient.createOrUpdateWriteTarget.$1.options.namespace",
+                    "type": "string",
+                    "tags": [],
+                    "label": "namespace",
+                    "description": [],
+                    "signature": [
+                      "string | undefined"
+                    ],
+                    "source": {
+                      "path": "x-pack/plugins/rule_registry/server/rule_data_client/types.ts",
+                      "lineNumber": 37
+                    },
+                    "deprecated": false
+                  }
+                ]
               }
             ],
             "returnComment": []
+          }
+        ],
+        "initialIsOpen": false
+      },
+      {
+        "parentPluginId": "ruleRegistry",
+        "id": "def-server.RuleExecutorData",
+        "type": "Interface",
+        "tags": [],
+        "label": "RuleExecutorData",
+        "description": [],
+        "source": {
+          "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+          "lineNumber": 18
+        },
+        "deprecated": false,
+        "children": [
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.RuleExecutorData.RULE_CATEGORY",
+            "type": "string",
+            "tags": [],
+            "label": "[RULE_CATEGORY]",
+            "description": [],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 19
+            },
+            "deprecated": false
           },
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-public.IRuleRegistry.getTypes",
-            "type": "Function",
+            "id": "def-server.RuleExecutorData.RULE_ID",
+            "type": "string",
+            "tags": [],
+            "label": "[RULE_ID]",
+            "description": [],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 20
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.RuleExecutorData.RULE_UUID",
+            "type": "string",
+            "tags": [],
+            "label": "[RULE_UUID]",
+            "description": [],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 21
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.RuleExecutorData.RULE_NAME",
+            "type": "string",
+            "tags": [],
+            "label": "[RULE_NAME]",
+            "description": [],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 22
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.RuleExecutorData.PRODUCER",
+            "type": "string",
+            "tags": [],
+            "label": "[PRODUCER]",
+            "description": [],
+            "source": {
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 23
+            },
+            "deprecated": false
+          },
+          {
+            "parentPluginId": "ruleRegistry",
+            "id": "def-server.RuleExecutorData.TAGS",
+            "type": "Array",
             "tags": [],
-            "label": "getTypes",
+            "label": "[TAGS]",
             "description": [],
             "signature": [
-              "() => TRuleType[]"
+              "string[]"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-              "lineNumber": 55
+              "path": "x-pack/plugins/rule_registry/server/utils/get_rule_executor_data.ts",
+              "lineNumber": 24
             },
-            "deprecated": false,
-            "children": [],
-            "returnComment": []
+            "deprecated": false
           }
         ],
         "initialIsOpen": false
@@ -430,324 +686,17 @@
     "misc": [
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-public.RuleRegistryPublicPluginSetupContract",
+        "id": "def-server.RuleRegistryPluginConfig",
         "type": "Type",
         "tags": [],
-        "label": "RuleRegistryPublicPluginSetupContract",
+        "label": "RuleRegistryPluginConfig",
         "description": [],
         "signature": [
-          "{ registry: ",
-          {
-            "pluginId": "ruleRegistry",
-            "scope": "public",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-public.RuleRegistry",
-            "text": "RuleRegistry"
-          },
-          "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }, ",
-          {
-            "pluginId": "triggersActionsUi",
-            "scope": "public",
-            "docId": "kibTriggersActionsUiPluginApi",
-            "section": "def-public.AlertTypeModel",
-            "text": "AlertTypeModel"
-          },
-          "<Record<string, unknown>>>; }"
+          "{ readonly enabled: boolean; readonly index: string; readonly write: Readonly<{} & { enabled: boolean; }>; }"
         ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/public/plugin.ts",
-          "lineNumber": 35
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-public.RuleType",
-        "type": "Type",
-        "tags": [],
-        "label": "RuleType",
-        "description": [],
-        "signature": [
-          {
-            "pluginId": "triggersActionsUi",
-            "scope": "public",
-            "docId": "kibTriggersActionsUiPluginApi",
-            "section": "def-public.AlertTypeModel",
-            "text": "AlertTypeModel"
-          },
-          "<Record<string, unknown>>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/public/rule_registry/types.ts",
-          "lineNumber": 16
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      }
-    ],
-    "objects": []
-  },
-  "server": {
-    "classes": [],
-    "functions": [
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-server.createLifecycleRuleTypeFactory",
-        "type": "Function",
-        "tags": [],
-        "label": "createLifecycleRuleTypeFactory",
-        "description": [],
-        "signature": [
-          "() => TRuleRegistry extends ",
-          "RuleRegistry",
-          "<infer TFieldMap> ? CreateLifecycleRuleType<TFieldMap> : never"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory.ts",
-          "lineNumber": 54
-        },
-        "deprecated": false,
-        "children": [],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-server.createLifecycleRuleTypeFactory",
-        "type": "Function",
-        "tags": [],
-        "label": "createLifecycleRuleTypeFactory",
-        "description": [],
-        "signature": [
-          "() => CreateLifecycleRuleType<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/server/rule_registry/rule_type_helpers/create_lifecycle_rule_type_factory.ts",
-          "lineNumber": 60
-        },
-        "deprecated": false,
-        "children": [],
-        "returnComment": [],
-        "initialIsOpen": false
-      }
-    ],
-    "interfaces": [
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-server.ScopedRuleRegistryClient",
-        "type": "Interface",
-        "tags": [],
-        "label": "ScopedRuleRegistryClient",
-        "description": [],
-        "signature": [
-          {
-            "pluginId": "ruleRegistry",
-            "scope": "server",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-server.ScopedRuleRegistryClient",
-            "text": "ScopedRuleRegistryClient"
-          },
-          "<TFieldMap>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-          "lineNumber": 41
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-server.ScopedRuleRegistryClient.search",
-            "type": "Function",
-            "tags": [],
-            "label": "search",
-            "description": [],
-            "signature": [
-              "<TSearchRequest extends FieldsESSearchRequest<TFieldMap>>(request: TSearchRequest) => Promise<{ body: ",
-              "InferSearchResponseOf",
-              "<unknown, TSearchRequest, { restTotalHitsAsInt: false; }>; events: ",
-              "EventsOf",
-              "<TSearchRequest, TFieldMap>; }>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-              "lineNumber": 42
-            },
-            "deprecated": false,
-            "children": [
-              {
-                "parentPluginId": "ruleRegistry",
-                "id": "def-server.ScopedRuleRegistryClient.search.$1",
-                "type": "Uncategorized",
-                "tags": [],
-                "label": "request",
-                "description": [],
-                "signature": [
-                  "TSearchRequest"
-                ],
-                "source": {
-                  "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-                  "lineNumber": 43
-                },
-                "deprecated": false,
-                "isRequired": true
-              }
-            ],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-server.ScopedRuleRegistryClient.getDynamicIndexPattern",
-            "type": "Function",
-            "tags": [],
-            "label": "getDynamicIndexPattern",
-            "description": [],
-            "signature": [
-              "() => Promise<{ title: string; timeFieldName: string; fields: ",
-              {
-                "pluginId": "data",
-                "scope": "server",
-                "docId": "kibDataIndexPatternsPluginApi",
-                "section": "def-server.FieldDescriptor",
-                "text": "FieldDescriptor"
-              },
-              "[]; }>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-              "lineNumber": 48
-            },
-            "deprecated": false,
-            "children": [],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-server.ScopedRuleRegistryClient.index",
-            "type": "Function",
-            "tags": [],
-            "label": "index",
-            "description": [],
-            "signature": [
-              "(doc: Pick<OutputOf<",
-              "Optional",
-              "<TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>>, Exclude<{ [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap], \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\"> | Exclude<",
-              "SetDifference",
-              "<keyof TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>, \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\">>) => void"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-              "lineNumber": 53
-            },
-            "deprecated": false,
-            "children": [
-              {
-                "parentPluginId": "ruleRegistry",
-                "id": "def-server.ScopedRuleRegistryClient.index.$1",
-                "type": "Object",
-                "tags": [],
-                "label": "doc",
-                "description": [],
-                "signature": [
-                  "Pick<OutputOf<",
-                  "Optional",
-                  "<TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>>, Exclude<{ [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap], \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\"> | Exclude<",
-                  "SetDifference",
-                  "<keyof TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>, \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\">>"
-                ],
-                "source": {
-                  "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-                  "lineNumber": 53
-                },
-                "deprecated": false,
-                "isRequired": true
-              }
-            ],
-            "returnComment": []
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-server.ScopedRuleRegistryClient.bulkIndex",
-            "type": "Function",
-            "tags": [],
-            "label": "bulkIndex",
-            "description": [],
-            "signature": [
-              "(doc: Pick<OutputOf<",
-              "Optional",
-              "<TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>>, Exclude<{ [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap], \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\"> | Exclude<",
-              "SetDifference",
-              "<keyof TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>, \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\">>[]) => Promise<void>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-              "lineNumber": 54
-            },
-            "deprecated": false,
-            "children": [
-              {
-                "parentPluginId": "ruleRegistry",
-                "id": "def-server.ScopedRuleRegistryClient.bulkIndex.$1",
-                "type": "Array",
-                "tags": [],
-                "label": "doc",
-                "description": [],
-                "signature": [
-                  "Pick<OutputOf<",
-                  "Optional",
-                  "<TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>>, Exclude<{ [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap], \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\"> | Exclude<",
-                  "SetDifference",
-                  "<keyof TFieldMap, { [key in keyof TFieldMap]: TFieldMap[key][\"required\"] extends true ? never : key; }[keyof TFieldMap]>, \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.producer\">>[]"
-                ],
-                "source": {
-                  "path": "x-pack/plugins/rule_registry/server/rule_registry/create_scoped_rule_registry_client/types.ts",
-                  "lineNumber": 55
-                },
-                "deprecated": false,
-                "isRequired": true
-              }
-            ],
-            "returnComment": []
-          }
-        ],
-        "initialIsOpen": false
-      }
-    ],
-    "enums": [],
-    "misc": [
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-server.FieldMapOf",
-        "type": "Type",
-        "tags": [],
-        "label": "FieldMapOf",
-        "description": [],
-        "signature": [
-          "TRuleRegistry extends ",
-          "RuleRegistry",
-          "<infer TFieldMap> ? TFieldMap : never"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/server/types.ts",
-          "lineNumber": 98
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-server.RuleRegistryConfig",
-        "type": "Type",
-        "tags": [],
-        "label": "RuleRegistryConfig",
-        "description": [],
-        "signature": [
-          "{ readonly enabled: boolean; readonly unsafe: Readonly<{} & { write: Readonly<{} & { enabled: boolean; }>; }>; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/server/index.ts",
-          "lineNumber": 26
+          "path": "x-pack/plugins/rule_registry/server/index.ts",
+          "lineNumber": 28
         },
         "deprecated": false,
         "initialIsOpen": false
@@ -762,16 +711,33 @@
       "label": "RuleRegistryPluginSetupContract",
       "description": [],
       "signature": [
-        "RuleRegistry",
-        "<{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }>"
+        "RuleDataPluginService"
       ],
       "source": {
         "path": "x-pack/plugins/rule_registry/server/plugin.ts",
-        "lineNumber": 15
+        "lineNumber": 12
       },
       "deprecated": false,
       "lifecycle": "setup",
       "initialIsOpen": true
+    },
+    "start": {
+      "parentPluginId": "ruleRegistry",
+      "id": "def-server.RuleRegistryPluginStartContract",
+      "type": "Type",
+      "tags": [],
+      "label": "RuleRegistryPluginStartContract",
+      "description": [],
+      "signature": [
+        "void"
+      ],
+      "source": {
+        "path": "x-pack/plugins/rule_registry/server/plugin.ts",
+        "lineNumber": 13
+      },
+      "deprecated": false,
+      "lifecycle": "start",
+      "initialIsOpen": true
     }
   },
   "common": {
@@ -779,161 +745,35 @@
     "functions": [
       {
         "parentPluginId": "ruleRegistry",
-        "id": "def-common.mergeFieldMaps",
-        "type": "Function",
-        "tags": [],
-        "label": "mergeFieldMaps",
-        "description": [],
-        "signature": [
-          "(first: T1, second: T2) => T1 & T2"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/merge_field_maps.ts",
-          "lineNumber": 9
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-common.mergeFieldMaps.$1",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "first",
-            "description": [],
-            "signature": [
-              "T1"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/common/field_map/merge_field_maps.ts",
-              "lineNumber": 10
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-common.mergeFieldMaps.$2",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "second",
-            "description": [],
-            "signature": [
-              "T2"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/common/field_map/merge_field_maps.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.pickWithPatterns",
-        "type": "Function",
-        "tags": [],
-        "label": "pickWithPatterns",
-        "description": [],
-        "signature": [
-          "(map: T, patterns: TPatterns) => Pick<{ [TFieldName in keyof T]: ",
-          "SetIntersection",
-          "<",
-          "ValuesType",
-          "<TPatterns>, PatternMapOf<T>[TFieldName]> extends never ? never : T[TFieldName]; }, { [Key in keyof { [TFieldName in keyof T]: ",
-          "SetIntersection",
-          "<",
-          "ValuesType",
-          "<TPatterns>, PatternMapOf<T>[TFieldName]> extends never ? never : T[TFieldName]; }]-?: [{ [TFieldName in keyof T]: ",
-          "SetIntersection",
-          "<",
-          "ValuesType",
-          "<TPatterns>, PatternMapOf<T>[TFieldName]> extends never ? never : T[TFieldName]; }[Key]] extends [never] ? never : Key; }[keyof T]>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/pick_with_patterns/index.ts",
-          "lineNumber": 39
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-common.pickWithPatterns.$1",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "map",
-            "description": [],
-            "signature": [
-              "T"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/common/pick_with_patterns/index.ts",
-              "lineNumber": 42
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-common.pickWithPatterns.$2",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "patterns",
-            "description": [],
-            "signature": [
-              "TPatterns"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/common/pick_with_patterns/index.ts",
-              "lineNumber": 42
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.runtimeTypeFromFieldMap",
+        "id": "def-common.parseTechnicalFields",
         "type": "Function",
         "tags": [],
-        "label": "runtimeTypeFromFieldMap",
+        "label": "parseTechnicalFields",
         "description": [],
         "signature": [
-          "(fieldMap: TFieldMap) => ",
-          {
-            "pluginId": "ruleRegistry",
-            "scope": "common",
-            "docId": "kibRuleRegistryPluginApi",
-            "section": "def-common.FieldMapType",
-            "text": "FieldMapType"
-          },
-          "<TFieldMap>"
+          "(input: unknown) => OutputOf<",
+          "Optional",
+          "<{ readonly \"kibana.rac.alert.producer\": { readonly type: \"keyword\"; }; readonly \"kibana.rac.alert.uuid\": { readonly type: \"keyword\"; }; readonly \"kibana.rac.alert.id\": { readonly type: \"keyword\"; }; readonly \"kibana.rac.alert.start\": { readonly type: \"date\"; }; readonly \"kibana.rac.alert.end\": { readonly type: \"date\"; }; readonly \"kibana.rac.alert.duration.us\": { readonly type: \"long\"; }; readonly \"kibana.rac.alert.severity.level\": { readonly type: \"keyword\"; }; readonly \"kibana.rac.alert.severity.value\": { readonly type: \"long\"; }; readonly \"kibana.rac.alert.status\": { readonly type: \"keyword\"; }; readonly \"kibana.rac.alert.evaluation.threshold\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; }; readonly \"kibana.rac.alert.evaluation.value\": { readonly type: \"scaled_float\"; readonly scaling_factor: 100; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }, \"tags\" | \"kibana.rac.alert.uuid\" | \"event.kind\" | \"event.action\" | \"rule.uuid\" | \"rule.id\" | \"rule.name\" | \"rule.category\" | \"kibana.rac.alert.producer\" | \"kibana.rac.alert.id\" | \"kibana.rac.alert.start\" | \"kibana.rac.alert.end\" | \"kibana.rac.alert.duration.us\" | \"kibana.rac.alert.severity.level\" | \"kibana.rac.alert.severity.value\" | \"kibana.rac.alert.status\" | \"kibana.rac.alert.evaluation.threshold\" | \"kibana.rac.alert.evaluation.value\">>"
         ],
         "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts",
-          "lineNumber": 85
+          "path": "x-pack/plugins/rule_registry/common/parse_technical_fields.ts",
+          "lineNumber": 15
         },
         "deprecated": false,
         "children": [
           {
             "parentPluginId": "ruleRegistry",
-            "id": "def-common.runtimeTypeFromFieldMap.$1",
-            "type": "Uncategorized",
+            "id": "def-common.parseTechnicalFields.$1",
+            "type": "Unknown",
             "tags": [],
-            "label": "fieldMap",
+            "label": "input",
             "description": [],
             "signature": [
-              "TFieldMap"
+              "unknown"
             ],
             "source": {
-              "path": "x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts",
-              "lineNumber": 86
+              "path": "x-pack/plugins/rule_registry/common/parse_technical_fields.ts",
+              "lineNumber": 15
             },
             "deprecated": false,
             "isRequired": true
@@ -943,224 +783,9 @@
         "initialIsOpen": false
       }
     ],
-    "interfaces": [
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.FieldMap",
-        "type": "Interface",
-        "tags": [],
-        "label": "FieldMap",
-        "description": [],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/types.ts",
-          "lineNumber": 8
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "ruleRegistry",
-            "id": "def-common.FieldMap.Unnamed",
-            "type": "Any",
-            "tags": [],
-            "label": "Unnamed",
-            "description": [],
-            "signature": [
-              "any"
-            ],
-            "source": {
-              "path": "x-pack/plugins/rule_registry/common/field_map/types.ts",
-              "lineNumber": 9
-            },
-            "deprecated": false
-          }
-        ],
-        "initialIsOpen": false
-      }
-    ],
+    "interfaces": [],
     "enums": [],
-    "misc": [
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.BaseRuleFieldMap",
-        "type": "Type",
-        "tags": [],
-        "label": "BaseRuleFieldMap",
-        "description": [],
-        "signature": [
-          "{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/base_rule_field_map.ts",
-          "lineNumber": 33
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.EcsFieldMap",
-        "type": "Type",
-        "tags": [],
-        "label": "EcsFieldMap",
-        "description": [],
-        "signature": [
-          "{ readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly 'agent.build.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.ephemeral_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'client.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'client.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'client.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'cloud.account.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.account.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.availability_zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.instance.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.instance.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.machine.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.project.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.project.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.provider': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.region': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.image.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.image.tag': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'container.labels': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'container.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.runtime': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'destination.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'destination.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'dll.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers': { readonly type: \"object\"; readonly array: true; readonly required: false; }; readonly 'dns.answers.class': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.data': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.ttl': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.header_flags': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'dns.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.op_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.class': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.resolved_ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'dns.response_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'ecs.version': { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly 'error.code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.message': { readonly type: \"text\"; readonly array: false; readonly required: false; }; readonly 'error.stack_trace': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.category': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.created': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.dataset': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.duration': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.end': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.ingested': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.module': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.outcome': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.provider': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.reason': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.risk_score': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'event.risk_score_norm': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'event.sequence': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.severity': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.timezone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.type': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.url': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.accessed': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.attributes': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.created': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.ctime': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.device': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.drive_letter': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.extension': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.gid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.group': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.inode': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mode': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mtime': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.owner': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.target_path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.uid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'host.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.hostname': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'host.mac': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'host.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'http.request.body.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.request.body.content': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.request.method': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.referrer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.body.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.response.body.content': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.response.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.status_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly labels: { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'log.file.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.level': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.logger': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.origin.file.line': { readonly type: \"integer\"; readonly array: false; readonly required: false; }; readonly 'log.origin.file.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.origin.function': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.syslog': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.facility.code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.facility.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.priority': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.severity.code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.severity.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly message: { readonly type: \"text\"; readonly array: false; readonly required: false; }; readonly 'network.application': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'network.community_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.direction': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.forwarded_ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'network.iana_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.inner': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'network.inner.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.inner.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'network.protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.transport': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.alias': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.hostname': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.alias': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'observer.mac': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'observer.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.vendor': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'organization.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.build_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.checksum': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.install_scope': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.installed': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'package.license': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'package.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.args': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'process.args_count': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.command_line': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.entity_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.executable': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.exit_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.args': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'process.parent.args_count': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.command_line': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.entity_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.executable': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.exit_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pgid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.ppid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'process.parent.thread.id': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.thread.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.title': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.working_directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pgid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.pid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.ppid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'process.thread.id': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.thread.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.title': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.working_directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.data.bytes': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.data.strings': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'registry.data.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.hive': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.key': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.value': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'related.hash': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'related.hosts': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'related.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'related.user': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'rule.author': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.license': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.ruleset': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'server.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'server.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'server.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'service.ephemeral_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.node.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.state': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'source.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'source.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'source.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'span.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.framework': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'threat.tactic.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.tactic.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.tactic.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.cipher': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.certificate': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.certificate_chain': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.issuer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.ja3': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.server_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.subject': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.supported_ciphers': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.established': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'tls.next_protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.resumed': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'tls.server.certificate': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.certificate_chain': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.issuer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.ja3s': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.subject': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.version_protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'trace.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'transaction.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.extension': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.fragment': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.password': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'url.query': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.scheme': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.username': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.target.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user_agent.device.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.category': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'vulnerability.classification': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.enumeration': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.report_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.scanner.vendor': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.base': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.environmental': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.temporal': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.severity': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/ecs_field_map.ts",
-          "lineNumber": 3380
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.FieldMapType",
-        "type": "Type",
-        "tags": [],
-        "label": "FieldMapType",
-        "description": [],
-        "signature": [
-          "Type",
-          "<TypeOf<",
-          "Optional",
-          "<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>>, OutputOf<",
-          "Optional",
-          "<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>>, unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts",
-          "lineNumber": 83
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.OutputOfFieldMap",
-        "type": "Type",
-        "tags": [],
-        "label": "OutputOfFieldMap",
-        "description": [],
-        "signature": [
-          "{ [key in keyof ",
-          "Optional",
-          "<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>]: OutputOfField<Exclude<",
-          "Optional",
-          "<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>[key], undefined>>; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts",
-          "lineNumber": 81
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.PatternsUnionOf",
-        "type": "Type",
-        "tags": [],
-        "label": "PatternsUnionOf",
-        "description": [],
-        "signature": [
-          "\"*\" | ",
-          "ValuesType",
-          "<PatternMapOf<T>>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/pick_with_patterns/index.ts",
-          "lineNumber": 37
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.PickWithPatterns",
-        "type": "Type",
-        "tags": [],
-        "label": "PickWithPatterns",
-        "description": [],
-        "signature": [
-          "{ [P in { [Key in keyof { [TFieldName in keyof T]: ",
-          "SetIntersection",
-          "<",
-          "ValuesType",
-          "<TPatterns>, PatternMapOf<T>[TFieldName]> extends never ? never : T[TFieldName]; }]-?: [{ [TFieldName in keyof T]: ",
-          "SetIntersection",
-          "<",
-          "ValuesType",
-          "<TPatterns>, PatternMapOf<T>[TFieldName]> extends never ? never : T[TFieldName]; }[Key]] extends [never] ? never : Key; }[keyof T]]: { [TFieldName in keyof T]: ",
-          "SetIntersection",
-          "<",
-          "ValuesType",
-          "<TPatterns>, PatternMapOf<T>[TFieldName]> extends never ? never : T[TFieldName]; }[P]; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/pick_with_patterns/index.ts",
-          "lineNumber": 22
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.TypeOfFieldMap",
-        "type": "Type",
-        "tags": [],
-        "label": "TypeOfFieldMap",
-        "description": [],
-        "signature": [
-          "{ [key in keyof ",
-          "Optional",
-          "<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>]: TypeOfField<Exclude<",
-          "Optional",
-          "<T, { [key in keyof T]: T[key][\"required\"] extends true ? never : key; }[keyof T]>[key], undefined>>; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts",
-          "lineNumber": 80
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      }
-    ],
-    "objects": [
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.baseRuleFieldMap",
-        "type": "Object",
-        "tags": [],
-        "label": "baseRuleFieldMap",
-        "description": [],
-        "signature": [
-          "{ readonly 'kibana.rac.producer': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.uuid': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.id': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.start': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.end': { readonly type: \"date\"; }; readonly 'kibana.rac.alert.duration.us': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.severity.level': { readonly type: \"keyword\"; }; readonly 'kibana.rac.alert.severity.value': { readonly type: \"long\"; }; readonly 'kibana.rac.alert.status': { readonly type: \"keyword\"; }; readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/base_rule_field_map.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "ruleRegistry",
-        "id": "def-common.ecsFieldMap",
-        "type": "Object",
-        "tags": [],
-        "label": "ecsFieldMap",
-        "description": [],
-        "signature": [
-          "{ readonly '@timestamp': { readonly type: \"date\"; readonly array: false; readonly required: true; }; readonly 'agent.build.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.ephemeral_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'agent.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'client.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'client.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'client.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'client.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'client.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'cloud.account.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.account.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.availability_zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.instance.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.instance.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.machine.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.project.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.project.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.provider': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'cloud.region': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.image.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.image.tag': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'container.labels': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'container.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'container.runtime': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'destination.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'destination.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'destination.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'destination.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'dll.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dll.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers': { readonly type: \"object\"; readonly array: true; readonly required: false; }; readonly 'dns.answers.class': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.data': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.ttl': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'dns.answers.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.header_flags': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'dns.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.op_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.class': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.question.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.resolved_ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'dns.response_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'dns.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'ecs.version': { readonly type: \"keyword\"; readonly array: false; readonly required: true; }; readonly 'error.code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.message': { readonly type: \"text\"; readonly array: false; readonly required: false; }; readonly 'error.stack_trace': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'error.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.action': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.category': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.created': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.dataset': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.duration': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.end': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.ingested': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.kind': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.module': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.outcome': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.provider': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.reason': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.risk_score': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'event.risk_score_norm': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'event.sequence': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.severity': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'event.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'event.timezone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'event.type': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'event.url': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.accessed': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.attributes': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'file.created': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.ctime': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.device': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.drive_letter': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.extension': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.gid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.group': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.inode': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mode': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.mtime': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.owner': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.target_path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.uid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'file.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'file.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'file.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'host.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.hostname': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'host.mac': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'host.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'host.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'host.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'http.request.body.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.request.body.content': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.request.method': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.request.referrer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.body.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.response.body.content': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.response.mime_type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'http.response.status_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'http.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly labels: { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'log.file.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.level': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.logger': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.origin.file.line': { readonly type: \"integer\"; readonly array: false; readonly required: false; }; readonly 'log.origin.file.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.origin.function': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.syslog': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.facility.code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.facility.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.priority': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.severity.code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'log.syslog.severity.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly message: { readonly type: \"text\"; readonly array: false; readonly required: false; }; readonly 'network.application': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'network.community_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.direction': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.forwarded_ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'network.iana_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.inner': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'network.inner.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.inner.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'network.protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.transport': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'network.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.alias': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.interface.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.egress.zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.hostname': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress': { readonly type: \"object\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.alias': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.interface.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.vlan.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.vlan.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ingress.zone': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'observer.mac': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'observer.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.vendor': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'observer.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'organization.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.build_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.checksum': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.install_scope': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.installed': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'package.license': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'package.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'package.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.args': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'process.args_count': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.command_line': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.entity_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.executable': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.exit_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.args': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'process.parent.args_count': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.exists': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.status': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.subject_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.trusted': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.code_signature.valid': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'process.parent.command_line': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.entity_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.executable': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.exit_code': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.hash.sha512': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pgid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.pid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.ppid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'process.parent.thread.id': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.thread.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.title': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.parent.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.parent.working_directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.architecture': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.company': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.file_version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.imphash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.original_file_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pe.product': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.pgid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.pid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.ppid': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.start': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'process.thread.id': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.thread.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.title': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'process.uptime': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'process.working_directory': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.data.bytes': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.data.strings': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'registry.data.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.hive': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.key': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'registry.value': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'related.hash': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'related.hosts': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'related.ip': { readonly type: \"ip\"; readonly array: true; readonly required: false; }; readonly 'related.user': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'rule.author': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'rule.category': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.license': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.ruleset': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.uuid': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'rule.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'server.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'server.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'server.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'server.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'server.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'service.ephemeral_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.node.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.state': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'service.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.address': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.as.number': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.as.organization.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.bytes': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.city_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.continent_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.country_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.country_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.location': { readonly type: \"geo_point\"; readonly array: false; readonly required: false; }; readonly 'source.geo.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.region_iso_code': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.geo.region_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'source.mac': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.nat.ip': { readonly type: \"ip\"; readonly array: false; readonly required: false; }; readonly 'source.nat.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.packets': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'source.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'source.user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'span.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly tags: { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.framework': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'threat.tactic.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.tactic.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.tactic.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.id': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'threat.technique.subtechnique.reference': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.cipher': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.certificate': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.certificate_chain': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.issuer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.ja3': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.server_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.subject': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.supported_ciphers': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.client.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.client.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.established': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'tls.next_protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.resumed': { readonly type: \"boolean\"; readonly array: false; readonly required: false; }; readonly 'tls.server.certificate': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.certificate_chain': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.hash.md5': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.hash.sha1': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.hash.sha256': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.issuer': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.ja3s': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.subject': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.alternative_names': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.issuer.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.issuer.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.not_after': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.not_before': { readonly type: \"date\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_curve': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_exponent': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.public_key_size': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.serial_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.signature_algorithm': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.subject.common_name': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.country': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.distinguished_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.server.x509.subject.locality': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.organization': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.organizational_unit': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.subject.state_or_province': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'tls.server.x509.version_number': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'tls.version_protocol': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'trace.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'transaction.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.extension': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.fragment': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.password': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.path': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.port': { readonly type: \"long\"; readonly array: false; readonly required: false; }; readonly 'url.query': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.registered_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.scheme': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.subdomain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.top_level_domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'url.username': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.changes.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.effective.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user.target.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.email': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.full_name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.domain': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.group.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.hash': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user.target.roles': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'user_agent.device.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.original': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.family': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.full': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.kernel': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.name': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.platform': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.type': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.os.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'user_agent.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.category': { readonly type: \"keyword\"; readonly array: true; readonly required: false; }; readonly 'vulnerability.classification': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.description': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.enumeration': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.reference': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.report_id': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.scanner.vendor': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.base': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.environmental': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.temporal': { readonly type: \"float\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.score.version': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; readonly 'vulnerability.severity': { readonly type: \"keyword\"; readonly array: false; readonly required: false; }; }"
-        ],
-        "source": {
-          "path": "x-pack/plugins/rule_registry/common/field_map/ecs_field_map.ts",
-          "lineNumber": 12
-        },
-        "deprecated": false,
-        "initialIsOpen": false
-      }
-    ]
+    "misc": [],
+    "objects": []
   }
 }
\ No newline at end of file
diff --git a/api_docs/rule_registry.mdx b/api_docs/rule_registry.mdx
index 450b2f3ee5d615..964d29594d3c66 100644
--- a/api_docs/rule_registry.mdx
+++ b/api_docs/rule_registry.mdx
@@ -11,25 +11,20 @@ warning: This document is auto-generated and is meant to be viewed inside our ex
 
 import ruleRegistryObj from './rule_registry.json';
 
-## Client
-
-### Classes
-<DocDefinitionList data={ruleRegistryObj.client.classes}/>
-
-### Interfaces
-<DocDefinitionList data={ruleRegistryObj.client.interfaces}/>
-
-### Consts, variables and types
-<DocDefinitionList data={ruleRegistryObj.client.misc}/>
-
 ## Server
 
 ### Setup
 <DocDefinitionList data={[ruleRegistryObj.server.setup]}/>
 
+### Start
+<DocDefinitionList data={[ruleRegistryObj.server.start]}/>
+
 ### Functions
 <DocDefinitionList data={ruleRegistryObj.server.functions}/>
 
+### Classes
+<DocDefinitionList data={ruleRegistryObj.server.classes}/>
+
 ### Interfaces
 <DocDefinitionList data={ruleRegistryObj.server.interfaces}/>
 
@@ -38,15 +33,6 @@ import ruleRegistryObj from './rule_registry.json';
 
 ## Common
 
-### Objects
-<DocDefinitionList data={ruleRegistryObj.common.objects}/>
-
 ### Functions
 <DocDefinitionList data={ruleRegistryObj.common.functions}/>
 
-### Interfaces
-<DocDefinitionList data={ruleRegistryObj.common.interfaces}/>
-
-### Consts, variables and types
-<DocDefinitionList data={ruleRegistryObj.common.misc}/>
-
diff --git a/api_docs/security.json b/api_docs/security.json
index 89f0110e5325f0..f9900e084e5070 100644
--- a/api_docs/security.json
+++ b/api_docs/security.json
@@ -513,7 +513,7 @@
         "{ authc: ",
         "AuthenticationServiceSetup",
         "; sessionTimeout: ",
-        "ISessionTimeout",
+        "SessionTimeout",
         "; license: Readonly<{ isLicenseAvailable: () => boolean; isEnabled: () => boolean; getType: () => \"basic\" | \"standard\" | \"gold\" | \"platinum\" | \"enterprise\" | \"trial\" | undefined; getFeatures: () => ",
         "SecurityLicenseFeatures",
         "; features$: ",
@@ -524,7 +524,7 @@
       ],
       "source": {
         "path": "x-pack/plugins/security/public/plugin.tsx",
-        "lineNumber": 171
+        "lineNumber": 164
       },
       "deprecated": false,
       "lifecycle": "setup",
@@ -546,7 +546,7 @@
       ],
       "source": {
         "path": "x-pack/plugins/security/public/plugin.tsx",
-        "lineNumber": 172
+        "lineNumber": 165
       },
       "deprecated": false,
       "lifecycle": "start",
@@ -1570,6 +1570,31 @@
     ],
     "enums": [],
     "misc": [
+      {
+        "parentPluginId": "security",
+        "id": "def-server.AuthorizationServiceSetup",
+        "type": "Type",
+        "tags": [],
+        "label": "AuthorizationServiceSetup",
+        "description": [],
+        "signature": [
+          "{ mode: ",
+          "AuthorizationMode",
+          "; actions: ",
+          "Actions",
+          "; checkPrivilegesDynamicallyWithRequest: ",
+          "CheckPrivilegesDynamicallyWithRequest",
+          "; checkPrivilegesWithRequest: ",
+          "CheckPrivilegesWithRequest",
+          "; }"
+        ],
+        "source": {
+          "path": "x-pack/plugins/security/server/index.ts",
+          "lineNumber": 30
+        },
+        "deprecated": false,
+        "initialIsOpen": false
+      },
       {
         "parentPluginId": "security",
         "id": "def-server.ROUTE_TAG_CAN_REDIRECT",
diff --git a/api_docs/security_solution.json b/api_docs/security_solution.json
index 437fa4c9cbd090..c0bbb37bfd0dff 100644
--- a/api_docs/security_solution.json
+++ b/api_docs/security_solution.json
@@ -673,1205 +673,7 @@
         "initialIsOpen": false
       }
     ],
-    "functions": [
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.buildRouteValidation",
-        "type": "Function",
-        "tags": [],
-        "label": "buildRouteValidation",
-        "description": [],
-        "signature": [
-          "<T extends ",
-          "Mixed",
-          ", A = ",
-          "TypeOf",
-          "<T>>(schema: T) => ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.RouteValidationFunction",
-            "text": "RouteValidationFunction"
-          },
-          "<A>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/utils/build_validation/route_validation.ts",
-          "lineNumber": 30
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.buildRouteValidation.$1",
-            "type": "Uncategorized",
-            "tags": [],
-            "label": "schema",
-            "description": [],
-            "signature": [
-              "T"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/utils/build_validation/route_validation.ts",
-              "lineNumber": 31
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.buildSiemResponse",
-        "type": "Function",
-        "tags": [],
-        "label": "buildSiemResponse",
-        "description": [],
-        "signature": [
-          "(response: { custom: <T extends string | Record<string, any> | Error | { message: string | Error; attributes?: Record<string, any> | undefined; } | Buffer | ",
-          "Stream",
-          " | undefined>(options: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.CustomHttpResponseOptions",
-            "text": "CustomHttpResponseOptions"
-          },
-          "<T>) => ",
-          "KibanaResponse",
-          "<T>; badRequest: (options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ErrorHttpResponseOptions",
-            "text": "ErrorHttpResponseOptions"
-          },
-          ") => ",
-          "KibanaResponse",
-          "<",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ResponseError",
-            "text": "ResponseError"
-          },
-          ">; unauthorized: (options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ErrorHttpResponseOptions",
-            "text": "ErrorHttpResponseOptions"
-          },
-          ") => ",
-          "KibanaResponse",
-          "<",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ResponseError",
-            "text": "ResponseError"
-          },
-          ">; forbidden: (options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ErrorHttpResponseOptions",
-            "text": "ErrorHttpResponseOptions"
-          },
-          ") => ",
-          "KibanaResponse",
-          "<",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ResponseError",
-            "text": "ResponseError"
-          },
-          ">; notFound: (options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ErrorHttpResponseOptions",
-            "text": "ErrorHttpResponseOptions"
-          },
-          ") => ",
-          "KibanaResponse",
-          "<",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ResponseError",
-            "text": "ResponseError"
-          },
-          ">; conflict: (options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ErrorHttpResponseOptions",
-            "text": "ErrorHttpResponseOptions"
-          },
-          ") => ",
-          "KibanaResponse",
-          "<",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ResponseError",
-            "text": "ResponseError"
-          },
-          ">; customError: (options: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.CustomHttpResponseOptions",
-            "text": "CustomHttpResponseOptions"
-          },
-          "<",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ResponseError",
-            "text": "ResponseError"
-          },
-          ">) => ",
-          "KibanaResponse",
-          "<",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.ResponseError",
-            "text": "ResponseError"
-          },
-          ">; redirected: (options: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.RedirectResponseOptions",
-            "text": "RedirectResponseOptions"
-          },
-          ") => ",
-          "KibanaResponse",
-          "<string | Record<string, any> | Buffer | ",
-          "Stream",
-          ">; ok: (options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.HttpResponseOptions",
-            "text": "HttpResponseOptions"
-          },
-          ") => ",
-          "KibanaResponse",
-          "<string | Record<string, any> | Buffer | ",
-          "Stream",
-          ">; accepted: (options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.HttpResponseOptions",
-            "text": "HttpResponseOptions"
-          },
-          ") => ",
-          "KibanaResponse",
-          "<string | Record<string, any> | Buffer | ",
-          "Stream",
-          ">; noContent: (options?: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCoreHttpPluginApi",
-            "section": "def-server.HttpResponseOptions",
-            "text": "HttpResponseOptions"
-          },
-          ") => ",
-          "KibanaResponse",
-          "<undefined>; }) => ",
-          "SiemResponseFactory"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-          "lineNumber": 295
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.buildSiemResponse.$1",
-            "type": "Object",
-            "tags": [],
-            "label": "response",
-            "description": [],
-            "signature": [
-              "{ custom: <T extends string | Record<string, any> | Error | { message: string | Error; attributes?: Record<string, any> | undefined; } | Buffer | ",
-              "Stream",
-              " | undefined>(options: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.CustomHttpResponseOptions",
-                "text": "CustomHttpResponseOptions"
-              },
-              "<T>) => ",
-              "KibanaResponse",
-              "<T>; badRequest: (options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ErrorHttpResponseOptions",
-                "text": "ErrorHttpResponseOptions"
-              },
-              ") => ",
-              "KibanaResponse",
-              "<",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ResponseError",
-                "text": "ResponseError"
-              },
-              ">; unauthorized: (options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ErrorHttpResponseOptions",
-                "text": "ErrorHttpResponseOptions"
-              },
-              ") => ",
-              "KibanaResponse",
-              "<",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ResponseError",
-                "text": "ResponseError"
-              },
-              ">; forbidden: (options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ErrorHttpResponseOptions",
-                "text": "ErrorHttpResponseOptions"
-              },
-              ") => ",
-              "KibanaResponse",
-              "<",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ResponseError",
-                "text": "ResponseError"
-              },
-              ">; notFound: (options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ErrorHttpResponseOptions",
-                "text": "ErrorHttpResponseOptions"
-              },
-              ") => ",
-              "KibanaResponse",
-              "<",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ResponseError",
-                "text": "ResponseError"
-              },
-              ">; conflict: (options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ErrorHttpResponseOptions",
-                "text": "ErrorHttpResponseOptions"
-              },
-              ") => ",
-              "KibanaResponse",
-              "<",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ResponseError",
-                "text": "ResponseError"
-              },
-              ">; customError: (options: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.CustomHttpResponseOptions",
-                "text": "CustomHttpResponseOptions"
-              },
-              "<",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ResponseError",
-                "text": "ResponseError"
-              },
-              ">) => ",
-              "KibanaResponse",
-              "<",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.ResponseError",
-                "text": "ResponseError"
-              },
-              ">; redirected: (options: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.RedirectResponseOptions",
-                "text": "RedirectResponseOptions"
-              },
-              ") => ",
-              "KibanaResponse",
-              "<string | Record<string, any> | Buffer | ",
-              "Stream",
-              ">; ok: (options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.HttpResponseOptions",
-                "text": "HttpResponseOptions"
-              },
-              ") => ",
-              "KibanaResponse",
-              "<string | Record<string, any> | Buffer | ",
-              "Stream",
-              ">; accepted: (options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.HttpResponseOptions",
-                "text": "HttpResponseOptions"
-              },
-              ") => ",
-              "KibanaResponse",
-              "<string | Record<string, any> | Buffer | ",
-              "Stream",
-              ">; noContent: (options?: ",
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCoreHttpPluginApi",
-                "section": "def-server.HttpResponseOptions",
-                "text": "HttpResponseOptions"
-              },
-              ") => ",
-              "KibanaResponse",
-              "<undefined>; }"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-              "lineNumber": 295
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.createBootstrapIndex",
-        "type": "Function",
-        "tags": [],
-        "label": "createBootstrapIndex",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", index: string) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/create_bootstrap_index.ts",
-          "lineNumber": 13
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.createBootstrapIndex.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/create_bootstrap_index.ts",
-              "lineNumber": 14
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.createBootstrapIndex.$2",
-            "type": "string",
-            "tags": [],
-            "label": "index",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/create_bootstrap_index.ts",
-              "lineNumber": 15
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.deleteAllIndex",
-        "type": "Function",
-        "tags": [],
-        "label": "deleteAllIndex",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", pattern: string, maxAttempts?: number) => Promise<boolean>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_all_index.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deleteAllIndex.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_all_index.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deleteAllIndex.$2",
-            "type": "string",
-            "tags": [],
-            "label": "pattern",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_all_index.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deleteAllIndex.$3",
-            "type": "number",
-            "tags": [],
-            "label": "maxAttempts",
-            "description": [],
-            "signature": [
-              "number"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_all_index.ts",
-              "lineNumber": 13
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.deletePolicy",
-        "type": "Function",
-        "tags": [],
-        "label": "deletePolicy",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", policy: string) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_policy.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deletePolicy.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_policy.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deletePolicy.$2",
-            "type": "string",
-            "tags": [],
-            "label": "policy",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_policy.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.deleteTemplate",
-        "type": "Function",
-        "tags": [],
-        "label": "deleteTemplate",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", name: string) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_template.ts",
-          "lineNumber": 9
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deleteTemplate.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_template.ts",
-              "lineNumber": 10
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.deleteTemplate.$2",
-            "type": "string",
-            "tags": [],
-            "label": "name",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/delete_template.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.getIndexExists",
-        "type": "Function",
-        "tags": [],
-        "label": "getIndexExists",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", index: string) => Promise<boolean>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_index_exists.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getIndexExists.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_index_exists.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getIndexExists.$2",
-            "type": "string",
-            "tags": [],
-            "label": "index",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_index_exists.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.getPolicyExists",
-        "type": "Function",
-        "tags": [],
-        "label": "getPolicyExists",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", policy: string) => Promise<boolean>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_policy_exists.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getPolicyExists.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_policy_exists.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getPolicyExists.$2",
-            "type": "string",
-            "tags": [],
-            "label": "policy",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_policy_exists.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.getTemplateExists",
-        "type": "Function",
-        "tags": [],
-        "label": "getTemplateExists",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", template: string) => Promise<boolean>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_template_exists.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getTemplateExists.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_template_exists.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.getTemplateExists.$2",
-            "type": "string",
-            "tags": [],
-            "label": "template",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/get_template_exists.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.readPrivileges",
-        "type": "Function",
-        "tags": [],
-        "label": "readPrivileges",
-        "description": [],
-        "signature": [
-          "(callWithRequest: ",
-          "CallWithRequest",
-          "<{}, unknown>, index: string) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/privileges/read_privileges.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.readPrivileges.$1",
-            "type": "Function",
-            "tags": [],
-            "label": "callWithRequest",
-            "description": [],
-            "signature": [
-              "CallWithRequest",
-              "<{}, unknown>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/privileges/read_privileges.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.readPrivileges.$2",
-            "type": "string",
-            "tags": [],
-            "label": "index",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/privileges/read_privileges.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.setPolicy",
-        "type": "Function",
-        "tags": [],
-        "label": "setPolicy",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", policy: string, body: Record<string, unknown>) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_policy.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setPolicy.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_policy.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setPolicy.$2",
-            "type": "string",
-            "tags": [],
-            "label": "policy",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_policy.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setPolicy.$3",
-            "type": "Object",
-            "tags": [],
-            "label": "body",
-            "description": [],
-            "signature": [
-              "Record<string, unknown>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_policy.ts",
-              "lineNumber": 13
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.setTemplate",
-        "type": "Function",
-        "tags": [],
-        "label": "setTemplate",
-        "description": [],
-        "signature": [
-          "(esClient: ",
-          {
-            "pluginId": "core",
-            "scope": "server",
-            "docId": "kibCorePluginApi",
-            "section": "def-server.ElasticsearchClient",
-            "text": "ElasticsearchClient"
-          },
-          ", name: string, body: Record<string, unknown>) => Promise<unknown>"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_template.ts",
-          "lineNumber": 10
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setTemplate.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "esClient",
-            "description": [],
-            "signature": [
-              {
-                "pluginId": "core",
-                "scope": "server",
-                "docId": "kibCorePluginApi",
-                "section": "def-server.ElasticsearchClient",
-                "text": "ElasticsearchClient"
-              }
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_template.ts",
-              "lineNumber": 11
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setTemplate.$2",
-            "type": "string",
-            "tags": [],
-            "label": "name",
-            "description": [],
-            "signature": [
-              "string"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_template.ts",
-              "lineNumber": 12
-            },
-            "deprecated": false,
-            "isRequired": true
-          },
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.setTemplate.$3",
-            "type": "Object",
-            "tags": [],
-            "label": "body",
-            "description": [],
-            "signature": [
-              "Record<string, unknown>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/index/set_template.ts",
-              "lineNumber": 13
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      },
-      {
-        "parentPluginId": "securitySolution",
-        "id": "def-server.transformError",
-        "type": "Function",
-        "tags": [],
-        "label": "transformError",
-        "description": [],
-        "signature": [
-          "(err: Error & Partial<",
-          "ResponseError",
-          "<Record<string, any>, unknown>>) => ",
-          "OutputError"
-        ],
-        "source": {
-          "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-          "lineNumber": 28
-        },
-        "deprecated": false,
-        "children": [
-          {
-            "parentPluginId": "securitySolution",
-            "id": "def-server.transformError.$1",
-            "type": "CompoundType",
-            "tags": [],
-            "label": "err",
-            "description": [],
-            "signature": [
-              "Error & Partial<",
-              "ResponseError",
-              "<Record<string, any>, unknown>>"
-            ],
-            "source": {
-              "path": "x-pack/plugins/security_solution/server/lib/detection_engine/routes/utils.ts",
-              "lineNumber": 28
-            },
-            "deprecated": false,
-            "isRequired": true
-          }
-        ],
-        "returnComment": [],
-        "initialIsOpen": false
-      }
-    ],
+    "functions": [],
     "interfaces": [
       {
         "parentPluginId": "securitySolution",
@@ -2194,15 +996,7 @@
           "lineNumber": 14
         },
         "deprecated": true,
-        "references": [
-          {
-            "plugin": "lists",
-            "link": {
-              "path": "x-pack/plugins/lists/server/siem_server_deps.ts",
-              "lineNumber": 24
-            }
-          }
-        ],
+        "references": [],
         "children": [
           {
             "parentPluginId": "securitySolution",
diff --git a/api_docs/security_solution.mdx b/api_docs/security_solution.mdx
index 397b2d52385968..4cd726b97bbc7d 100644
--- a/api_docs/security_solution.mdx
+++ b/api_docs/security_solution.mdx
@@ -27,9 +27,6 @@ import securitySolutionObj from './security_solution.json';
 ### Start
 <DocDefinitionList data={[securitySolutionObj.server.start]}/>
 
-### Functions
-<DocDefinitionList data={securitySolutionObj.server.functions}/>
-
 ### Classes
 <DocDefinitionList data={securitySolutionObj.server.classes}/>