From f9afe67f1e554cf3b295c4c43bf2b3f68c103120 Mon Sep 17 00:00:00 2001
From: Andrew Goldstein <andrew-goldstein@users.noreply.github.com>
Date: Tue, 19 Oct 2021 04:10:14 -0600
Subject: [PATCH 01/10] [Security Solution] Improves the formatting of array
 values and JSON in the Event and Alert Details panels (#115141)

## [Security Solution] Improves the formatting of array values and JSON in the Event and Alert Details panels

This PR improves the formatting of array values and JSON in the Event and Alert details panels by:

- in the `Table` tab, formatting array values such that each value appears on a separate line, (instead of joining the values on a single line)
- in the `JSON` tab, displaying the raw search hit JSON, instead displaying a JSON representation based on the `Fields` API

### Table value formatting

In the Event and Alert details `Table` tab, array values were joined on a single line, as shown in the _before_ screenshot below:

![event-details-value-formatting-before](https://user-images.githubusercontent.com/4459398/137524968-6450cd73-3154-457d-b850-32a3e7faaab2.png)

_Above: (before) array values were joined on a single line_

Array values are now formatted such that each value appears on a separate line, as shown in the _after_ screenshot below:

![event-details-value-formatting-after](https://user-images.githubusercontent.com/4459398/137436705-b0bec735-5a83-402e-843a-2776e1c80da9.png)

_Above: (after) array values each appear on a separte line_

### JSON formatting

The `JSON` tab previously displayed a JSON representation based on the `Fields` API. Array values were previously represented as a joined string, as shown in the _before_ screenshot below:

![event-details-json-formatting-before](https://user-images.githubusercontent.com/4459398/137525039-d1b14f21-5f9c-4201-905e-8b08f00bb5a0.png)

_Above: (before) array values were previously represented as a joined string_

The `JSON` tab now displays the raw search hit JSON, per the _after_ screenshot below:

![event-details-json-formatting-after](https://user-images.githubusercontent.com/4459398/137437257-330c5b49-a4ad-418e-a976-923f7a35c0cf.png)

_Above: (after) the `JSON` tab displays the raw search hit_

CC @monina-n @paulewing
---
 .../detection_alerts/alerts_details.spec.ts   |  20 +-
 .../detection_alerts/cti_enrichments.spec.ts  |  49 ++-
 .../cypress/screens/alerts_details.ts         |   2 +
 .../alert_summary_view.test.tsx.snap          | 120 ++++--
 .../__snapshots__/json_view.test.tsx.snap     | 343 ++++++++++++++++--
 .../event_details/event_details.test.tsx      |   3 +-
 .../event_details/event_details.tsx           |   6 +-
 .../event_details/json_view.test.tsx          |  49 +--
 .../components/event_details/json_view.tsx    |  23 +-
 .../table/field_value_cell.test.tsx           | 193 ++++++++++
 .../event_details/table/field_value_cell.tsx  |  26 +-
 .../public/common/mock/mock_detail_item.ts    | 188 ++++++++++
 .../event_details/expandable_event.tsx        |   3 +
 .../side_panel/event_details/index.tsx        |   4 +-
 .../timelines/containers/details/index.tsx    |   7 +-
 .../timeline/events/details/index.ts          |   1 +
 .../timeline/factory/events/details/index.ts  |   4 +
 17 files changed, 872 insertions(+), 169 deletions(-)
 create mode 100644 x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx

diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
index 674114188632b5..7b792f8d560f1a 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/alerts_details.spec.ts
@@ -5,14 +5,14 @@
  * 2.0.
  */
 
-import { ALERT_FLYOUT, CELL_TEXT, JSON_LINES, TABLE_ROWS } from '../../screens/alerts_details';
+import { ALERT_FLYOUT, CELL_TEXT, JSON_TEXT, TABLE_ROWS } from '../../screens/alerts_details';
 
 import {
   expandFirstAlert,
   waitForAlertsIndexToBeCreated,
   waitForAlertsPanelToBeLoaded,
 } from '../../tasks/alerts';
-import { openJsonView, openTable, scrollJsonViewToBottom } from '../../tasks/alerts_details';
+import { openJsonView, openTable } from '../../tasks/alerts_details';
 import { createCustomRuleActivated } from '../../tasks/api_calls/rules';
 import { cleanKibana } from '../../tasks/common';
 import { esArchiverLoad } from '../../tasks/es_archiver';
@@ -36,20 +36,14 @@ describe('Alert details with unmapped fields', () => {
   });
 
   it('Displays the unmapped field on the JSON view', () => {
-    const expectedUnmappedField = { line: 2, text: '  "unmapped": "This is the unmapped field"' };
+    const expectedUnmappedValue = 'This is the unmapped field';
 
     openJsonView();
-    scrollJsonViewToBottom();
 
-    cy.get(ALERT_FLYOUT)
-      .find(JSON_LINES)
-      .then((elements) => {
-        const length = elements.length;
-        cy.wrap(elements)
-          .eq(length - expectedUnmappedField.line)
-          .invoke('text')
-          .should('include', expectedUnmappedField.text);
-      });
+    cy.get(JSON_TEXT).then((x) => {
+      const parsed = JSON.parse(x.text());
+      expect(parsed._source.unmapped).to.equal(expectedUnmappedValue);
+    });
   });
 
   it('Displays the unmapped field on the table', () => {
diff --git a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
index b3c6abcd8e4266..f15e7adbbca440 100644
--- a/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/detection_alerts/cti_enrichments.spec.ts
@@ -10,7 +10,7 @@ import { cleanKibana, reload } from '../../tasks/common';
 import { esArchiverLoad, esArchiverUnload } from '../../tasks/es_archiver';
 import { loginAndWaitForPageWithoutDateRange } from '../../tasks/login';
 import {
-  JSON_LINES,
+  JSON_TEXT,
   TABLE_CELL,
   TABLE_ROWS,
   THREAT_DETAILS_VIEW,
@@ -28,11 +28,7 @@ import {
   viewThreatIntelTab,
 } from '../../tasks/alerts';
 import { createCustomIndicatorRule } from '../../tasks/api_calls/rules';
-import {
-  openJsonView,
-  openThreatIndicatorDetails,
-  scrollJsonViewToBottom,
-} from '../../tasks/alerts_details';
+import { openJsonView, openThreatIndicatorDetails } from '../../tasks/alerts_details';
 
 import { ALERTS_URL } from '../../urls/navigation';
 import { addsFieldsToTimeline } from '../../tasks/rule_details';
@@ -76,26 +72,39 @@ describe('CTI Enrichment', () => {
 
   it('Displays persisted enrichments on the JSON view', () => {
     const expectedEnrichment = [
-      { line: 4, text: '  "threat": {' },
       {
-        line: 3,
-        text: '    "enrichments": "{\\"indicator\\":{\\"first_seen\\":\\"2021-03-10T08:02:14.000Z\\",\\"file\\":{\\"size\\":80280,\\"pe\\":{},\\"type\\":\\"elf\\",\\"hash\\":{\\"sha256\\":\\"a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3\\",\\"tlsh\\":\\"6D7312E017B517CC1371A8353BED205E9128223972AE35302E97528DF957703BAB2DBE\\",\\"ssdeep\\":\\"1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL\\",\\"md5\\":\\"9b6c3518a91d23ed77504b5416bfb5b3\\"}},\\"type\\":\\"file\\"},\\"matched\\":{\\"atomic\\":\\"a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3\\",\\"field\\":\\"myhash.mysha256\\",\\"id\\":\\"84cf452c1e0375c3d4412cb550bd1783358468a3b3b777da4829d72c7d6fb74f\\",\\"index\\":\\"logs-ti_abusech.malware\\",\\"type\\":\\"indicator_match_rule\\"}}"',
+        indicator: {
+          first_seen: '2021-03-10T08:02:14.000Z',
+          file: {
+            size: 80280,
+            pe: {},
+            type: 'elf',
+            hash: {
+              sha256: 'a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3',
+              tlsh: '6D7312E017B517CC1371A8353BED205E9128223972AE35302E97528DF957703BAB2DBE',
+              ssdeep:
+                '1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL',
+              md5: '9b6c3518a91d23ed77504b5416bfb5b3',
+            },
+          },
+          type: 'file',
+        },
+        matched: {
+          atomic: 'a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3',
+          field: 'myhash.mysha256',
+          id: '84cf452c1e0375c3d4412cb550bd1783358468a3b3b777da4829d72c7d6fb74f',
+          index: 'logs-ti_abusech.malware',
+          type: 'indicator_match_rule',
+        },
       },
-      { line: 2, text: '  }' },
     ];
 
     expandFirstAlert();
     openJsonView();
-    scrollJsonViewToBottom();
-
-    cy.get(JSON_LINES).then((elements) => {
-      const length = elements.length;
-      expectedEnrichment.forEach((enrichment) => {
-        cy.wrap(elements)
-          .eq(length - enrichment.line)
-          .invoke('text')
-          .should('include', enrichment.text);
-      });
+
+    cy.get(JSON_TEXT).then((x) => {
+      const parsed = JSON.parse(x.text());
+      expect(parsed._source.threat.enrichments).to.deep.equal(expectedEnrichment);
     });
   });
 
diff --git a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
index c740a669d059a8..584fba05452f05 100644
--- a/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
+++ b/x-pack/plugins/security_solution/cypress/screens/alerts_details.ts
@@ -28,6 +28,8 @@ export const JSON_LINES = '.euiCodeBlock__line';
 
 export const JSON_VIEW_TAB = '[data-test-subj="jsonViewTab"]';
 
+export const JSON_TEXT = '[data-test-subj="jsonView"]';
+
 export const TABLE_CELL = '.euiTableRowCell';
 
 export const TABLE_TAB = '[data-test-subj="tableTab"]';
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
index d367c68586be1b..930e1282ebca50 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/alert_summary_view.test.tsx.snap
@@ -138,12 +138,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.status"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  open
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    open
+                  </div>
                 </div>
               </div>
               <div
@@ -204,10 +209,11 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-@timestamp"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor eui-textTruncate eui-alignMiddle"
@@ -274,12 +280,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  xxx
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    xxx
+                  </div>
                 </div>
               </div>
               <div
@@ -340,12 +351,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.severity"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  low
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    low
+                  </div>
                 </div>
               </div>
               <div
@@ -406,12 +422,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.risk_score"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  21
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    21
+                  </div>
                 </div>
               </div>
               <div
@@ -472,12 +493,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-host.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  windows-native
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    windows-native
+                  </div>
                 </div>
               </div>
               <div
@@ -538,12 +564,17 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-user.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  administrator
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    administrator
+                  </div>
                 </div>
               </div>
               <div
@@ -604,10 +635,11 @@ exports[`AlertSummaryView Behavior event code renders additional summary rows 1`
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-source.ip"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor"
@@ -800,12 +832,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.status"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  open
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    open
+                  </div>
                 </div>
               </div>
               <div
@@ -866,10 +903,11 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-@timestamp"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor eui-textTruncate eui-alignMiddle"
@@ -936,12 +974,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  xxx
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    xxx
+                  </div>
                 </div>
               </div>
               <div
@@ -1002,12 +1045,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.severity"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  low
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    low
+                  </div>
                 </div>
               </div>
               <div
@@ -1068,12 +1116,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-signal.rule.risk_score"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  21
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    21
+                  </div>
                 </div>
               </div>
               <div
@@ -1134,12 +1187,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-host.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  windows-native
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    windows-native
+                  </div>
                 </div>
               </div>
               <div
@@ -1200,12 +1258,17 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-user.name"
               >
                 <div
-                  class="euiText euiText--extraSmall"
+                  class="euiFlexItem euiFlexItem--flexGrowZero"
                 >
-                  administrator
+                  <div
+                    class="euiText euiText--extraSmall"
+                  >
+                    administrator
+                  </div>
                 </div>
               </div>
               <div
@@ -1266,10 +1329,11 @@ exports[`AlertSummaryView Memory event code renders additional summary rows 1`]
               class="euiTableCellContent flyoutOverviewDescription euiTableCellContent--overflowingContent"
             >
               <div
+                class="euiFlexGroup euiFlexGroup--directionColumn euiFlexGroup--responsive"
                 data-test-subj="event-field-source.ip"
               >
                 <div
-                  class="eventFieldsTable__fieldValue"
+                  class="euiFlexItem euiFlexItem--flexGrowZero eventFieldsTable__fieldValue"
                 >
                   <span
                     class="euiToolTipAnchor"
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
index d4e839c4bef77e..a2e4971899dcc3 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/__snapshots__/json_view.test.tsx.snap
@@ -10,40 +10,325 @@ exports[`JSON View rendering should match snapshot 1`] = `
     paddingSize="m"
   >
     {
-  "_id": "pEMaMmkBUV60JmNWmWVi",
-  "_index": "filebeat-8.0.0-2019.02.19-000001",
+  "_index": ".ds-logs-endpoint.events.network-default-2021.09.28-000001",
+  "_id": "TUWyf3wBFCFU0qRJTauW",
   "_score": 1,
-  "_type": "_doc",
-  "@timestamp": "2019-02-28T16:50:54.621Z",
-  "agent": {
-    "ephemeral_id": "9d391ef2-a734-4787-8891-67031178c641",
-    "hostname": "siem-kibana",
-    "id": "5de03d5f-52f3-482e-91d4-853c7de073c3",
-    "type": "filebeat",
-    "version": "8.0.0"
-  },
-  "cloud": {
-    "availability_zone": "projects/189716325846/zones/us-east1-b",
-    "instance": {
-      "id": "5412578377715150143",
-      "name": "siem-kibana"
+  "_source": {
+    "agent": {
+      "id": "2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624",
+      "type": "endpoint",
+      "version": "8.0.0-SNAPSHOT"
     },
-    "machine": {
-      "type": "projects/189716325846/machineTypes/n1-standard-1"
+    "process": {
+      "Ext": {
+        "ancestry": [
+          "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=",
+          "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA=="
+        ]
+      },
+      "name": "filebeat",
+      "pid": 22535,
+      "entity_id": "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=",
+      "executable": "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
     },
-    "project": {
-      "id": "elastic-beats"
+    "destination": {
+      "address": "127.0.0.1",
+      "port": 9200,
+      "ip": "127.0.0.1"
     },
-    "provider": "gce"
-  },
-  "destination": {
-    "bytes": 584,
-    "ip": "10.47.8.200",
-    "packets": 4,
-    "port": 902
+    "source": {
+      "address": "127.0.0.1",
+      "port": 54146,
+      "ip": "127.0.0.1"
+    },
+    "message": "Endpoint network event",
+    "network": {
+      "transport": "tcp",
+      "type": "ipv4"
+    },
+    "@timestamp": "2021-10-14T16:45:58.0310772Z",
+    "ecs": {
+      "version": "1.11.0"
+    },
+    "data_stream": {
+      "namespace": "default",
+      "type": "logs",
+      "dataset": "endpoint.events.network"
+    },
+    "elastic": {
+      "agent": {
+        "id": "12345"
+      }
+    },
+    "host": {
+      "hostname": "test-linux-1",
+      "os": {
+        "Ext": {
+          "variant": "Debian"
+        },
+        "kernel": "4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)",
+        "name": "Linux",
+        "family": "debian",
+        "type": "linux",
+        "version": "10",
+        "platform": "debian",
+        "full": "Debian 10"
+      },
+      "ip": [
+        "127.0.0.1",
+        "::1",
+        "10.1.2.3",
+        "2001:0DB8:AC10:FE01::"
+      ],
+      "name": "test-linux-1",
+      "id": "76ea303129f249aa7382338e4263eac1",
+      "mac": [
+        "aa:bb:cc:dd:ee:ff"
+      ],
+      "architecture": "x86_64"
+    },
+    "event": {
+      "agent_id_status": "verified",
+      "sequence": 44872,
+      "ingested": "2021-10-14T16:46:04Z",
+      "created": "2021-10-14T16:45:58.0310772Z",
+      "kind": "event",
+      "module": "endpoint",
+      "action": "connection_attempted",
+      "id": "MKPXftjGeHiQzUNj++++nn6R",
+      "category": [
+        "network"
+      ],
+      "type": [
+        "start"
+      ],
+      "dataset": "endpoint.events.network",
+      "outcome": "unknown"
+    },
+    "user": {
+      "Ext": {
+        "real": {
+          "name": "root",
+          "id": 0
+        }
+      },
+      "name": "root",
+      "id": 0
+    },
+    "group": {
+      "Ext": {
+        "real": {
+          "name": "root",
+          "id": 0
+        }
+      },
+      "name": "root",
+      "id": 0
+    }
   },
-  "event": {
-    "kind": "event"
+  "fields": {
+    "host.os.full.text": [
+      "Debian 10"
+    ],
+    "event.category": [
+      "network"
+    ],
+    "process.name.text": [
+      "filebeat"
+    ],
+    "host.os.name.text": [
+      "Linux"
+    ],
+    "host.os.full": [
+      "Debian 10"
+    ],
+    "host.hostname": [
+      "test-linux-1"
+    ],
+    "process.pid": [
+      22535
+    ],
+    "host.mac": [
+      "42:01:0a:c8:00:32"
+    ],
+    "elastic.agent.id": [
+      "abcdefg-f6d5-4ce6-915d-8f1f8f413624"
+    ],
+    "host.os.version": [
+      "10"
+    ],
+    "host.os.name": [
+      "Linux"
+    ],
+    "source.ip": [
+      "127.0.0.1"
+    ],
+    "destination.address": [
+      "127.0.0.1"
+    ],
+    "host.name": [
+      "test-linux-1"
+    ],
+    "event.agent_id_status": [
+      "verified"
+    ],
+    "event.kind": [
+      "event"
+    ],
+    "event.outcome": [
+      "unknown"
+    ],
+    "group.name": [
+      "root"
+    ],
+    "user.id": [
+      "0"
+    ],
+    "host.os.type": [
+      "linux"
+    ],
+    "process.Ext.ancestry": [
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=",
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA=="
+    ],
+    "user.Ext.real.id": [
+      "0"
+    ],
+    "data_stream.type": [
+      "logs"
+    ],
+    "host.architecture": [
+      "x86_64"
+    ],
+    "process.name": [
+      "filebeat"
+    ],
+    "agent.id": [
+      "2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624"
+    ],
+    "source.port": [
+      54146
+    ],
+    "ecs.version": [
+      "1.11.0"
+    ],
+    "event.created": [
+      "2021-10-14T16:45:58.031Z"
+    ],
+    "agent.version": [
+      "8.0.0-SNAPSHOT"
+    ],
+    "host.os.family": [
+      "debian"
+    ],
+    "destination.port": [
+      9200
+    ],
+    "group.id": [
+      "0"
+    ],
+    "user.name": [
+      "root"
+    ],
+    "source.address": [
+      "127.0.0.1"
+    ],
+    "process.entity_id": [
+      "MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA="
+    ],
+    "host.ip": [
+      "127.0.0.1",
+      "::1",
+      "10.1.2.3",
+      "2001:0DB8:AC10:FE01::"
+    ],
+    "process.executable.caseless": [
+      "/opt/elastic/agent/data/elastic-agent-058c40/install/filebeat-8.0.0-snapshot-linux-x86_64/filebeat"
+    ],
+    "event.sequence": [
+      44872
+    ],
+    "agent.type": [
+      "endpoint"
+    ],
+    "process.executable.text": [
+      "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
+    ],
+    "group.Ext.real.name": [
+      "root"
+    ],
+    "event.module": [
+      "endpoint"
+    ],
+    "host.os.kernel": [
+      "4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)"
+    ],
+    "host.os.full.caseless": [
+      "debian 10"
+    ],
+    "host.id": [
+      "76ea303129f249aa7382338e4263eac1"
+    ],
+    "process.name.caseless": [
+      "filebeat"
+    ],
+    "network.type": [
+      "ipv4"
+    ],
+    "process.executable": [
+      "/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat"
+    ],
+    "user.Ext.real.name": [
+      "root"
+    ],
+    "data_stream.namespace": [
+      "default"
+    ],
+    "message": [
+      "Endpoint network event"
+    ],
+    "destination.ip": [
+      "127.0.0.1"
+    ],
+    "network.transport": [
+      "tcp"
+    ],
+    "host.os.Ext.variant": [
+      "Debian"
+    ],
+    "group.Ext.real.id": [
+      "0"
+    ],
+    "event.ingested": [
+      "2021-10-14T16:46:04.000Z"
+    ],
+    "event.action": [
+      "connection_attempted"
+    ],
+    "@timestamp": [
+      "2021-10-14T16:45:58.031Z"
+    ],
+    "host.os.platform": [
+      "debian"
+    ],
+    "data_stream.dataset": [
+      "endpoint.events.network"
+    ],
+    "event.type": [
+      "start"
+    ],
+    "event.id": [
+      "MKPXftjGeHiQzUNj++++nn6R"
+    ],
+    "host.os.name.caseless": [
+      "linux"
+    ],
+    "event.dataset": [
+      "endpoint.events.network"
+    ],
+    "user.name.text": [
+      "root"
+    ]
   }
 }
   </EuiCodeBlock>
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
index a8ba536a755410..37ca3b0b897a65 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.test.tsx
@@ -11,7 +11,7 @@ import React from 'react';
 
 import '../../mock/match_media';
 import '../../mock/react_beautiful_dnd';
-import { mockDetailItemData, mockDetailItemDataId, TestProviders } from '../../mock';
+import { mockDetailItemData, mockDetailItemDataId, rawEventData, TestProviders } from '../../mock';
 
 import { EventDetails, EventsViewType } from './event_details';
 import { mockBrowserFields } from '../../containers/source/mock';
@@ -48,6 +48,7 @@ describe('EventDetails', () => {
     timelineId: 'test',
     eventView: EventsViewType.summaryView,
     hostRisk: { fields: [], loading: true },
+    rawEventData,
   };
 
   const alertsProps = {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
index e7092d9d6f466d..a8305a635f157b 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/event_details.tsx
@@ -61,6 +61,7 @@ interface Props {
   id: string;
   isAlert: boolean;
   isDraggable?: boolean;
+  rawEventData: object | undefined;
   timelineTabType: TimelineTabs | 'flyout';
   timelineId: string;
   hostRisk: HostRisk | null;
@@ -106,6 +107,7 @@ const EventDetailsComponent: React.FC<Props> = ({
   id,
   isAlert,
   isDraggable,
+  rawEventData,
   timelineId,
   timelineTabType,
   hostRisk,
@@ -278,12 +280,12 @@ const EventDetailsComponent: React.FC<Props> = ({
         <>
           <EuiSpacer size="m" />
           <TabContentWrapper data-test-subj="jsonViewWrapper">
-            <JsonView data={data} />
+            <JsonView rawEventData={rawEventData} />
           </TabContentWrapper>
         </>
       ),
     }),
-    [data]
+    [rawEventData]
   );
 
   const tabs = useMemo(() => {
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
index 696fac60166032..b20270266602d8 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.test.tsx
@@ -8,58 +8,15 @@
 import { shallow } from 'enzyme';
 import React from 'react';
 
-import { mockDetailItemData } from '../../mock';
+import { rawEventData } from '../../mock';
 
-import { buildJsonView, JsonView } from './json_view';
+import { JsonView } from './json_view';
 
 describe('JSON View', () => {
   describe('rendering', () => {
     test('should match snapshot', () => {
-      const wrapper = shallow(<JsonView data={mockDetailItemData} />);
+      const wrapper = shallow(<JsonView rawEventData={rawEventData} />);
       expect(wrapper).toMatchSnapshot();
     });
   });
-
-  describe('buildJsonView', () => {
-    test('should match a json', () => {
-      const expectedData = {
-        '@timestamp': '2019-02-28T16:50:54.621Z',
-        _id: 'pEMaMmkBUV60JmNWmWVi',
-        _index: 'filebeat-8.0.0-2019.02.19-000001',
-        _score: 1,
-        _type: '_doc',
-        agent: {
-          ephemeral_id: '9d391ef2-a734-4787-8891-67031178c641',
-          hostname: 'siem-kibana',
-          id: '5de03d5f-52f3-482e-91d4-853c7de073c3',
-          type: 'filebeat',
-          version: '8.0.0',
-        },
-        cloud: {
-          availability_zone: 'projects/189716325846/zones/us-east1-b',
-          instance: {
-            id: '5412578377715150143',
-            name: 'siem-kibana',
-          },
-          machine: {
-            type: 'projects/189716325846/machineTypes/n1-standard-1',
-          },
-          project: {
-            id: 'elastic-beats',
-          },
-          provider: 'gce',
-        },
-        destination: {
-          bytes: 584,
-          ip: '10.47.8.200',
-          packets: 4,
-          port: 902,
-        },
-        event: {
-          kind: 'event',
-        },
-      };
-      expect(buildJsonView(mockDetailItemData)).toEqual(expectedData);
-    });
-  });
 });
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
index 0614f131bcd101..0227d44f32305a 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx
@@ -6,15 +6,13 @@
  */
 
 import { EuiCodeBlock } from '@elastic/eui';
-import { set } from '@elastic/safer-lodash-set/fp';
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
 
-import { TimelineEventsDetailsItem } from '../../../../common/search_strategy';
 import { omitTypenameAndEmpty } from '../../../timelines/components/timeline/body/helpers';
 
 interface Props {
-  data: TimelineEventsDetailsItem[];
+  rawEventData: object | undefined;
 }
 
 const EuiCodeEditorContainer = styled.div`
@@ -23,15 +21,15 @@ const EuiCodeEditorContainer = styled.div`
   }
 `;
 
-export const JsonView = React.memo<Props>(({ data }) => {
+export const JsonView = React.memo<Props>(({ rawEventData }) => {
   const value = useMemo(
     () =>
       JSON.stringify(
-        buildJsonView(data),
+        rawEventData,
         omitTypenameAndEmpty,
         2 // indent level
       ),
-    [data]
+    [rawEventData]
   );
 
   return (
@@ -50,16 +48,3 @@ export const JsonView = React.memo<Props>(({ data }) => {
 });
 
 JsonView.displayName = 'JsonView';
-
-export const buildJsonView = (data: TimelineEventsDetailsItem[]) =>
-  data
-    .sort((a, b) => a.field.localeCompare(b.field))
-    .reduce(
-      (accumulator, item) =>
-        set(
-          item.field,
-          Array.isArray(item.originalValue) ? item.originalValue.join() : item.originalValue,
-          accumulator
-        ),
-      {}
-    );
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx
new file mode 100644
index 00000000000000..f6c43da2da8ac8
--- /dev/null
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.test.tsx
@@ -0,0 +1,193 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { render, screen } from '@testing-library/react';
+import React from 'react';
+
+import { BrowserField } from '../../../containers/source';
+import { FieldValueCell } from './field_value_cell';
+import { TestProviders } from '../../../mock';
+import { EventFieldsData } from '../types';
+
+const contextId = 'test';
+
+const eventId = 'TUWyf3wBFCFU0qRJTauW';
+
+const hostIpData: EventFieldsData = {
+  aggregatable: true,
+  ariaRowindex: 35,
+  category: 'host',
+  description: 'Host ip addresses.',
+  example: '127.0.0.1',
+  field: 'host.ip',
+  fields: {},
+  format: '',
+  indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+  isObjectArray: false,
+  name: 'host.ip',
+  originalValue: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+  searchable: true,
+  type: 'ip',
+  values: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+};
+const hostIpValues = ['127.0.0.1', '::1', '10.1.2.3', 'fe80::4001:aff:fec8:32'];
+
+describe('FieldValueCell', () => {
+  describe('common behavior', () => {
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it formats multiple values such that each value is displayed on a single line', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`)).toHaveClass(
+        'euiFlexGroup--directionColumn'
+      );
+    });
+  });
+
+  describe('when `BrowserField` metadata is NOT available', () => {
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            fieldFromBrowserField={undefined} // <-- no metadata
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders each of the expected values when `fieldFromBrowserField` is undefined', () => {
+      hostIpValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+
+    test('it renders values formatted as plain text (without `eventFieldsTable__fieldValue` formatting)', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`).firstChild).not.toHaveClass(
+        'eventFieldsTable__fieldValue'
+      );
+    });
+  });
+
+  describe('`message` field formatting', () => {
+    const messageData: EventFieldsData = {
+      aggregatable: false,
+      ariaRowindex: 50,
+      category: 'base',
+      description:
+        'For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.',
+      example: 'Hello World',
+      field: 'message',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      isObjectArray: false,
+      name: 'message',
+      originalValue: ['Endpoint network event'],
+      searchable: true,
+      type: 'string',
+      values: ['Endpoint network event'],
+    };
+    const messageValues = ['Endpoint network event'];
+
+    const messageFieldFromBrowserField: BrowserField = {
+      aggregatable: false,
+      category: 'base',
+      description:
+        'For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.',
+      example: 'Hello World',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      name: 'message',
+      searchable: true,
+      type: 'string',
+    };
+
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={messageData}
+            eventId={eventId}
+            fieldFromBrowserField={messageFieldFromBrowserField}
+            values={messageValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders special formatting for the `message` field', () => {
+      expect(screen.getByTestId('event-field-message')).toBeInTheDocument();
+    });
+
+    test('it renders the expected message value', () => {
+      messageValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+  });
+
+  describe('when `BrowserField` metadata IS available', () => {
+    const hostIpFieldFromBrowserField: BrowserField = {
+      aggregatable: true,
+      category: 'host',
+      description: 'Host ip addresses.',
+      example: '127.0.0.1',
+      fields: {},
+      format: '',
+      indexes: ['auditbeat-*', 'filebeat-*', 'logs-*', 'winlogbeat-*'],
+      name: 'host.ip',
+      searchable: true,
+      type: 'ip',
+    };
+
+    beforeEach(() => {
+      render(
+        <TestProviders>
+          <FieldValueCell
+            contextId={contextId}
+            data={hostIpData}
+            eventId={eventId}
+            fieldFromBrowserField={hostIpFieldFromBrowserField} // <-- metadata
+            values={hostIpValues}
+          />
+        </TestProviders>
+      );
+    });
+
+    test('it renders values formatted with the expected class', () => {
+      expect(screen.getByTestId(`event-field-${hostIpData.field}`).firstChild).toHaveClass(
+        'eventFieldsTable__fieldValue'
+      );
+    });
+
+    test('it renders link buttons for each of the host ip addresses', () => {
+      expect(screen.getAllByRole('button').length).toBe(hostIpValues.length);
+    });
+
+    test('it renders each of the expected values when `fieldFromBrowserField` is provided', () => {
+      hostIpValues.forEach((value) => {
+        expect(screen.getByText(value)).toBeInTheDocument();
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
index fc20f84d3650d9..dc6c84b8138fe9 100644
--- a/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/event_details/table/field_value_cell.tsx
@@ -6,7 +6,7 @@
  */
 
 import React from 'react';
-import { EuiText } from '@elastic/eui';
+import { EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
 import { BrowserField } from '../../../containers/source';
 import { OverflowField } from '../../tables/helpers';
 import { FormattedFieldValue } from '../../../../timelines/components/timeline/body/renderers/formatted_field';
@@ -36,18 +36,28 @@ export const FieldValueCell = React.memo(
     values,
   }: FieldValueCellProps) => {
     return (
-      <div data-test-subj={`event-field-${data.field}`}>
+      <EuiFlexGroup
+        data-test-subj={`event-field-${data.field}`}
+        direction="column"
+        gutterSize="none"
+      >
         {values != null &&
           values.map((value, i) => {
             if (fieldFromBrowserField == null) {
               return (
-                <EuiText size="xs" key={value}>
-                  {value}
-                </EuiText>
+                <EuiFlexItem grow={false} key={`${i}-${value}`}>
+                  <EuiText size="xs" key={`${i}-${value}`}>
+                    {value}
+                  </EuiText>
+                </EuiFlexItem>
               );
             }
             return (
-              <div className="eventFieldsTable__fieldValue" key={value}>
+              <EuiFlexItem
+                className="eventFieldsTable__fieldValue"
+                grow={false}
+                key={`${i}-${value}`}
+              >
                 {data.field === MESSAGE_FIELD_NAME ? (
                   <OverflowField value={value} />
                 ) : (
@@ -63,10 +73,10 @@ export const FieldValueCell = React.memo(
                     linkValue={(getLinkValue && getLinkValue(data.field)) ?? linkValue}
                   />
                 )}
-              </div>
+              </EuiFlexItem>
             );
           })}
-      </div>
+      </EuiFlexGroup>
     );
   }
 );
diff --git a/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts b/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
index 3712d389edeb10..035bdbbceff886 100644
--- a/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
+++ b/x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts
@@ -139,3 +139,191 @@ export const generateMockDetailItemData = (): TimelineEventsDetailsItem[] => [
 ];
 
 export const mockDetailItemData: TimelineEventsDetailsItem[] = generateMockDetailItemData();
+
+export const rawEventData = {
+  _index: '.ds-logs-endpoint.events.network-default-2021.09.28-000001',
+  _id: 'TUWyf3wBFCFU0qRJTauW',
+  _score: 1,
+  _source: {
+    agent: {
+      id: '2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624',
+      type: 'endpoint',
+      version: '8.0.0-SNAPSHOT',
+    },
+    process: {
+      Ext: {
+        ancestry: [
+          'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=',
+          'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA==',
+        ],
+      },
+      name: 'filebeat',
+      pid: 22535,
+      entity_id: 'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=',
+      executable:
+        '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    },
+    destination: {
+      address: '127.0.0.1',
+      port: 9200,
+      ip: '127.0.0.1',
+    },
+    source: {
+      address: '127.0.0.1',
+      port: 54146,
+      ip: '127.0.0.1',
+    },
+    message: 'Endpoint network event',
+    network: {
+      transport: 'tcp',
+      type: 'ipv4',
+    },
+    '@timestamp': '2021-10-14T16:45:58.0310772Z',
+    ecs: {
+      version: '1.11.0',
+    },
+    data_stream: {
+      namespace: 'default',
+      type: 'logs',
+      dataset: 'endpoint.events.network',
+    },
+    elastic: {
+      agent: {
+        id: '12345',
+      },
+    },
+    host: {
+      hostname: 'test-linux-1',
+      os: {
+        Ext: {
+          variant: 'Debian',
+        },
+        kernel: '4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)',
+        name: 'Linux',
+        family: 'debian',
+        type: 'linux',
+        version: '10',
+        platform: 'debian',
+        full: 'Debian 10',
+      },
+      ip: ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+      name: 'test-linux-1',
+      id: '76ea303129f249aa7382338e4263eac1',
+      mac: ['aa:bb:cc:dd:ee:ff'],
+      architecture: 'x86_64',
+    },
+    event: {
+      agent_id_status: 'verified',
+      sequence: 44872,
+      ingested: '2021-10-14T16:46:04Z',
+      created: '2021-10-14T16:45:58.0310772Z',
+      kind: 'event',
+      module: 'endpoint',
+      action: 'connection_attempted',
+      id: 'MKPXftjGeHiQzUNj++++nn6R',
+      category: ['network'],
+      type: ['start'],
+      dataset: 'endpoint.events.network',
+      outcome: 'unknown',
+    },
+    user: {
+      Ext: {
+        real: {
+          name: 'root',
+          id: 0,
+        },
+      },
+      name: 'root',
+      id: 0,
+    },
+    group: {
+      Ext: {
+        real: {
+          name: 'root',
+          id: 0,
+        },
+      },
+      name: 'root',
+      id: 0,
+    },
+  },
+  fields: {
+    'host.os.full.text': ['Debian 10'],
+    'event.category': ['network'],
+    'process.name.text': ['filebeat'],
+    'host.os.name.text': ['Linux'],
+    'host.os.full': ['Debian 10'],
+    'host.hostname': ['test-linux-1'],
+    'process.pid': [22535],
+    'host.mac': ['42:01:0a:c8:00:32'],
+    'elastic.agent.id': ['abcdefg-f6d5-4ce6-915d-8f1f8f413624'],
+    'host.os.version': ['10'],
+    'host.os.name': ['Linux'],
+    'source.ip': ['127.0.0.1'],
+    'destination.address': ['127.0.0.1'],
+    'host.name': ['test-linux-1'],
+    'event.agent_id_status': ['verified'],
+    'event.kind': ['event'],
+    'event.outcome': ['unknown'],
+    'group.name': ['root'],
+    'user.id': ['0'],
+    'host.os.type': ['linux'],
+    'process.Ext.ancestry': [
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyMzY0LTEzMjc4NjA2NTAyLjA=',
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTEtMTMyNzA3Njg2OTIuMA==',
+    ],
+    'user.Ext.real.id': ['0'],
+    'data_stream.type': ['logs'],
+    'host.architecture': ['x86_64'],
+    'process.name': ['filebeat'],
+    'agent.id': ['2ac9e9b3-f6d5-4ce6-915d-8f1f8f413624'],
+    'source.port': [54146],
+    'ecs.version': ['1.11.0'],
+    'event.created': ['2021-10-14T16:45:58.031Z'],
+    'agent.version': ['8.0.0-SNAPSHOT'],
+    'host.os.family': ['debian'],
+    'destination.port': [9200],
+    'group.id': ['0'],
+    'user.name': ['root'],
+    'source.address': ['127.0.0.1'],
+    'process.entity_id': [
+      'MmFjOWU5YjMtZjZkNS00Y2U2LTkxNWQtOGYxZjhmNDEzNjI0LTIyNTM1LTEzMjc4NjA2NTI4LjA=',
+    ],
+    'host.ip': ['127.0.0.1', '::1', '10.1.2.3', '2001:0DB8:AC10:FE01::'],
+    'process.executable.caseless': [
+      '/opt/elastic/agent/data/elastic-agent-058c40/install/filebeat-8.0.0-snapshot-linux-x86_64/filebeat',
+    ],
+    'event.sequence': [44872],
+    'agent.type': ['endpoint'],
+    'process.executable.text': [
+      '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    ],
+    'group.Ext.real.name': ['root'],
+    'event.module': ['endpoint'],
+    'host.os.kernel': ['4.19.0-17-cloud-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21)'],
+    'host.os.full.caseless': ['debian 10'],
+    'host.id': ['76ea303129f249aa7382338e4263eac1'],
+    'process.name.caseless': ['filebeat'],
+    'network.type': ['ipv4'],
+    'process.executable': [
+      '/opt/Elastic/Agent/data/elastic-agent-058c40/install/filebeat-8.0.0-SNAPSHOT-linux-x86_64/filebeat',
+    ],
+    'user.Ext.real.name': ['root'],
+    'data_stream.namespace': ['default'],
+    message: ['Endpoint network event'],
+    'destination.ip': ['127.0.0.1'],
+    'network.transport': ['tcp'],
+    'host.os.Ext.variant': ['Debian'],
+    'group.Ext.real.id': ['0'],
+    'event.ingested': ['2021-10-14T16:46:04.000Z'],
+    'event.action': ['connection_attempted'],
+    '@timestamp': ['2021-10-14T16:45:58.031Z'],
+    'host.os.platform': ['debian'],
+    'data_stream.dataset': ['endpoint.events.network'],
+    'event.type': ['start'],
+    'event.id': ['MKPXftjGeHiQzUNj++++nn6R'],
+    'host.os.name.caseless': ['linux'],
+    'event.dataset': ['endpoint.events.network'],
+    'user.name.text': ['root'],
+  },
+};
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
index 17d43d80a5a9a3..6a7f0602c36751 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/expandable_event.tsx
@@ -33,6 +33,7 @@ interface Props {
   isDraggable?: boolean;
   loading: boolean;
   messageHeight?: number;
+  rawEventData: object | undefined;
   timelineTabType: TimelineTabs | 'flyout';
   timelineId: string;
   hostRisk: HostRisk | null;
@@ -93,6 +94,7 @@ export const ExpandableEvent = React.memo<Props>(
     loading,
     detailsData,
     hostRisk,
+    rawEventData,
   }) => {
     if (!event.eventId) {
       return <EuiTextColor color="subdued">{i18n.EVENT_DETAILS_PLACEHOLDER}</EuiTextColor>;
@@ -111,6 +113,7 @@ export const ExpandableEvent = React.memo<Props>(
             id={event.eventId}
             isAlert={isAlert}
             isDraggable={isDraggable}
+            rawEventData={rawEventData}
             timelineId={timelineId}
             timelineTabType={timelineTabType}
             hostRisk={hostRisk}
diff --git a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
index f8786e0706834a..b9d7e0a8c024f6 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/side_panel/event_details/index.tsx
@@ -79,7 +79,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
   tabType,
   timelineId,
 }) => {
-  const [loading, detailsData] = useTimelineEventsDetails({
+  const [loading, detailsData, rawEventData] = useTimelineEventsDetails({
     docValueFields,
     entityType,
     indexName: expandedEvent.indexName ?? '',
@@ -195,6 +195,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
             isAlert={isAlert}
             isDraggable={isDraggable}
             loading={loading}
+            rawEventData={rawEventData}
             timelineId={timelineId}
             timelineTabType="flyout"
             hostRisk={hostRisk}
@@ -228,6 +229,7 @@ const EventDetailsPanelComponent: React.FC<EventDetailsPanelProps> = ({
         isAlert={isAlert}
         isDraggable={isDraggable}
         loading={loading}
+        rawEventData={rawEventData}
         timelineId={timelineId}
         timelineTabType={tabType}
         hostRisk={hostRisk}
diff --git a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
index e59eaeed4f2a61..f05966bd97870b 100644
--- a/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/containers/details/index.tsx
@@ -42,7 +42,7 @@ export const useTimelineEventsDetails = ({
   indexName,
   eventId,
   skip,
-}: UseTimelineEventsDetailsProps): [boolean, EventsArgs['detailsData']] => {
+}: UseTimelineEventsDetailsProps): [boolean, EventsArgs['detailsData'], object | undefined] => {
   const { data } = useKibana().services;
   const refetch = useRef<inputsModel.Refetch>(noop);
   const abortCtrl = useRef(new AbortController());
@@ -55,6 +55,8 @@ export const useTimelineEventsDetails = ({
   const [timelineDetailsResponse, setTimelineDetailsResponse] =
     useState<EventsArgs['detailsData']>(null);
 
+  const [rawEventData, setRawEventData] = useState<object | undefined>(undefined);
+
   const timelineDetailsSearch = useCallback(
     (request: TimelineEventsDetailsRequestOptions | null) => {
       if (request == null || skip || isEmpty(request.eventId)) {
@@ -78,6 +80,7 @@ export const useTimelineEventsDetails = ({
               if (isCompleteResponse(response)) {
                 setLoading(false);
                 setTimelineDetailsResponse(response.data || []);
+                setRawEventData(response.rawResponse.hits.hits[0]);
                 searchSubscription$.current.unsubscribe();
               } else if (isErrorResponse(response)) {
                 setLoading(false);
@@ -125,5 +128,5 @@ export const useTimelineEventsDetails = ({
     };
   }, [timelineDetailsRequest, timelineDetailsSearch]);
 
-  return [loading, timelineDetailsResponse];
+  return [loading, timelineDetailsResponse, rawEventData];
 };
diff --git a/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts b/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
index 5bceb310816877..f9f6a2ea579172 100644
--- a/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
+++ b/x-pack/plugins/timelines/common/search_strategy/timeline/events/details/index.ts
@@ -24,6 +24,7 @@ export interface TimelineEventsDetailsItem {
 export interface TimelineEventsDetailsStrategyResponse extends IEsSearchResponse {
   data?: Maybe<TimelineEventsDetailsItem[]>;
   inspect?: Maybe<Inspect>;
+  rawEventData?: Maybe<object>;
 }
 
 export interface TimelineEventsDetailsRequestOptions
diff --git a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
index c82d9af938a980..b60add2515ec93 100644
--- a/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
+++ b/x-pack/plugins/timelines/server/search_strategy/timeline/factory/events/details/index.ts
@@ -57,10 +57,14 @@ export const timelineEventsDetails: TimelineFactory<TimelineEventsQueries.detail
     );
 
     const data = unionBy('field', fieldsData, sourceData);
+
+    const rawEventData = response.rawResponse.hits.hits[0];
+
     return {
       ...response,
       data,
       inspect,
+      rawEventData,
     };
   },
 };

From 5974fcfdb55ba12e2b90ebdd911004b271343fed Mon Sep 17 00:00:00 2001
From: Josh Dover <1813008+joshdover@users.noreply.github.com>
Date: Tue, 19 Oct 2021 12:14:57 +0200
Subject: [PATCH 02/10] Allow elastic/fleet-server to call appropriate Fleet
 APIs (#113932)

---
 x-pack/plugins/fleet/server/mocks/index.ts    |  12 +-
 x-pack/plugins/fleet/server/plugin.ts         |  55 ++++--
 .../fleet/server/routes/agent_policy/index.ts |  27 +--
 .../routes/enrollment_api_key/handler.ts      |   6 +-
 .../server/routes/enrollment_api_key/index.ts |  21 ++-
 .../plugins/fleet/server/routes/epm/index.ts  |  39 ++--
 .../fleet/server/routes/security.test.ts      | 175 ++++++++++++++++++
 .../plugins/fleet/server/routes/security.ts   | 135 +++++++++++---
 .../fleet/server/routes/setup/handlers.ts     |   8 +-
 .../fleet/server/routes/setup/index.ts        |  21 +--
 .../fleet/server/types/request_context.ts     |   7 +
 .../authorization/check_privileges.test.ts    | 108 +++++++++++
 .../server/authorization/check_privileges.ts  |  31 +++-
 .../check_privileges_dynamically.test.ts      |  22 ++-
 .../check_privileges_dynamically.ts           |  14 +-
 .../security/server/authorization/types.ts    |  26 ++-
 .../apis/security/privileges.ts               |   2 +-
 .../apis/security/privileges_basic.ts         |   2 +-
 .../apis/agents/services.ts                   |  26 ++-
 .../fleet_api_integration/apis/epm/setup.ts   |  45 +++++
 20 files changed, 651 insertions(+), 131 deletions(-)
 create mode 100644 x-pack/plugins/fleet/server/routes/security.test.ts

diff --git a/x-pack/plugins/fleet/server/mocks/index.ts b/x-pack/plugins/fleet/server/mocks/index.ts
index c7f6b6fefc414d..e6577426974a3f 100644
--- a/x-pack/plugins/fleet/server/mocks/index.ts
+++ b/x-pack/plugins/fleet/server/mocks/index.ts
@@ -23,7 +23,17 @@ import type { FleetAppContext } from '../plugin';
 // Export all mocks from artifacts
 export * from '../services/artifacts/mocks';
 
-export const createAppContextStartContractMock = (): FleetAppContext => {
+export interface MockedFleetAppContext extends FleetAppContext {
+  elasticsearch: ReturnType<typeof elasticsearchServiceMock.createStart>;
+  data: ReturnType<typeof dataPluginMock.createStartContract>;
+  encryptedSavedObjectsStart?: ReturnType<typeof encryptedSavedObjectsMock.createStart>;
+  savedObjects: ReturnType<typeof savedObjectsServiceMock.createStartContract>;
+  securitySetup?: ReturnType<typeof securityMock.createSetup>;
+  securityStart?: ReturnType<typeof securityMock.createStart>;
+  logger: ReturnType<ReturnType<typeof loggingSystemMock.create>['get']>;
+}
+
+export const createAppContextStartContractMock = (): MockedFleetAppContext => {
   const config = {
     agents: { enabled: true, elasticsearch: {} },
     enabled: true,
diff --git a/x-pack/plugins/fleet/server/plugin.ts b/x-pack/plugins/fleet/server/plugin.ts
index aaee24b39685ac..8a95065380b698 100644
--- a/x-pack/plugins/fleet/server/plugin.ts
+++ b/x-pack/plugins/fleet/server/plugin.ts
@@ -80,9 +80,10 @@ import {
 } from './services/agents';
 import { registerFleetUsageCollector } from './collectors/register';
 import { getInstallation, ensureInstalledPackage } from './services/epm/packages';
-import { makeRouterEnforcingSuperuser } from './routes/security';
+import { RouterWrappers } from './routes/security';
 import { startFleetServerSetup } from './services/fleet_server';
 import { FleetArtifactsClient } from './services/artifacts';
+import type { FleetRouter } from './types/request_context';
 
 export interface FleetSetupDeps {
   licensing: LicensingPluginSetup;
@@ -206,6 +207,24 @@ export class FleetPlugin
         category: DEFAULT_APP_CATEGORIES.management,
         app: [PLUGIN_ID, INTEGRATIONS_PLUGIN_ID, 'kibana'],
         catalogue: ['fleet'],
+        reserved: {
+          description:
+            'Privilege to setup Fleet packages and configured policies. Intended for use by the elastic/fleet-server service account only.',
+          privileges: [
+            {
+              id: 'fleet-setup',
+              privilege: {
+                excludeFromBasePrivileges: true,
+                api: ['fleet-setup'],
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: [],
+              },
+            },
+          ],
+        },
         privileges: {
           all: {
             api: [`${PLUGIN_ID}-read`, `${PLUGIN_ID}-all`],
@@ -245,7 +264,7 @@ export class FleetPlugin
       })
     );
 
-    const router = core.http.createRouter<FleetRequestHandlerContext>();
+    const router: FleetRouter = core.http.createRouter<FleetRequestHandlerContext>();
 
     // Register usage collection
     registerFleetUsageCollector(core, config, deps.usageCollection);
@@ -254,24 +273,34 @@ export class FleetPlugin
     registerAppRoutes(router);
     // Allow read-only users access to endpoints necessary for Integrations UI
     // Only some endpoints require superuser so we pass a raw IRouter here
-    registerEPMRoutes(router);
 
     // For all the routes we enforce the user to have role superuser
-    const routerSuperuserOnly = makeRouterEnforcingSuperuser(router);
+    const superuserRouter = RouterWrappers.require.superuser(router);
+    const fleetSetupRouter = RouterWrappers.require.fleetSetupPrivilege(router);
+
+    // Some EPM routes use regular rbac to support integrations app
+    registerEPMRoutes({ rbac: router, superuser: superuserRouter });
+
     // Register rest of routes only if security is enabled
     if (deps.security) {
-      registerSetupRoutes(routerSuperuserOnly, config);
-      registerAgentPolicyRoutes(routerSuperuserOnly);
-      registerPackagePolicyRoutes(routerSuperuserOnly);
-      registerOutputRoutes(routerSuperuserOnly);
-      registerSettingsRoutes(routerSuperuserOnly);
-      registerDataStreamRoutes(routerSuperuserOnly);
-      registerPreconfigurationRoutes(routerSuperuserOnly);
+      registerSetupRoutes(fleetSetupRouter, config);
+      registerAgentPolicyRoutes({
+        fleetSetup: fleetSetupRouter,
+        superuser: superuserRouter,
+      });
+      registerPackagePolicyRoutes(superuserRouter);
+      registerOutputRoutes(superuserRouter);
+      registerSettingsRoutes(superuserRouter);
+      registerDataStreamRoutes(superuserRouter);
+      registerPreconfigurationRoutes(superuserRouter);
 
       // Conditional config routes
       if (config.agents.enabled) {
-        registerAgentAPIRoutes(routerSuperuserOnly, config);
-        registerEnrollmentApiKeyRoutes(routerSuperuserOnly);
+        registerAgentAPIRoutes(superuserRouter, config);
+        registerEnrollmentApiKeyRoutes({
+          fleetSetup: fleetSetupRouter,
+          superuser: superuserRouter,
+        });
       }
     }
   }
diff --git a/x-pack/plugins/fleet/server/routes/agent_policy/index.ts b/x-pack/plugins/fleet/server/routes/agent_policy/index.ts
index a66a9ab9cadc75..4c20358e15085d 100644
--- a/x-pack/plugins/fleet/server/routes/agent_policy/index.ts
+++ b/x-pack/plugins/fleet/server/routes/agent_policy/index.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, AGENT_POLICY_API_ROUTES } from '../../constants';
 import {
   GetAgentPoliciesRequestSchema,
@@ -17,6 +15,7 @@ import {
   DeleteAgentPolicyRequestSchema,
   GetFullAgentPolicyRequestSchema,
 } from '../../types';
+import type { FleetRouter } from '../../types/request_context';
 
 import {
   getAgentPoliciesHandler,
@@ -29,19 +28,21 @@ import {
   downloadFullAgentPolicy,
 } from './handlers';
 
-export const registerRoutes = (router: IRouter) => {
-  // List
-  router.get(
+export const registerRoutes = (routers: { superuser: FleetRouter; fleetSetup: FleetRouter }) => {
+  // List - Fleet Server needs access to run setup
+  routers.fleetSetup.get(
     {
       path: AGENT_POLICY_API_ROUTES.LIST_PATTERN,
       validate: GetAgentPoliciesRequestSchema,
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
+      // options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getAgentPoliciesHandler
   );
 
   // Get one
-  router.get(
+  routers.superuser.get(
     {
       path: AGENT_POLICY_API_ROUTES.INFO_PATTERN,
       validate: GetOneAgentPolicyRequestSchema,
@@ -51,7 +52,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Create
-  router.post(
+  routers.superuser.post(
     {
       path: AGENT_POLICY_API_ROUTES.CREATE_PATTERN,
       validate: CreateAgentPolicyRequestSchema,
@@ -61,7 +62,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Update
-  router.put(
+  routers.superuser.put(
     {
       path: AGENT_POLICY_API_ROUTES.UPDATE_PATTERN,
       validate: UpdateAgentPolicyRequestSchema,
@@ -71,7 +72,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Copy
-  router.post(
+  routers.superuser.post(
     {
       path: AGENT_POLICY_API_ROUTES.COPY_PATTERN,
       validate: CopyAgentPolicyRequestSchema,
@@ -81,7 +82,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Delete
-  router.post(
+  routers.superuser.post(
     {
       path: AGENT_POLICY_API_ROUTES.DELETE_PATTERN,
       validate: DeleteAgentPolicyRequestSchema,
@@ -91,7 +92,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Get one full agent policy
-  router.get(
+  routers.superuser.get(
     {
       path: AGENT_POLICY_API_ROUTES.FULL_INFO_PATTERN,
       validate: GetFullAgentPolicyRequestSchema,
@@ -101,7 +102,7 @@ export const registerRoutes = (router: IRouter) => {
   );
 
   // Download one full agent policy
-  router.get(
+  routers.superuser.get(
     {
       path: AGENT_POLICY_API_ROUTES.FULL_INFO_DOWNLOAD_PATTERN,
       validate: GetFullAgentPolicyRequestSchema,
diff --git a/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts b/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts
index 0959a9a88704af..9cb07a9050f830 100644
--- a/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts
+++ b/x-pack/plugins/fleet/server/routes/enrollment_api_key/handler.ts
@@ -27,7 +27,8 @@ export const getEnrollmentApiKeysHandler: RequestHandler<
   undefined,
   TypeOf<typeof GetEnrollmentAPIKeysRequestSchema.query>
 > = async (context, request, response) => {
-  const esClient = context.core.elasticsearch.client.asCurrentUser;
+  // Use kibana_system and depend on authz checks on HTTP layer to prevent abuse
+  const esClient = context.core.elasticsearch.client.asInternalUser;
 
   try {
     const { items, total, page, perPage } = await APIKeyService.listEnrollmentApiKeys(esClient, {
@@ -87,7 +88,8 @@ export const deleteEnrollmentApiKeyHandler: RequestHandler<
 export const getOneEnrollmentApiKeyHandler: RequestHandler<
   TypeOf<typeof GetOneEnrollmentAPIKeyRequestSchema.params>
 > = async (context, request, response) => {
-  const esClient = context.core.elasticsearch.client.asCurrentUser;
+  // Use kibana_system and depend on authz checks on HTTP layer to prevent abuse
+  const esClient = context.core.elasticsearch.client.asInternalUser;
   try {
     const apiKey = await APIKeyService.getEnrollmentAPIKey(esClient, request.params.keyId);
     const body: GetOneEnrollmentAPIKeyResponse = { item: apiKey };
diff --git a/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts b/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts
index b37a88e70e085b..6429d4d29d5c94 100644
--- a/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts
+++ b/x-pack/plugins/fleet/server/routes/enrollment_api_key/index.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, ENROLLMENT_API_KEY_ROUTES } from '../../constants';
 import {
   GetEnrollmentAPIKeysRequestSchema,
@@ -14,6 +12,7 @@ import {
   DeleteEnrollmentAPIKeyRequestSchema,
   PostEnrollmentAPIKeyRequestSchema,
 } from '../../types';
+import type { FleetRouter } from '../../types/request_context';
 
 import {
   getEnrollmentApiKeysHandler,
@@ -22,17 +21,19 @@ import {
   postEnrollmentApiKeyHandler,
 } from './handler';
 
-export const registerRoutes = (router: IRouter) => {
-  router.get(
+export const registerRoutes = (routers: { superuser: FleetRouter; fleetSetup: FleetRouter }) => {
+  routers.fleetSetup.get(
     {
       path: ENROLLMENT_API_KEY_ROUTES.INFO_PATTERN,
       validate: GetOneEnrollmentAPIKeyRequestSchema,
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
+      // options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getOneEnrollmentApiKeyHandler
   );
 
-  router.delete(
+  routers.superuser.delete(
     {
       path: ENROLLMENT_API_KEY_ROUTES.DELETE_PATTERN,
       validate: DeleteEnrollmentAPIKeyRequestSchema,
@@ -41,16 +42,18 @@ export const registerRoutes = (router: IRouter) => {
     deleteEnrollmentApiKeyHandler
   );
 
-  router.get(
+  routers.fleetSetup.get(
     {
       path: ENROLLMENT_API_KEY_ROUTES.LIST_PATTERN,
       validate: GetEnrollmentAPIKeysRequestSchema,
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
+      // options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getEnrollmentApiKeysHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: ENROLLMENT_API_KEY_ROUTES.CREATE_PATTERN,
       validate: PostEnrollmentAPIKeyRequestSchema,
diff --git a/x-pack/plugins/fleet/server/routes/epm/index.ts b/x-pack/plugins/fleet/server/routes/epm/index.ts
index 360f2ec1d446ed..a2f2df4a00c55f 100644
--- a/x-pack/plugins/fleet/server/routes/epm/index.ts
+++ b/x-pack/plugins/fleet/server/routes/epm/index.ts
@@ -5,10 +5,7 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, EPM_API_ROUTES } from '../../constants';
-import type { FleetRequestHandlerContext } from '../../types';
 import {
   GetCategoriesRequestSchema,
   GetPackagesRequestSchema,
@@ -21,7 +18,7 @@ import {
   GetStatsRequestSchema,
   UpdatePackageRequestSchema,
 } from '../../types';
-import { enforceSuperUser } from '../security';
+import type { FleetRouter } from '../../types/request_context';
 
 import {
   getCategoriesHandler,
@@ -39,8 +36,8 @@ import {
 
 const MAX_FILE_SIZE_BYTES = 104857600; // 100MB
 
-export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
-  router.get(
+export const registerRoutes = (routers: { rbac: FleetRouter; superuser: FleetRouter }) => {
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.CATEGORIES_PATTERN,
       validate: GetCategoriesRequestSchema,
@@ -49,7 +46,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getCategoriesHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.LIST_PATTERN,
       validate: GetPackagesRequestSchema,
@@ -58,7 +55,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getListHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.LIMITED_LIST_PATTERN,
       validate: false,
@@ -67,7 +64,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getLimitedListHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.STATS_PATTERN,
       validate: GetStatsRequestSchema,
@@ -76,7 +73,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getStatsHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.FILEPATH_PATTERN,
       validate: GetFileRequestSchema,
@@ -85,7 +82,7 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getFileHandler
   );
 
-  router.get(
+  routers.rbac.get(
     {
       path: EPM_API_ROUTES.INFO_PATTERN,
       validate: GetInfoRequestSchema,
@@ -94,34 +91,34 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
     getInfoHandler
   );
 
-  router.put(
+  routers.superuser.put(
     {
       path: EPM_API_ROUTES.INFO_PATTERN,
       validate: UpdatePackageRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(updatePackageHandler)
+    updatePackageHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: EPM_API_ROUTES.INSTALL_FROM_REGISTRY_PATTERN,
       validate: InstallPackageFromRegistryRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(installPackageFromRegistryHandler)
+    installPackageFromRegistryHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: EPM_API_ROUTES.BULK_INSTALL_PATTERN,
       validate: BulkUpgradePackagesFromRegistryRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(bulkInstallPackagesFromRegistryHandler)
+    bulkInstallPackagesFromRegistryHandler
   );
 
-  router.post(
+  routers.superuser.post(
     {
       path: EPM_API_ROUTES.INSTALL_BY_UPLOAD_PATTERN,
       validate: InstallPackageByUploadRequestSchema,
@@ -134,15 +131,15 @@ export const registerRoutes = (router: IRouter<FleetRequestHandlerContext>) => {
         },
       },
     },
-    enforceSuperUser(installPackageByUploadHandler)
+    installPackageByUploadHandler
   );
 
-  router.delete(
+  routers.superuser.delete(
     {
       path: EPM_API_ROUTES.DELETE_PATTERN,
       validate: DeletePackageRequestSchema,
       options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
-    enforceSuperUser(deletePackageHandler)
+    deletePackageHandler
   );
 };
diff --git a/x-pack/plugins/fleet/server/routes/security.test.ts b/x-pack/plugins/fleet/server/routes/security.test.ts
new file mode 100644
index 00000000000000..80ea142541530c
--- /dev/null
+++ b/x-pack/plugins/fleet/server/routes/security.test.ts
@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { IRouter, RequestHandler, RouteConfig } from '../../../../../src/core/server';
+import { coreMock } from '../../../../../src/core/server/mocks';
+import type { AuthenticatedUser } from '../../../security/server';
+import type { CheckPrivilegesDynamically } from '../../../security/server/authorization/check_privileges_dynamically';
+import { createAppContextStartContractMock } from '../mocks';
+import { appContextService } from '../services';
+
+import type { RouterWrapper } from './security';
+import { RouterWrappers } from './security';
+
+describe('RouterWrappers', () => {
+  const runTest = async ({
+    wrapper,
+    security: {
+      roles = [],
+      pluginEnabled = true,
+      licenseEnabled = true,
+      checkPrivilegesDynamically,
+    } = {},
+  }: {
+    wrapper: RouterWrapper;
+    security?: {
+      roles?: string[];
+      pluginEnabled?: boolean;
+      licenseEnabled?: boolean;
+      checkPrivilegesDynamically?: CheckPrivilegesDynamically;
+    };
+  }) => {
+    const fakeRouter = {
+      get: jest.fn(),
+    } as unknown as jest.Mocked<IRouter>;
+    const fakeHandler: RequestHandler = jest.fn((ctx, req, res) => res.ok());
+
+    const mockContext = createAppContextStartContractMock();
+    // @ts-expect-error type doesn't properly respect deeply mocked keys
+    mockContext.securityStart?.authz.actions.api.get.mockImplementation((priv) => `api:${priv}`);
+
+    if (!pluginEnabled) {
+      mockContext.securitySetup = undefined;
+      mockContext.securityStart = undefined;
+    } else {
+      mockContext.securityStart?.authc.getCurrentUser.mockReturnValue({
+        username: 'foo',
+        roles,
+      } as unknown as AuthenticatedUser);
+
+      mockContext.securitySetup?.license.isEnabled.mockReturnValue(licenseEnabled);
+      if (licenseEnabled) {
+        mockContext.securityStart?.authz.mode.useRbacForRequest.mockReturnValue(true);
+      }
+
+      if (checkPrivilegesDynamically) {
+        mockContext.securityStart?.authz.checkPrivilegesDynamicallyWithRequest.mockReturnValue(
+          checkPrivilegesDynamically
+        );
+      }
+    }
+
+    appContextService.start(mockContext);
+
+    const wrappedRouter = wrapper(fakeRouter);
+    wrappedRouter.get({} as RouteConfig<any, any, any, any>, fakeHandler);
+    const wrappedHandler = fakeRouter.get.mock.calls[0][1];
+    const resFactory = { forbidden: jest.fn(() => 'forbidden'), ok: jest.fn(() => 'ok') };
+    const res = await wrappedHandler(
+      { core: coreMock.createRequestHandlerContext() },
+      {} as any,
+      resFactory as any
+    );
+
+    return res as unknown as 'forbidden' | 'ok';
+  };
+
+  describe('require.superuser', () => {
+    it('allow users with the superuser role', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { roles: ['superuser'] },
+        })
+      ).toEqual('ok');
+    });
+
+    it('does not allow users without the superuser role', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { roles: ['foo'] },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security plugin to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { pluginEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security license to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.superuser,
+          security: { licenseEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+  });
+
+  describe('require.fleetSetupPrivilege', () => {
+    const mockCheckPrivileges: jest.Mock<
+      ReturnType<CheckPrivilegesDynamically>,
+      Parameters<CheckPrivilegesDynamically>
+    > = jest.fn().mockResolvedValue({ hasAllRequested: true });
+
+    it('executes custom authz check', async () => {
+      await runTest({
+        wrapper: RouterWrappers.require.fleetSetupPrivilege,
+        security: { checkPrivilegesDynamically: mockCheckPrivileges },
+      });
+      expect(mockCheckPrivileges).toHaveBeenCalledWith(
+        { kibana: ['api:fleet-setup'] },
+        {
+          requireLoginAction: false,
+        }
+      );
+    });
+
+    it('allow users with required privileges', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { checkPrivilegesDynamically: mockCheckPrivileges },
+        })
+      ).toEqual('ok');
+    });
+
+    it('does not allow users without required privileges', async () => {
+      mockCheckPrivileges.mockResolvedValueOnce({ hasAllRequested: false } as any);
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { checkPrivilegesDynamically: mockCheckPrivileges },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security plugin to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { pluginEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+
+    it('does not allow security license to be disabled', async () => {
+      expect(
+        await runTest({
+          wrapper: RouterWrappers.require.fleetSetupPrivilege,
+          security: { licenseEnabled: false },
+        })
+      ).toEqual('forbidden');
+    });
+  });
+});
diff --git a/x-pack/plugins/fleet/server/routes/security.ts b/x-pack/plugins/fleet/server/routes/security.ts
index 33a510c27f04ec..8a67a7066742a6 100644
--- a/x-pack/plugins/fleet/server/routes/security.ts
+++ b/x-pack/plugins/fleet/server/routes/security.ts
@@ -5,56 +5,137 @@
  * 2.0.
  */
 
-import type { IRouter, RequestHandler, RequestHandlerContext } from 'src/core/server';
+import type {
+  IRouter,
+  KibanaRequest,
+  RequestHandler,
+  RequestHandlerContext,
+} from 'src/core/server';
 
 import { appContextService } from '../services';
 
-export function enforceSuperUser<T1, T2, T3, TContext extends RequestHandlerContext>(
+const SUPERUSER_AUTHZ_MESSAGE =
+  'Access to Fleet API requires the superuser role and for stack security features to be enabled.';
+
+function checkSecurityEnabled() {
+  return appContextService.hasSecurity() && appContextService.getSecurityLicense().isEnabled();
+}
+
+function checkSuperuser(req: KibanaRequest) {
+  if (!checkSecurityEnabled()) {
+    return false;
+  }
+
+  const security = appContextService.getSecurity();
+  const user = security.authc.getCurrentUser(req);
+  if (!user) {
+    return false;
+  }
+
+  const userRoles = user.roles || [];
+  if (!userRoles.includes('superuser')) {
+    return false;
+  }
+
+  return true;
+}
+
+function enforceSuperuser<T1, T2, T3, TContext extends RequestHandlerContext>(
   handler: RequestHandler<T1, T2, T3, TContext>
 ): RequestHandler<T1, T2, T3, TContext> {
   return function enforceSuperHandler(context, req, res) {
-    if (!appContextService.hasSecurity() || !appContextService.getSecurityLicense().isEnabled()) {
+    const isSuperuser = checkSuperuser(req);
+    if (!isSuperuser) {
       return res.forbidden({
         body: {
-          message: `Access to this API requires that security is enabled`,
+          message: SUPERUSER_AUTHZ_MESSAGE,
         },
       });
     }
 
-    const security = appContextService.getSecurity();
-    const user = security.authc.getCurrentUser(req);
-    if (!user) {
-      return res.forbidden({
-        body: {
-          message:
-            'Access to Fleet API require the superuser role, and for stack security features to be enabled.',
-        },
-      });
-    }
+    return handler(context, req, res);
+  };
+}
 
-    const userRoles = user.roles || [];
-    if (!userRoles.includes('superuser')) {
-      return res.forbidden({
-        body: {
-          message: 'Access to Fleet API require the superuser role.',
-        },
-      });
+function makeRouterEnforcingSuperuser<TContext extends RequestHandlerContext>(
+  router: IRouter<TContext>
+): IRouter<TContext> {
+  return {
+    get: (options, handler) => router.get(options, enforceSuperuser(handler)),
+    delete: (options, handler) => router.delete(options, enforceSuperuser(handler)),
+    post: (options, handler) => router.post(options, enforceSuperuser(handler)),
+    put: (options, handler) => router.put(options, enforceSuperuser(handler)),
+    patch: (options, handler) => router.patch(options, enforceSuperuser(handler)),
+    handleLegacyErrors: (handler) => router.handleLegacyErrors(handler),
+    getRoutes: () => router.getRoutes(),
+    routerPath: router.routerPath,
+  };
+}
+
+async function checkFleetSetupPrivilege(req: KibanaRequest) {
+  if (!checkSecurityEnabled()) {
+    return false;
+  }
+
+  const security = appContextService.getSecurity();
+
+  if (security.authz.mode.useRbacForRequest(req)) {
+    const checkPrivileges = security.authz.checkPrivilegesDynamicallyWithRequest(req);
+    const { hasAllRequested } = await checkPrivileges(
+      { kibana: [security.authz.actions.api.get('fleet-setup')] },
+      { requireLoginAction: false } // exclude login access requirement
+    );
+
+    return !!hasAllRequested;
+  }
+
+  return true;
+}
+
+function enforceFleetSetupPrivilege<P, Q, B, TContext extends RequestHandlerContext>(
+  handler: RequestHandler<P, Q, B, TContext>
+): RequestHandler<P, Q, B, TContext> {
+  return async (context, req, res) => {
+    const hasFleetSetupPrivilege = await checkFleetSetupPrivilege(req);
+    if (!hasFleetSetupPrivilege) {
+      return res.forbidden({ body: { message: SUPERUSER_AUTHZ_MESSAGE } });
     }
+
     return handler(context, req, res);
   };
 }
 
-export function makeRouterEnforcingSuperuser<TContext extends RequestHandlerContext>(
+function makeRouterEnforcingFleetSetupPrivilege<TContext extends RequestHandlerContext>(
   router: IRouter<TContext>
 ): IRouter<TContext> {
   return {
-    get: (options, handler) => router.get(options, enforceSuperUser(handler)),
-    delete: (options, handler) => router.delete(options, enforceSuperUser(handler)),
-    post: (options, handler) => router.post(options, enforceSuperUser(handler)),
-    put: (options, handler) => router.put(options, enforceSuperUser(handler)),
-    patch: (options, handler) => router.patch(options, enforceSuperUser(handler)),
+    get: (options, handler) => router.get(options, enforceFleetSetupPrivilege(handler)),
+    delete: (options, handler) => router.delete(options, enforceFleetSetupPrivilege(handler)),
+    post: (options, handler) => router.post(options, enforceFleetSetupPrivilege(handler)),
+    put: (options, handler) => router.put(options, enforceFleetSetupPrivilege(handler)),
+    patch: (options, handler) => router.patch(options, enforceFleetSetupPrivilege(handler)),
     handleLegacyErrors: (handler) => router.handleLegacyErrors(handler),
     getRoutes: () => router.getRoutes(),
     routerPath: router.routerPath,
   };
 }
+
+export type RouterWrapper = <T extends RequestHandlerContext>(route: IRouter<T>) => IRouter<T>;
+
+interface RouterWrappersSetup {
+  require: {
+    superuser: RouterWrapper;
+    fleetSetupPrivilege: RouterWrapper;
+  };
+}
+
+export const RouterWrappers: RouterWrappersSetup = {
+  require: {
+    superuser: (router) => {
+      return makeRouterEnforcingSuperuser(router);
+    },
+    fleetSetupPrivilege: (router) => {
+      return makeRouterEnforcingFleetSetupPrivilege(router);
+    },
+  },
+};
diff --git a/x-pack/plugins/fleet/server/routes/setup/handlers.ts b/x-pack/plugins/fleet/server/routes/setup/handlers.ts
index c5b2ef0ade26fe..fad5d93c3f5d59 100644
--- a/x-pack/plugins/fleet/server/routes/setup/handlers.ts
+++ b/x-pack/plugins/fleet/server/routes/setup/handlers.ts
@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-import type { RequestHandler } from 'src/core/server';
-
 import { appContextService } from '../../services';
 import type { GetFleetStatusResponse, PostFleetSetupResponse } from '../../../common';
 import { setupFleet } from '../../services/setup';
@@ -14,12 +12,14 @@ import { hasFleetServers } from '../../services/fleet_server';
 import { defaultIngestErrorHandler } from '../../errors';
 import type { FleetRequestHandler } from '../../types';
 
-export const getFleetStatusHandler: RequestHandler = async (context, request, response) => {
+export const getFleetStatusHandler: FleetRequestHandler = async (context, request, response) => {
   try {
     const isApiKeysEnabled = await appContextService
       .getSecurity()
       .authc.apiKeys.areAPIKeysEnabled();
-    const isFleetServerSetup = await hasFleetServers(appContextService.getInternalUserESClient());
+    const isFleetServerSetup = await hasFleetServers(
+      context.core.elasticsearch.client.asInternalUser
+    );
 
     const missingRequirements: GetFleetStatusResponse['missing_requirements'] = [];
     if (!isApiKeysEnabled) {
diff --git a/x-pack/plugins/fleet/server/routes/setup/index.ts b/x-pack/plugins/fleet/server/routes/setup/index.ts
index 591b9c832172db..d191f1b78e9ae3 100644
--- a/x-pack/plugins/fleet/server/routes/setup/index.ts
+++ b/x-pack/plugins/fleet/server/routes/setup/index.ts
@@ -5,55 +5,48 @@
  * 2.0.
  */
 
-import type { IRouter } from 'src/core/server';
-
 import { PLUGIN_ID, AGENTS_SETUP_API_ROUTES, SETUP_API_ROUTE } from '../../constants';
 import type { FleetConfigType } from '../../../common';
 
-import type { FleetRequestHandlerContext } from '../../types/request_context';
+import type { FleetRouter } from '../../types/request_context';
 
 import { getFleetStatusHandler, fleetSetupHandler } from './handlers';
 
-export const registerFleetSetupRoute = (router: IRouter<FleetRequestHandlerContext>) => {
+export const registerFleetSetupRoute = (router: FleetRouter) => {
   router.post(
     {
       path: SETUP_API_ROUTE,
       validate: false,
-      // if this route is set to `-all`, a read-only user get a 404 for this route
-      // and will see `Unable to initialize Ingest Manager` in the UI
-      options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     fleetSetupHandler
   );
 };
 
 // That route is used by agent to setup Fleet
-export const registerCreateFleetSetupRoute = (router: IRouter<FleetRequestHandlerContext>) => {
+export const registerCreateFleetSetupRoute = (router: FleetRouter) => {
   router.post(
     {
       path: AGENTS_SETUP_API_ROUTES.CREATE_PATTERN,
       validate: false,
-      options: { tags: [`access:${PLUGIN_ID}-all`] },
     },
     fleetSetupHandler
   );
 };
 
-export const registerGetFleetStatusRoute = (router: IRouter<FleetRequestHandlerContext>) => {
+export const registerGetFleetStatusRoute = (router: FleetRouter) => {
   router.get(
     {
       path: AGENTS_SETUP_API_ROUTES.INFO_PATTERN,
       validate: false,
+      // Disable this tag and the automatic RBAC support until elastic/fleet-server access is removed in 8.0
+      // Required to allow elastic/fleet-server to access this API.
       options: { tags: [`access:${PLUGIN_ID}-read`] },
     },
     getFleetStatusHandler
   );
 };
 
-export const registerRoutes = (
-  router: IRouter<FleetRequestHandlerContext>,
-  config: FleetConfigType
-) => {
+export const registerRoutes = (router: FleetRouter, config: FleetConfigType) => {
   // Ingest manager setup
   registerFleetSetupRoute(router);
 
diff --git a/x-pack/plugins/fleet/server/types/request_context.ts b/x-pack/plugins/fleet/server/types/request_context.ts
index a3b414119b685b..0d0da9145f0736 100644
--- a/x-pack/plugins/fleet/server/types/request_context.ts
+++ b/x-pack/plugins/fleet/server/types/request_context.ts
@@ -11,6 +11,7 @@ import type {
   RequestHandlerContext,
   RouteMethod,
   SavedObjectsClientContract,
+  IRouter,
 } from '../../../../../src/core/server';
 
 /** @internal */
@@ -37,3 +38,9 @@ export type FleetRequestHandler<
   Method extends RouteMethod = any,
   ResponseFactory extends KibanaResponseFactory = KibanaResponseFactory
 > = RequestHandler<P, Q, B, FleetRequestHandlerContext, Method, ResponseFactory>;
+
+/**
+ * Convenience type for routers in Fleet that includes the FleetRequestHandlerContext type
+ * @internal
+ */
+export type FleetRouter = IRouter<FleetRequestHandlerContext>;
diff --git a/x-pack/plugins/security/server/authorization/check_privileges.test.ts b/x-pack/plugins/security/server/authorization/check_privileges.test.ts
index 75c8229bb37d69..d8906d91f152b7 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges.test.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges.test.ts
@@ -878,6 +878,42 @@ describe('#atSpace', () => {
       `);
     });
   });
+
+  test('omits login privilege when requireLoginAction: false', async () => {
+    const { mockClusterClient, mockScopedClusterClient } = createMockClusterClient({
+      has_all_requested: true,
+      username: 'foo-username',
+      index: {},
+      application: {
+        [application]: {
+          'space:space_1': {
+            [mockActions.version]: true,
+          },
+        },
+      },
+    });
+    const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
+      mockActions,
+      () => Promise.resolve(mockClusterClient),
+      application
+    );
+    const request = httpServerMock.createKibanaRequest();
+    const checkPrivileges = checkPrivilegesWithRequest(request);
+    await checkPrivileges.atSpace('space_1', {}, { requireLoginAction: false });
+
+    expect(mockScopedClusterClient.asCurrentUser.security.hasPrivileges).toHaveBeenCalledWith({
+      body: {
+        index: [],
+        application: [
+          {
+            application,
+            resources: [`space:space_1`],
+            privileges: [mockActions.version],
+          },
+        ],
+      },
+    });
+  });
 });
 
 describe('#atSpaces', () => {
@@ -2083,6 +2119,42 @@ describe('#atSpaces', () => {
       `);
     });
   });
+
+  test('omits login privilege when requireLoginAction: false', async () => {
+    const { mockClusterClient, mockScopedClusterClient } = createMockClusterClient({
+      has_all_requested: true,
+      username: 'foo-username',
+      index: {},
+      application: {
+        [application]: {
+          'space:space_1': {
+            [mockActions.version]: true,
+          },
+        },
+      },
+    });
+    const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
+      mockActions,
+      () => Promise.resolve(mockClusterClient),
+      application
+    );
+    const request = httpServerMock.createKibanaRequest();
+    const checkPrivileges = checkPrivilegesWithRequest(request);
+    await checkPrivileges.atSpaces(['space_1'], {}, { requireLoginAction: false });
+
+    expect(mockScopedClusterClient.asCurrentUser.security.hasPrivileges).toHaveBeenCalledWith({
+      body: {
+        index: [],
+        application: [
+          {
+            application,
+            resources: [`space:space_1`],
+            privileges: [mockActions.version],
+          },
+        ],
+      },
+    });
+  });
 });
 
 describe('#globally', () => {
@@ -2937,4 +3009,40 @@ describe('#globally', () => {
       `);
     });
   });
+
+  test('omits login privilege when requireLoginAction: false', async () => {
+    const { mockClusterClient, mockScopedClusterClient } = createMockClusterClient({
+      has_all_requested: true,
+      username: 'foo-username',
+      index: {},
+      application: {
+        [application]: {
+          [GLOBAL_RESOURCE]: {
+            [mockActions.version]: true,
+          },
+        },
+      },
+    });
+    const checkPrivilegesWithRequest = checkPrivilegesWithRequestFactory(
+      mockActions,
+      () => Promise.resolve(mockClusterClient),
+      application
+    );
+    const request = httpServerMock.createKibanaRequest();
+    const checkPrivileges = checkPrivilegesWithRequest(request);
+    await checkPrivileges.globally({}, { requireLoginAction: false });
+
+    expect(mockScopedClusterClient.asCurrentUser.security.hasPrivileges).toHaveBeenCalledWith({
+      body: {
+        index: [],
+        application: [
+          {
+            application,
+            resources: [GLOBAL_RESOURCE],
+            privileges: [mockActions.version],
+          },
+        ],
+      },
+    });
+  });
 });
diff --git a/x-pack/plugins/security/server/authorization/check_privileges.ts b/x-pack/plugins/security/server/authorization/check_privileges.ts
index 3a35cf164ad85c..36c364f1ff7daf 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges.ts
@@ -13,6 +13,7 @@ import { GLOBAL_RESOURCE } from '../../common/constants';
 import { ResourceSerializer } from './resource_serializer';
 import type {
   CheckPrivileges,
+  CheckPrivilegesOptions,
   CheckPrivilegesPayload,
   CheckPrivilegesResponse,
   HasPrivilegesResponse,
@@ -41,14 +42,20 @@ export function checkPrivilegesWithRequestFactory(
   return function checkPrivilegesWithRequest(request: KibanaRequest): CheckPrivileges {
     const checkPrivilegesAtResources = async (
       resources: string[],
-      privileges: CheckPrivilegesPayload
+      privileges: CheckPrivilegesPayload,
+      { requireLoginAction = true }: CheckPrivilegesOptions = {}
     ): Promise<CheckPrivilegesResponse> => {
       const kibanaPrivileges = Array.isArray(privileges.kibana)
         ? privileges.kibana
         : privileges.kibana
         ? [privileges.kibana]
         : [];
-      const allApplicationPrivileges = uniq([actions.version, actions.login, ...kibanaPrivileges]);
+
+      const allApplicationPrivileges = uniq([
+        actions.version,
+        ...(requireLoginAction ? [actions.login] : []),
+        ...kibanaPrivileges,
+      ]);
 
       const clusterClient = await getClusterClient();
       const { body } = await clusterClient.asScoped(request).asCurrentUser.security.hasPrivileges({
@@ -135,18 +142,26 @@ export function checkPrivilegesWithRequestFactory(
     };
 
     return {
-      async atSpace(spaceId: string, privileges: CheckPrivilegesPayload) {
+      async atSpace(
+        spaceId: string,
+        privileges: CheckPrivilegesPayload,
+        options?: CheckPrivilegesOptions
+      ) {
         const spaceResource = ResourceSerializer.serializeSpaceResource(spaceId);
-        return await checkPrivilegesAtResources([spaceResource], privileges);
+        return await checkPrivilegesAtResources([spaceResource], privileges, options);
       },
-      async atSpaces(spaceIds: string[], privileges: CheckPrivilegesPayload) {
+      async atSpaces(
+        spaceIds: string[],
+        privileges: CheckPrivilegesPayload,
+        options?: CheckPrivilegesOptions
+      ) {
         const spaceResources = spaceIds.map((spaceId) =>
           ResourceSerializer.serializeSpaceResource(spaceId)
         );
-        return await checkPrivilegesAtResources(spaceResources, privileges);
+        return await checkPrivilegesAtResources(spaceResources, privileges, options);
       },
-      async globally(privileges: CheckPrivilegesPayload) {
-        return await checkPrivilegesAtResources([GLOBAL_RESOURCE], privileges);
+      async globally(privileges: CheckPrivilegesPayload, options?: CheckPrivilegesOptions) {
+        return await checkPrivilegesAtResources([GLOBAL_RESOURCE], privileges, options);
       },
     };
   };
diff --git a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts
index 547782bbd1ba1e..9fd14c6d298066 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.test.ts
@@ -8,6 +8,7 @@
 import { httpServerMock } from 'src/core/server/mocks';
 
 import { checkPrivilegesDynamicallyWithRequestFactory } from './check_privileges_dynamically';
+import type { CheckPrivilegesOptions } from './types';
 
 test(`checkPrivileges.atSpace when spaces is enabled`, async () => {
   const expectedResult = Symbol();
@@ -25,13 +26,18 @@ test(`checkPrivileges.atSpace when spaces is enabled`, async () => {
       namespaceToSpaceId: jest.fn(),
     })
   )(request);
-  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges });
+  const options: CheckPrivilegesOptions = { requireLoginAction: true };
+  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges }, options);
 
   expect(result).toBe(expectedResult);
   expect(mockCheckPrivilegesWithRequest).toHaveBeenCalledWith(request);
-  expect(mockCheckPrivileges.atSpace).toHaveBeenCalledWith(spaceId, {
-    kibana: privilegeOrPrivileges,
-  });
+  expect(mockCheckPrivileges.atSpace).toHaveBeenCalledWith(
+    spaceId,
+    {
+      kibana: privilegeOrPrivileges,
+    },
+    options
+  );
 });
 
 test(`checkPrivileges.globally when spaces is disabled`, async () => {
@@ -46,9 +52,13 @@ test(`checkPrivileges.globally when spaces is disabled`, async () => {
     mockCheckPrivilegesWithRequest,
     () => undefined
   )(request);
-  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges });
+  const options: CheckPrivilegesOptions = { requireLoginAction: true };
+  const result = await checkPrivilegesDynamically({ kibana: privilegeOrPrivileges }, options);
 
   expect(result).toBe(expectedResult);
   expect(mockCheckPrivilegesWithRequest).toHaveBeenCalledWith(request);
-  expect(mockCheckPrivileges.globally).toHaveBeenCalledWith({ kibana: privilegeOrPrivileges });
+  expect(mockCheckPrivileges.globally).toHaveBeenCalledWith(
+    { kibana: privilegeOrPrivileges },
+    options
+  );
 });
diff --git a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts
index 4ce59c87062702..d4e335ba040583 100644
--- a/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts
+++ b/x-pack/plugins/security/server/authorization/check_privileges_dynamically.ts
@@ -9,13 +9,15 @@ import type { KibanaRequest } from 'src/core/server';
 
 import type { SpacesService } from '../plugin';
 import type {
+  CheckPrivilegesOptions,
   CheckPrivilegesPayload,
   CheckPrivilegesResponse,
   CheckPrivilegesWithRequest,
 } from './types';
 
 export type CheckPrivilegesDynamically = (
-  privileges: CheckPrivilegesPayload
+  privileges: CheckPrivilegesPayload,
+  options?: CheckPrivilegesOptions
 ) => Promise<CheckPrivilegesResponse>;
 
 export type CheckPrivilegesDynamicallyWithRequest = (
@@ -28,11 +30,15 @@ export function checkPrivilegesDynamicallyWithRequestFactory(
 ): CheckPrivilegesDynamicallyWithRequest {
   return function checkPrivilegesDynamicallyWithRequest(request: KibanaRequest) {
     const checkPrivileges = checkPrivilegesWithRequest(request);
-    return async function checkPrivilegesDynamically(privileges: CheckPrivilegesPayload) {
+
+    return async function checkPrivilegesDynamically(
+      privileges: CheckPrivilegesPayload,
+      options?: CheckPrivilegesOptions
+    ) {
       const spacesService = getSpacesService();
       return spacesService
-        ? await checkPrivileges.atSpace(spacesService.getSpaceId(request), privileges)
-        : await checkPrivileges.globally(privileges);
+        ? await checkPrivileges.atSpace(spacesService.getSpaceId(request), privileges, options)
+        : await checkPrivileges.globally(privileges, options);
     };
   };
 }
diff --git a/x-pack/plugins/security/server/authorization/types.ts b/x-pack/plugins/security/server/authorization/types.ts
index 8bfe8928406373..aee059fb8becb6 100644
--- a/x-pack/plugins/security/server/authorization/types.ts
+++ b/x-pack/plugins/security/server/authorization/types.ts
@@ -29,6 +29,18 @@ export interface HasPrivilegesResponse {
   };
 }
 
+/**
+ * Options to influce the privilege checks.
+ */
+export interface CheckPrivilegesOptions {
+  /**
+   * Whether or not the `login` action should be required (default: true).
+   * Setting this to false is not advised except for special circumstances, when you do not require
+   * the request to belong to a user capable of logging into Kibana.
+   */
+  requireLoginAction?: boolean;
+}
+
 export interface CheckPrivilegesResponse {
   hasAllRequested: boolean;
   username: string;
@@ -59,12 +71,20 @@ export interface CheckPrivilegesResponse {
 export type CheckPrivilegesWithRequest = (request: KibanaRequest) => CheckPrivileges;
 
 export interface CheckPrivileges {
-  atSpace(spaceId: string, privileges: CheckPrivilegesPayload): Promise<CheckPrivilegesResponse>;
+  atSpace(
+    spaceId: string,
+    privileges: CheckPrivilegesPayload,
+    options?: CheckPrivilegesOptions
+  ): Promise<CheckPrivilegesResponse>;
   atSpaces(
     spaceIds: string[],
-    privileges: CheckPrivilegesPayload
+    privileges: CheckPrivilegesPayload,
+    options?: CheckPrivilegesOptions
+  ): Promise<CheckPrivilegesResponse>;
+  globally(
+    privileges: CheckPrivilegesPayload,
+    options?: CheckPrivilegesOptions
   ): Promise<CheckPrivilegesResponse>;
-  globally(privileges: CheckPrivilegesPayload): Promise<CheckPrivilegesResponse>;
 }
 
 export interface CheckPrivilegesPayload {
diff --git a/x-pack/test/api_integration/apis/security/privileges.ts b/x-pack/test/api_integration/apis/security/privileges.ts
index 762fc1642a87ab..f234855b84e179 100644
--- a/x-pack/test/api_integration/apis/security/privileges.ts
+++ b/x-pack/test/api_integration/apis/security/privileges.ts
@@ -73,7 +73,7 @@ export default function ({ getService }: FtrProviderContext) {
               'packs_read',
             ],
           },
-          reserved: ['ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
+          reserved: ['fleet-setup', 'ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
         };
 
         await supertest
diff --git a/x-pack/test/api_integration/apis/security/privileges_basic.ts b/x-pack/test/api_integration/apis/security/privileges_basic.ts
index 0efaa25ee57da0..ac69bfcd9d5d4c 100644
--- a/x-pack/test/api_integration/apis/security/privileges_basic.ts
+++ b/x-pack/test/api_integration/apis/security/privileges_basic.ts
@@ -45,7 +45,7 @@ export default function ({ getService }: FtrProviderContext) {
           },
           global: ['all', 'read'],
           space: ['all', 'read'],
-          reserved: ['ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
+          reserved: ['fleet-setup', 'ml_user', 'ml_admin', 'ml_apm_user', 'monitoring'],
         };
 
         await supertest
diff --git a/x-pack/test/fleet_api_integration/apis/agents/services.ts b/x-pack/test/fleet_api_integration/apis/agents/services.ts
index be5d2d438f76f7..0e28ad647bbc48 100644
--- a/x-pack/test/fleet_api_integration/apis/agents/services.ts
+++ b/x-pack/test/fleet_api_integration/apis/agents/services.ts
@@ -32,12 +32,30 @@ export function getEsClientForAPIKey({ getService }: FtrProviderContext, esApiKe
   });
 }
 
-export function setupFleetAndAgents({ getService }: FtrProviderContext) {
+export function setupFleetAndAgents(providerContext: FtrProviderContext) {
   before(async () => {
-    await getService('supertest').post(`/api/fleet/setup`).set('kbn-xsrf', 'xxx').send();
-    await getService('supertest')
+    // Use elastic/fleet-server service account to execute setup to verify privilege configuration
+    const es = providerContext.getService('es');
+    const {
+      body: { token },
+      // @ts-expect-error SecurityCreateServiceTokenRequest should not require `name`
+    } = await es.security.createServiceToken({
+      namespace: 'elastic',
+      service: 'fleet-server',
+    });
+    const supetestWithoutAuth = getSupertestWithoutAuth(providerContext);
+
+    await supetestWithoutAuth
+      .post(`/api/fleet/setup`)
+      .set('kbn-xsrf', 'xxx')
+      .set('Authorization', `Bearer ${token.value}`)
+      .send()
+      .expect(200);
+    await supetestWithoutAuth
       .post(`/api/fleet/agents/setup`)
       .set('kbn-xsrf', 'xxx')
-      .send({ forceRecreate: true });
+      .set('Authorization', `Bearer ${token.value}`)
+      .send({ forceRecreate: true })
+      .expect(200);
   });
 }
diff --git a/x-pack/test/fleet_api_integration/apis/epm/setup.ts b/x-pack/test/fleet_api_integration/apis/epm/setup.ts
index 8567cf8069c587..051636ad11f5ad 100644
--- a/x-pack/test/fleet_api_integration/apis/epm/setup.ts
+++ b/x-pack/test/fleet_api_integration/apis/epm/setup.ts
@@ -14,7 +14,9 @@ import { setupFleetAndAgents } from '../agents/services';
 export default function (providerContext: FtrProviderContext) {
   const { getService } = providerContext;
   const supertest = getService('supertest');
+  const supertestWithoutAuth = getService('supertestWithoutAuth');
   const log = getService('log');
+  const es = getService('es');
 
   describe('setup api', async () => {
     skipIfNoDockerRegistry(providerContext);
@@ -47,5 +49,48 @@ export default function (providerContext: FtrProviderContext) {
         );
       });
     });
+
+    it('allows elastic/fleet-server user to call required APIs', async () => {
+      const {
+        body: { token },
+        // @ts-expect-error SecurityCreateServiceTokenRequest should not require `name`
+      } = await es.security.createServiceToken({
+        namespace: 'elastic',
+        service: 'fleet-server',
+      });
+
+      // elastic/fleet-server needs access to these APIs:
+      // POST /api/fleet/setup
+      // POST /api/fleet/agents/setup
+      // GET /api/fleet/agent_policies
+      // GET /api/fleet/enrollment-api-keys
+      // GET /api/fleet/enrollment-api-keys/<id>
+      await supertestWithoutAuth
+        .post('/api/fleet/setup')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      await supertestWithoutAuth
+        .post('/api/fleet/agents/setup')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      await supertestWithoutAuth
+        .get('/api/fleet/agent_policies')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      const response = await supertestWithoutAuth
+        .get('/api/fleet/enrollment-api-keys')
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+      const enrollmentApiKeyId = response.body.list[0].id;
+      await supertestWithoutAuth
+        .get(`/api/fleet/enrollment-api-keys/${enrollmentApiKeyId}`)
+        .set('Authorization', `Bearer ${token.value}`)
+        .set('kbn-xsrf', 'xxx')
+        .expect(200);
+    });
   });
 }

From f6a9afea6165c6072bd0c3fdf00439b7a98de1fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Loix?= <sabee77@gmail.com>
Date: Tue, 19 Oct 2021 11:33:57 +0100
Subject: [PATCH 03/10] [Stack management apps] Deprecate "enabled" Kibana
 setting (#114768)

---
 docs/dev-tools/console/console.asciidoc       |   9 +
 docs/setup/settings.asciidoc                  |  34 +++
 src/plugins/console/public/index.ts           |   7 +-
 src/plugins/console/public/plugin.ts          | 122 ++++++-----
 src/plugins/console/public/types/config.ts    |  13 ++
 src/plugins/console/public/types/index.ts     |   2 +
 src/plugins/console/public/types/locator.ts   |  12 ++
 .../public/types/plugin_dependencies.ts       |   8 +-
 src/plugins/console/server/config.ts          | 199 ++++++++++++++----
 src/plugins/console/server/index.ts           |   1 +
 src/plugins/console/server/plugin.ts          |  10 +-
 .../components/manage_data/manage_data.tsx    |   3 +-
 .../components/details/req_code_viewer.tsx    |  12 +-
 .../common/constants/index.ts                 |   2 +
 .../server/config.ts                          |  96 ++++++++-
 .../cross_cluster_replication/server/index.ts |  13 +-
 .../common/constants/index.ts                 |   2 +
 .../server/config.ts                          |  96 ++++++++-
 .../server/index.ts                           |  13 +-
 .../plugins/index_management/public/plugin.ts |  50 +++--
 .../plugins/index_management/public/types.ts  |   6 +
 .../plugins/index_management/server/config.ts |  89 +++++++-
 .../plugins/index_management/server/index.ts  |  10 +-
 .../common/constants/index.ts                 |   2 +-
 .../common/constants/plugin.ts                |   2 +
 .../license_management/server/config.ts       |  90 +++++++-
 .../license_management/server/index.ts        |  13 +-
 .../remote_clusters/common/constants.ts       |   2 +
 .../plugins/remote_clusters/server/config.ts  |  89 +++++++-
 .../plugins/remote_clusters/server/plugin.ts  |   4 +-
 x-pack/plugins/rollup/common/index.ts         |   2 +
 x-pack/plugins/rollup/public/index.ts         |   3 +-
 x-pack/plugins/rollup/public/plugin.ts        |  57 ++---
 x-pack/plugins/rollup/public/types.ts         |  12 ++
 x-pack/plugins/rollup/server/config.ts        |  89 +++++++-
 x-pack/plugins/rollup/server/index.ts         |  10 +-
 .../snapshot_restore/common/constants.ts      |   2 +
 .../plugins/snapshot_restore/public/plugin.ts |  84 ++++----
 .../plugins/snapshot_restore/public/types.ts  |   1 +
 .../plugins/snapshot_restore/server/config.ts |  98 ++++++++-
 .../plugins/snapshot_restore/server/index.ts  |  13 +-
 .../plugins/snapshot_restore/server/plugin.ts |   9 +-
 .../client_integration/helpers/index.ts       |   2 +-
 .../helpers/setup_environment.tsx             |  12 +-
 .../overview/overview.test.tsx                |   5 +-
 .../upgrade_assistant/common/config.ts        |  20 --
 .../upgrade_assistant/common/constants.ts     |   6 +-
 .../reindex/flyout/warning_step.test.tsx      |  18 +-
 .../upgrade_assistant/public/plugin.ts        |  88 ++++----
 .../plugins/upgrade_assistant/public/types.ts |   7 +
 .../upgrade_assistant/server/config.ts        | 107 ++++++++++
 .../plugins/upgrade_assistant/server/index.ts |  13 +-
 .../server/lib/__fixtures__/version.ts        |   8 +-
 .../server/lib/es_version_precheck.test.ts    |   4 +-
 .../lib/reindexing/index_settings.test.ts     |   8 +-
 .../lib/reindexing/reindex_actions.test.ts    |   4 +-
 .../lib/reindexing/reindex_service.test.ts    |   4 +-
 57 files changed, 1279 insertions(+), 418 deletions(-)
 create mode 100644 src/plugins/console/public/types/config.ts
 create mode 100644 src/plugins/console/public/types/locator.ts
 create mode 100644 x-pack/plugins/rollup/public/types.ts
 delete mode 100644 x-pack/plugins/upgrade_assistant/common/config.ts
 create mode 100644 x-pack/plugins/upgrade_assistant/server/config.ts

diff --git a/docs/dev-tools/console/console.asciidoc b/docs/dev-tools/console/console.asciidoc
index 48fe936dd2db5e..21334c31011f44 100644
--- a/docs/dev-tools/console/console.asciidoc
+++ b/docs/dev-tools/console/console.asciidoc
@@ -129,3 +129,12 @@ image::dev-tools/console/images/console-settings.png["Console Settings", width=6
 
 For a list of available keyboard
 shortcuts, click *Help*.
+
+[float]
+[[console-settings]]
+=== Disable Console
+
+If you don’t want to use *Console*, you can disable it by setting `console.ui.enabled`
+to `false` in your `kibana.yml` configuration file. Changing this setting
+causes the server to regenerate assets on the next startup,
+which might cause a delay before pages start being served.
\ No newline at end of file
diff --git a/docs/setup/settings.asciidoc b/docs/setup/settings.asciidoc
index 4802a4da8182c0..af22ad4ad157f8 100644
--- a/docs/setup/settings.asciidoc
+++ b/docs/setup/settings.asciidoc
@@ -20,6 +20,11 @@ configuration using `${MY_ENV_VAR}` syntax.
 [cols="2*<"]
 |===
 
+| `console.ui.enabled:`
+Toggling this causes the server to regenerate assets on the next startup,
+which may cause a delay before pages start being served.
+Set to `false` to disable Console. *Default: `true`*
+
 | `csp.rules:`
  | deprecated:[7.14.0,"In 8.0 and later, this setting will no longer be supported."]
 A https://w3c.github.io/webappsec-csp/[Content Security Policy] template
@@ -681,6 +686,10 @@ out through *Advanced Settings*. *Default: `true`*
  | Set this value to true to allow Vega to use any URL to access external data
 sources and images. When false, Vega can only get data from {es}. *Default: `false`*
 
+| `xpack.ccr.ui.enabled`
+Set this value to false to disable the Cross-Cluster Replication UI.
+*Default: `true`*
+
 |[[settings-explore-data-in-context]] `xpack.discoverEnhanced.actions.`
 `exploreDataInContextMenu.enabled`
  | Enables the *Explore underlying data* option that allows you to open *Discover* from a dashboard panel and view the panel data. *Default: `false`*
@@ -689,6 +698,31 @@ sources and images. When false, Vega can only get data from {es}. *Default: `fal
 `exploreDataInChart.enabled`
  | Enables you to view the underlying documents in a data series from a dashboard panel. *Default: `false`*
 
+| `xpack.ilm.ui.enabled`
+Set this value to false to disable the Index Lifecycle Policies UI.
+*Default: `true`*
+
+| `xpack.index_management.ui.enabled`
+Set this value to false to disable the Index Management UI.
+*Default: `true`*
+
+| `xpack.license_management.ui.enabled`
+Set this value to false to disable the License Management UI.
+*Default: `true`*
+
+| `xpack.remote_clusters.ui.enabled`
+Set this value to false to disable the Remote Clusters UI.
+*Default: `true`*
+
+| `xpack.rollup.ui.enabled:`
+Set this value to false to disable the Rollup Jobs UI. *Default: true*
+
+| `xpack.snapshot_restore.ui.enabled:`
+Set this value to false to disable the Snapshot and Restore UI. *Default: true*
+
+| `xpack.upgrade_assistant.ui.enabled:`
+Set this value to false to disable the Upgrade Assistant UI. *Default: true*
+
 | `i18n.locale` {ess-icon}
  | Set this value to change the {kib} interface language.
 Valid locales are: `en`, `zh-CN`, `ja-JP`. *Default: `en`*
diff --git a/src/plugins/console/public/index.ts b/src/plugins/console/public/index.ts
index 8c4a107108565d..9a9c5896cd26d9 100644
--- a/src/plugins/console/public/index.ts
+++ b/src/plugins/console/public/index.ts
@@ -7,13 +7,14 @@
  */
 
 import './index.scss';
+import { PluginInitializerContext } from 'src/core/public';
 
 import { ConsoleUIPlugin } from './plugin';
 
-export type { ConsoleUILocatorParams } from './plugin';
+export type { ConsoleUILocatorParams, ConsolePluginSetup } from './types';
 
 export { ConsoleUIPlugin as Plugin };
 
-export function plugin() {
-  return new ConsoleUIPlugin();
+export function plugin(ctx: PluginInitializerContext) {
+  return new ConsoleUIPlugin(ctx);
 }
diff --git a/src/plugins/console/public/plugin.ts b/src/plugins/console/public/plugin.ts
index e3791df6a2db69..d61769c23dfe0c 100644
--- a/src/plugins/console/public/plugin.ts
+++ b/src/plugins/console/public/plugin.ts
@@ -7,77 +7,87 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { SerializableRecord } from '@kbn/utility-types';
-import { Plugin, CoreSetup } from 'src/core/public';
+import { Plugin, CoreSetup, PluginInitializerContext } from 'src/core/public';
 
 import { FeatureCatalogueCategory } from '../../home/public';
-import { AppSetupUIPluginDependencies } from './types';
-
-export interface ConsoleUILocatorParams extends SerializableRecord {
-  loadFrom?: string;
-}
+import {
+  AppSetupUIPluginDependencies,
+  ClientConfigType,
+  ConsolePluginSetup,
+  ConsoleUILocatorParams,
+} from './types';
 
 export class ConsoleUIPlugin implements Plugin<void, void, AppSetupUIPluginDependencies> {
+  constructor(private ctx: PluginInitializerContext) {}
+
   public setup(
     { notifications, getStartServices, http }: CoreSetup,
     { devTools, home, share, usageCollection }: AppSetupUIPluginDependencies
-  ) {
-    if (home) {
-      home.featureCatalogue.register({
+  ): ConsolePluginSetup {
+    const {
+      ui: { enabled: isConsoleUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
+
+    if (isConsoleUiEnabled) {
+      if (home) {
+        home.featureCatalogue.register({
+          id: 'console',
+          title: i18n.translate('console.devToolsTitle', {
+            defaultMessage: 'Interact with the Elasticsearch API',
+          }),
+          description: i18n.translate('console.devToolsDescription', {
+            defaultMessage: 'Skip cURL and use a JSON interface to work with your data in Console.',
+          }),
+          icon: 'consoleApp',
+          path: '/app/dev_tools#/console',
+          showOnHomePage: false,
+          category: FeatureCatalogueCategory.ADMIN,
+        });
+      }
+
+      devTools.register({
         id: 'console',
-        title: i18n.translate('console.devToolsTitle', {
-          defaultMessage: 'Interact with the Elasticsearch API',
-        }),
-        description: i18n.translate('console.devToolsDescription', {
-          defaultMessage: 'Skip cURL and use a JSON interface to work with your data in Console.',
+        order: 1,
+        title: i18n.translate('console.consoleDisplayName', {
+          defaultMessage: 'Console',
         }),
-        icon: 'consoleApp',
-        path: '/app/dev_tools#/console',
-        showOnHomePage: false,
-        category: FeatureCatalogueCategory.ADMIN,
-      });
-    }
+        enableRouting: false,
+        mount: async ({ element }) => {
+          const [core] = await getStartServices();
 
-    devTools.register({
-      id: 'console',
-      order: 1,
-      title: i18n.translate('console.consoleDisplayName', {
-        defaultMessage: 'Console',
-      }),
-      enableRouting: false,
-      mount: async ({ element }) => {
-        const [core] = await getStartServices();
+          const {
+            i18n: { Context: I18nContext },
+            docLinks: { DOC_LINK_VERSION },
+          } = core;
 
-        const {
-          i18n: { Context: I18nContext },
-          docLinks: { DOC_LINK_VERSION },
-        } = core;
+          const { renderApp } = await import('./application');
 
-        const { renderApp } = await import('./application');
+          return renderApp({
+            http,
+            docLinkVersion: DOC_LINK_VERSION,
+            I18nContext,
+            notifications,
+            usageCollection,
+            element,
+          });
+        },
+      });
 
-        return renderApp({
-          http,
-          docLinkVersion: DOC_LINK_VERSION,
-          I18nContext,
-          notifications,
-          usageCollection,
-          element,
-        });
-      },
-    });
+      const locator = share.url.locators.create<ConsoleUILocatorParams>({
+        id: 'CONSOLE_APP_LOCATOR',
+        getLocation: async ({ loadFrom }) => {
+          return {
+            app: 'dev_tools',
+            path: `#/console${loadFrom ? `?load_from=${loadFrom}` : ''}`,
+            state: { loadFrom },
+          };
+        },
+      });
 
-    const locator = share.url.locators.create<ConsoleUILocatorParams>({
-      id: 'CONSOLE_APP_LOCATOR',
-      getLocation: async ({ loadFrom }) => {
-        return {
-          app: 'dev_tools',
-          path: `#/console${loadFrom ? `?load_from=${loadFrom}` : ''}`,
-          state: { loadFrom },
-        };
-      },
-    });
+      return { locator };
+    }
 
-    return { locator };
+    return {};
   }
 
   public start() {}
diff --git a/src/plugins/console/public/types/config.ts b/src/plugins/console/public/types/config.ts
new file mode 100644
index 00000000000000..da41eef6f54847
--- /dev/null
+++ b/src/plugins/console/public/types/config.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export interface ClientConfigType {
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/src/plugins/console/public/types/index.ts b/src/plugins/console/public/types/index.ts
index b98adbf5610cd7..d8b6aaf7b12c45 100644
--- a/src/plugins/console/public/types/index.ts
+++ b/src/plugins/console/public/types/index.ts
@@ -11,3 +11,5 @@ export * from './core_editor';
 export * from './token';
 export * from './tokens_provider';
 export * from './common';
+export { ClientConfigType } from './config';
+export { ConsoleUILocatorParams } from './locator';
diff --git a/src/plugins/console/public/types/locator.ts b/src/plugins/console/public/types/locator.ts
new file mode 100644
index 00000000000000..f3a42338aaadcb
--- /dev/null
+++ b/src/plugins/console/public/types/locator.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+import { SerializableRecord } from '@kbn/utility-types';
+
+export interface ConsoleUILocatorParams extends SerializableRecord {
+  loadFrom?: string;
+}
diff --git a/src/plugins/console/public/types/plugin_dependencies.ts b/src/plugins/console/public/types/plugin_dependencies.ts
index 444776f47ea13f..afc49f9a5a986b 100644
--- a/src/plugins/console/public/types/plugin_dependencies.ts
+++ b/src/plugins/console/public/types/plugin_dependencies.ts
@@ -9,7 +9,9 @@
 import { HomePublicPluginSetup } from '../../../home/public';
 import { DevToolsSetup } from '../../../dev_tools/public';
 import { UsageCollectionSetup } from '../../../usage_collection/public';
-import { SharePluginSetup } from '../../../share/public';
+import { SharePluginSetup, LocatorPublic } from '../../../share/public';
+
+import { ConsoleUILocatorParams } from './locator';
 
 export interface AppSetupUIPluginDependencies {
   home?: HomePublicPluginSetup;
@@ -17,3 +19,7 @@ export interface AppSetupUIPluginDependencies {
   share: SharePluginSetup;
   usageCollection?: UsageCollectionSetup;
 }
+
+export interface ConsolePluginSetup {
+  locator?: LocatorPublic<ConsoleUILocatorParams>;
+}
diff --git a/src/plugins/console/server/config.ts b/src/plugins/console/server/config.ts
index 6d667fed081e88..024777aa8d2528 100644
--- a/src/plugins/console/server/config.ts
+++ b/src/plugins/console/server/config.ts
@@ -7,6 +7,8 @@
  */
 
 import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
 import { PluginConfigDescriptor } from 'kibana/server';
 
@@ -14,62 +16,171 @@ import { MAJOR_VERSION } from '../common/constants';
 
 const kibanaVersion = new SemVer(MAJOR_VERSION);
 
-const baseSettings = {
-  enabled: schema.boolean({ defaultValue: true }),
-  ssl: schema.object({ verify: schema.boolean({ defaultValue: false }) }, {}),
-};
-
-// Settings only available in 7.x
-const deprecatedSettings = {
-  proxyFilter: schema.arrayOf(schema.string(), { defaultValue: ['.*'] }),
-  proxyConfig: schema.arrayOf(
-    schema.object({
-      match: schema.object({
-        protocol: schema.string({ defaultValue: '*' }),
-        host: schema.string({ defaultValue: '*' }),
-        port: schema.string({ defaultValue: '*' }),
-        path: schema.string({ defaultValue: '*' }),
-      }),
-
-      timeout: schema.number(),
-      ssl: schema.object(
-        {
-          verify: schema.boolean(),
-          ca: schema.arrayOf(schema.string()),
-          cert: schema.string(),
-          key: schema.string(),
-        },
-        { defaultValue: undefined }
-      ),
-    }),
-    { defaultValue: [] }
-  ),
-};
-
-const configSchema = schema.object(
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
   {
-    ...baseSettings,
+    ssl: schema.object({ verify: schema.boolean({ defaultValue: false }) }, {}),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
   },
   { defaultValue: undefined }
 );
 
-const configSchema7x = schema.object(
+const configLatest: PluginConfigDescriptor<ConsoleConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type ConsoleConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
   {
-    ...baseSettings,
-    ...deprecatedSettings,
+    enabled: schema.boolean({ defaultValue: true }),
+    proxyFilter: schema.arrayOf(schema.string(), { defaultValue: ['.*'] }),
+    proxyConfig: schema.arrayOf(
+      schema.object({
+        match: schema.object({
+          protocol: schema.string({ defaultValue: '*' }),
+          host: schema.string({ defaultValue: '*' }),
+          port: schema.string({ defaultValue: '*' }),
+          path: schema.string({ defaultValue: '*' }),
+        }),
+
+        timeout: schema.number(),
+        ssl: schema.object(
+          {
+            verify: schema.boolean(),
+            ca: schema.arrayOf(schema.string()),
+            cert: schema.string(),
+            key: schema.string(),
+          },
+          { defaultValue: undefined }
+        ),
+      }),
+      { defaultValue: [] }
+    ),
+    ssl: schema.object({ verify: schema.boolean({ defaultValue: false }) }, {}),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
   },
   { defaultValue: undefined }
 );
 
-export type ConfigType = TypeOf<typeof configSchema>;
-export type ConfigType7x = TypeOf<typeof configSchema7x>;
+export type ConsoleConfig7x = TypeOf<typeof schema7x>;
 
-export const config: PluginConfigDescriptor<ConfigType | ConfigType7x> = {
-  schema: kibanaVersion.major < 8 ? configSchema7x : configSchema,
+const config7x: PluginConfigDescriptor<ConsoleConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
   deprecations: ({ deprecate, unused }) => [
-    deprecate('enabled', '8.0.0'),
-    deprecate('proxyFilter', '8.0.0'),
-    deprecate('proxyConfig', '8.0.0'),
     unused('ssl'),
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'console.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'console.enabled',
+        level: 'critical',
+        title: i18n.translate('console.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "console.enabled" is deprecated',
+        }),
+        message: i18n.translate('console.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Console UI, use the "console.ui.enabled" setting instead of "console.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('console.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('console.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage: 'Change the "console.enabled" setting to "console.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'console.proxyConfig') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'console.proxyConfig',
+        level: 'critical',
+        title: i18n.translate('console.deprecations.proxyConfigTitle', {
+          defaultMessage: 'Setting "console.proxyConfig" is deprecated',
+        }),
+        message: i18n.translate('console.deprecations.proxyConfigMessage', {
+          defaultMessage:
+            'Configuring "console.proxyConfig" is deprecated and will be removed in 8.0.0. To secure your connection between Kibana and Elasticsearch use the standard "server.ssl.*" settings instead.',
+        }),
+        documentationUrl: 'https://ela.st/encrypt-kibana-browser',
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('console.deprecations.proxyConfig.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('console.deprecations.proxyConfig.manualStepTwoMessage', {
+              defaultMessage: 'Remove the "console.proxyConfig" setting.',
+            }),
+            i18n.translate('console.deprecations.proxyConfig.manualStepThreeMessage', {
+              defaultMessage:
+                'Configure the secure connection between Kibana and Elasticsearch using the "server.ssl.*" settings.',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'console.proxyFilter') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'console.proxyFilter',
+        level: 'critical',
+        title: i18n.translate('console.deprecations.proxyFilterTitle', {
+          defaultMessage: 'Setting "console.proxyFilter" is deprecated',
+        }),
+        message: i18n.translate('console.deprecations.proxyFilterMessage', {
+          defaultMessage:
+            'Configuring "console.proxyFilter" is deprecated and will be removed in 8.0.0. To secure your connection between Kibana and Elasticsearch use the standard "server.ssl.*" settings instead.',
+        }),
+        documentationUrl: 'https://ela.st/encrypt-kibana-browser',
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('console.deprecations.proxyFilter.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('console.deprecations.proxyFilter.manualStepTwoMessage', {
+              defaultMessage: 'Remove the "console.proxyFilter" setting.',
+            }),
+            i18n.translate('console.deprecations.proxyFilter.manualStepThreeMessage', {
+              defaultMessage:
+                'Configure the secure connection between Kibana and Elasticsearch using the "server.ssl.*" settings.',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
   ],
 };
+
+export const config: PluginConfigDescriptor<ConsoleConfig | ConsoleConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/src/plugins/console/server/index.ts b/src/plugins/console/server/index.ts
index 6ae518f5dc796f..b270b89a3d45a6 100644
--- a/src/plugins/console/server/index.ts
+++ b/src/plugins/console/server/index.ts
@@ -11,6 +11,7 @@ import { PluginInitializerContext } from 'kibana/server';
 import { ConsoleServerPlugin } from './plugin';
 
 export { ConsoleSetup, ConsoleStart } from './types';
+
 export { config } from './config';
 
 export const plugin = (ctx: PluginInitializerContext) => new ConsoleServerPlugin(ctx);
diff --git a/src/plugins/console/server/plugin.ts b/src/plugins/console/server/plugin.ts
index 613337b286fbff..5543c40d03cb00 100644
--- a/src/plugins/console/server/plugin.ts
+++ b/src/plugins/console/server/plugin.ts
@@ -11,7 +11,7 @@ import { SemVer } from 'semver';
 
 import { ProxyConfigCollection } from './lib';
 import { SpecDefinitionsService, EsLegacyConfigService } from './services';
-import { ConfigType, ConfigType7x } from './config';
+import { ConsoleConfig, ConsoleConfig7x } from './config';
 
 import { registerRoutes } from './routes';
 
@@ -24,11 +24,11 @@ export class ConsoleServerPlugin implements Plugin<ConsoleSetup, ConsoleStart> {
 
   esLegacyConfigService = new EsLegacyConfigService();
 
-  constructor(private readonly ctx: PluginInitializerContext<ConfigType | ConfigType7x>) {
+  constructor(private readonly ctx: PluginInitializerContext<ConsoleConfig | ConsoleConfig7x>) {
     this.log = this.ctx.logger.get();
   }
 
-  setup({ http, capabilities, getStartServices, elasticsearch }: CoreSetup) {
+  setup({ http, capabilities, elasticsearch }: CoreSetup) {
     capabilities.registerProvider(() => ({
       dev_tools: {
         show: true,
@@ -43,8 +43,8 @@ export class ConsoleServerPlugin implements Plugin<ConsoleSetup, ConsoleStart> {
     let proxyConfigCollection: ProxyConfigCollection | undefined;
     if (kibanaVersion.major < 8) {
       // "pathFilters" and "proxyConfig" are only used in 7.x
-      pathFilters = (config as ConfigType7x).proxyFilter.map((str: string) => new RegExp(str));
-      proxyConfigCollection = new ProxyConfigCollection((config as ConfigType7x).proxyConfig);
+      pathFilters = (config as ConsoleConfig7x).proxyFilter.map((str: string) => new RegExp(str));
+      proxyConfigCollection = new ProxyConfigCollection((config as ConsoleConfig7x).proxyConfig);
     }
 
     this.esLegacyConfigService.setup(elasticsearch.legacy.config$);
diff --git a/src/plugins/home/public/application/components/manage_data/manage_data.tsx b/src/plugins/home/public/application/components/manage_data/manage_data.tsx
index b374bdd2e16129..0f465dfcf965f9 100644
--- a/src/plugins/home/public/application/components/manage_data/manage_data.tsx
+++ b/src/plugins/home/public/application/components/manage_data/manage_data.tsx
@@ -61,7 +61,8 @@ export const ManageData: FC<Props> = ({ addBasePath, application, features }) =>
             {isDevToolsEnabled || isManagementEnabled ? (
               <EuiFlexItem className="homDataManage__actions" grow={false}>
                 <EuiFlexGroup alignItems="center" responsive={false} wrap>
-                  {isDevToolsEnabled ? (
+                  {/* Check if both the Dev Tools UI and the Console UI are enabled. */}
+                  {isDevToolsEnabled && consoleHref !== undefined ? (
                     <EuiFlexItem grow={false}>
                       <RedirectAppLinks application={application}>
                         <EuiButtonEmpty
diff --git a/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx b/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx
index 36f2f8534399f7..e46910c170103f 100644
--- a/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx
+++ b/src/plugins/inspector/public/views/requests/components/details/req_code_viewer.tsx
@@ -39,15 +39,17 @@ export const RequestCodeViewer = ({ indexPattern, json }: RequestCodeViewerProps
   const { services } = useKibana<InspectorPluginStartDeps>();
 
   const navigateToUrl = services.application?.navigateToUrl;
-  const canShowDevTools = services.application?.capabilities?.dev_tools.show;
   const devToolsDataUri = compressToEncodedURIComponent(`GET ${indexPattern}/_search\n${json}`);
-  const devToolsHref = services.share.url.locators
+  const consoleHref = services.share.url.locators
     .get('CONSOLE_APP_LOCATOR')
     ?.useUrl({ loadFrom: `data:text/plain,${devToolsDataUri}` });
+  // Check if both the Dev Tools UI and the Console UI are enabled.
+  const canShowDevTools =
+    services.application?.capabilities?.dev_tools.show && consoleHref !== undefined;
   const shouldShowDevToolsLink = !!(indexPattern && canShowDevTools);
   const handleDevToolsLinkClick = useCallback(
-    () => devToolsHref && navigateToUrl && navigateToUrl(devToolsHref),
-    [devToolsHref, navigateToUrl]
+    () => consoleHref && navigateToUrl && navigateToUrl(consoleHref),
+    [consoleHref, navigateToUrl]
   );
 
   return (
@@ -79,7 +81,7 @@ export const RequestCodeViewer = ({ indexPattern, json }: RequestCodeViewerProps
               size="xs"
               flush="right"
               iconType="wrench"
-              href={devToolsHref}
+              href={consoleHref}
               onClick={handleDevToolsLinkClick}
               data-test-subj="inspectorRequestOpenInConsoleButton"
             >
diff --git a/x-pack/plugins/cross_cluster_replication/common/constants/index.ts b/x-pack/plugins/cross_cluster_replication/common/constants/index.ts
index f1b327aed6389f..a800afcf77ae42 100644
--- a/x-pack/plugins/cross_cluster_replication/common/constants/index.ts
+++ b/x-pack/plugins/cross_cluster_replication/common/constants/index.ts
@@ -19,6 +19,8 @@ export const PLUGIN = {
   minimumLicenseType: platinumLicense,
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const APPS = {
   CCR_APP: 'ccr',
   REMOTE_CLUSTER_APP: 'remote_cluster',
diff --git a/x-pack/plugins/cross_cluster_replication/server/config.ts b/x-pack/plugins/cross_cluster_replication/server/config.ts
index 50cca903f8a2bb..732137e308a0d2 100644
--- a/x-pack/plugins/cross_cluster_replication/server/config.ts
+++ b/x-pack/plugins/cross_cluster_replication/server/config.ts
@@ -4,14 +4,96 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<CrossClusterReplicationConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+export type CrossClusterReplicationConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type CrossClusterReplicationConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<CrossClusterReplicationConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.ccr.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.ccr.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.crossClusterReplication.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.ccr.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.crossClusterReplication.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Cross-Cluster Replication UI, use the "xpack.ccr.ui.enabled" setting instead of "xpack.ccr.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate(
+              'xpack.crossClusterReplication.deprecations.enabled.manualStepOneMessage',
+              {
+                defaultMessage: 'Open the kibana.yml config file.',
+              }
+            ),
+            i18n.translate(
+              'xpack.crossClusterReplication.deprecations.enabled.manualStepTwoMessage',
+              {
+                defaultMessage: 'Change the "xpack.ccr.enabled" setting to "xpack.ccr.ui.enabled".',
+              }
+            ),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type CrossClusterReplicationConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<
+  CrossClusterReplicationConfig | CrossClusterReplicationConfig7x
+> = kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/cross_cluster_replication/server/index.ts b/x-pack/plugins/cross_cluster_replication/server/index.ts
index a6a3ec0fe57537..7a0984a6117bf5 100644
--- a/x-pack/plugins/cross_cluster_replication/server/index.ts
+++ b/x-pack/plugins/cross_cluster_replication/server/index.ts
@@ -5,17 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 import { CrossClusterReplicationServerPlugin } from './plugin';
-import { configSchema, CrossClusterReplicationConfig } from './config';
+
+export { config } from './config';
 
 export const plugin = (pluginInitializerContext: PluginInitializerContext) =>
   new CrossClusterReplicationServerPlugin(pluginInitializerContext);
-
-export const config: PluginConfigDescriptor<CrossClusterReplicationConfig> = {
-  schema: configSchema,
-  exposeToBrowser: {
-    ui: true,
-  },
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
diff --git a/x-pack/plugins/index_lifecycle_management/common/constants/index.ts b/x-pack/plugins/index_lifecycle_management/common/constants/index.ts
index 7107489f4e2bac..329f479e128e2b 100644
--- a/x-pack/plugins/index_lifecycle_management/common/constants/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/common/constants/index.ts
@@ -19,6 +19,8 @@ export const PLUGIN = {
   }),
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const API_BASE_PATH = '/api/index_lifecycle_management';
 
 export { MIN_SEARCHABLE_SNAPSHOT_LICENSE, MIN_PLUGIN_LICENSE };
diff --git a/x-pack/plugins/index_lifecycle_management/server/config.ts b/x-pack/plugins/index_lifecycle_management/server/config.ts
index f3fdf59cec55b8..691cc06708bb5b 100644
--- a/x-pack/plugins/index_lifecycle_management/server/config.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/config.ts
@@ -4,16 +4,94 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    // Cloud requires the ability to hide internal node attributes from users.
+    filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [] }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<IndexLifecycleManagementConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+export type IndexLifecycleManagementConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-  // Cloud requires the ability to hide internal node attributes from users.
-  filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [] }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    // Cloud requires the ability to hide internal node attributes from users.
+    filteredNodeAttributes: schema.arrayOf(schema.string(), { defaultValue: [] }),
+  },
+  { defaultValue: undefined }
+);
+
+export type IndexLifecycleManagementConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<IndexLifecycleManagementConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.ilm.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.ilm.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.ilm.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Index Lifecycle Policies UI, use the "xpack.ilm.ui.enabled" setting instead of "xpack.ilm.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.indexLifecycleMgmt.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage: 'Change the "xpack.ilm.enabled" setting to "xpack.ilm.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type IndexLifecycleManagementConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<
+  IndexLifecycleManagementConfig | IndexLifecycleManagementConfig7x
+> = kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/index_lifecycle_management/server/index.ts b/x-pack/plugins/index_lifecycle_management/server/index.ts
index 1f8b01913fd3ea..6a74b4c80b2d35 100644
--- a/x-pack/plugins/index_lifecycle_management/server/index.ts
+++ b/x-pack/plugins/index_lifecycle_management/server/index.ts
@@ -5,17 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'kibana/server';
+import { PluginInitializerContext } from 'kibana/server';
 import { IndexLifecycleManagementServerPlugin } from './plugin';
-import { configSchema, IndexLifecycleManagementConfig } from './config';
+
+export { config } from './config';
 
 export const plugin = (ctx: PluginInitializerContext) =>
   new IndexLifecycleManagementServerPlugin(ctx);
-
-export const config: PluginConfigDescriptor<IndexLifecycleManagementConfig> = {
-  schema: configSchema,
-  exposeToBrowser: {
-    ui: true,
-  },
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
diff --git a/x-pack/plugins/index_management/public/plugin.ts b/x-pack/plugins/index_management/public/plugin.ts
index 4e123b6f474f81..2394167ca61b2c 100644
--- a/x-pack/plugins/index_management/public/plugin.ts
+++ b/x-pack/plugins/index_management/public/plugin.ts
@@ -13,7 +13,12 @@ import { setExtensionsService } from './application/store/selectors/extension_se
 
 import { ExtensionsService } from './services';
 
-import { IndexManagementPluginSetup, SetupDependencies, StartDependencies } from './types';
+import {
+  IndexManagementPluginSetup,
+  SetupDependencies,
+  StartDependencies,
+  ClientConfigType,
+} from './types';
 
 // avoid import from index files in plugin.ts, use specific import paths
 import { PLUGIN } from '../common/constants/plugin';
@@ -31,25 +36,30 @@ export class IndexMgmtUIPlugin {
     coreSetup: CoreSetup<StartDependencies>,
     plugins: SetupDependencies
   ): IndexManagementPluginSetup {
-    const { fleet, usageCollection, management } = plugins;
-    const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
-
-    management.sections.section.data.registerApp({
-      id: PLUGIN.id,
-      title: i18n.translate('xpack.idxMgmt.appTitle', { defaultMessage: 'Index Management' }),
-      order: 0,
-      mount: async (params) => {
-        const { mountManagementSection } = await import('./application/mount_management_section');
-        return mountManagementSection(
-          coreSetup,
-          usageCollection,
-          params,
-          this.extensionsService,
-          Boolean(fleet),
-          kibanaVersion
-        );
-      },
-    });
+    const {
+      ui: { enabled: isIndexManagementUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
+
+    if (isIndexManagementUiEnabled) {
+      const { fleet, usageCollection, management } = plugins;
+      const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
+      management.sections.section.data.registerApp({
+        id: PLUGIN.id,
+        title: i18n.translate('xpack.idxMgmt.appTitle', { defaultMessage: 'Index Management' }),
+        order: 0,
+        mount: async (params) => {
+          const { mountManagementSection } = await import('./application/mount_management_section');
+          return mountManagementSection(
+            coreSetup,
+            usageCollection,
+            params,
+            this.extensionsService,
+            Boolean(fleet),
+            kibanaVersion
+          );
+        },
+      });
+    }
 
     return {
       extensionsService: this.extensionsService.setup(),
diff --git a/x-pack/plugins/index_management/public/types.ts b/x-pack/plugins/index_management/public/types.ts
index 05c486e299c7a5..e0af6b160cf113 100644
--- a/x-pack/plugins/index_management/public/types.ts
+++ b/x-pack/plugins/index_management/public/types.ts
@@ -23,3 +23,9 @@ export interface SetupDependencies {
 export interface StartDependencies {
   share: SharePluginStart;
 }
+
+export interface ClientConfigType {
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/x-pack/plugins/index_management/server/config.ts b/x-pack/plugins/index_management/server/config.ts
index 0a314c7654b167..88a714db5edca1 100644
--- a/x-pack/plugins/index_management/server/config.ts
+++ b/x-pack/plugins/index_management/server/config.ts
@@ -4,11 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<IndexManagementConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type IndexManagementConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
+    enabled: schema.boolean({ defaultValue: true }),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type IndexManagementConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<IndexManagementConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.index_management.enabled') === undefined) {
+        return completeConfig;
+      }
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-});
+      addDeprecation({
+        configPath: 'xpack.index_management.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.idxMgmt.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.index_management.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.idxMgmt.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Index Management UI, use the "xpack.index_management.ui.enabled" setting instead of "xpack.index_management.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.idxMgmt.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.idxMgmt.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.index_management.enabled" setting to "xpack.index_management.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type IndexManagementConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<IndexManagementConfig | IndexManagementConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/index_management/server/index.ts b/x-pack/plugins/index_management/server/index.ts
index 14b67e2ffd581a..29291116e44fc2 100644
--- a/x-pack/plugins/index_management/server/index.ts
+++ b/x-pack/plugins/index_management/server/index.ts
@@ -5,17 +5,13 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 
 import { IndexMgmtServerPlugin } from './plugin';
-import { configSchema } from './config';
 
-export const plugin = (context: PluginInitializerContext) => new IndexMgmtServerPlugin(context);
+export { config } from './config';
 
-export const config: PluginConfigDescriptor = {
-  schema: configSchema,
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
+export const plugin = (context: PluginInitializerContext) => new IndexMgmtServerPlugin(context);
 
 /** @public */
 export { Dependencies } from './types';
diff --git a/x-pack/plugins/license_management/common/constants/index.ts b/x-pack/plugins/license_management/common/constants/index.ts
index 0567b0008f0c85..9735eabeb1e40f 100644
--- a/x-pack/plugins/license_management/common/constants/index.ts
+++ b/x-pack/plugins/license_management/common/constants/index.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-export { PLUGIN } from './plugin';
+export { PLUGIN, MAJOR_VERSION } from './plugin';
 export { API_BASE_PATH } from './base_path';
 export { EXTERNAL_LINKS } from './external_links';
 export { APP_PERMISSION } from './permissions';
diff --git a/x-pack/plugins/license_management/common/constants/plugin.ts b/x-pack/plugins/license_management/common/constants/plugin.ts
index ae7fd0f6e8a2e0..76f4d94a0188a2 100644
--- a/x-pack/plugins/license_management/common/constants/plugin.ts
+++ b/x-pack/plugins/license_management/common/constants/plugin.ts
@@ -13,3 +13,5 @@ export const PLUGIN = {
   }),
   id: 'license_management',
 };
+
+export const MAJOR_VERSION = '8.0.0';
diff --git a/x-pack/plugins/license_management/server/config.ts b/x-pack/plugins/license_management/server/config.ts
index 0e4de29b718bea..e378a10191684b 100644
--- a/x-pack/plugins/license_management/server/config.ts
+++ b/x-pack/plugins/license_management/server/config.ts
@@ -4,14 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<LicenseManagementConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+export type LicenseManagementConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type LicenseManagementConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<LicenseManagementConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.license_management.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.license_management.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.licenseMgmt.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.license_management.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.licenseMgmt.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the License Management UI, use the "xpack.license_management.ui.enabled" setting instead of "xpack.license_management.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.licenseMgmt.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.licenseMgmt.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.license_management.enabled" setting to "xpack.license_management.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type LicenseManagementConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<LicenseManagementConfig | LicenseManagementConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/license_management/server/index.ts b/x-pack/plugins/license_management/server/index.ts
index e78ffe07b50c04..7aa6bfb06d54d1 100644
--- a/x-pack/plugins/license_management/server/index.ts
+++ b/x-pack/plugins/license_management/server/index.ts
@@ -5,17 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 
 import { LicenseManagementServerPlugin } from './plugin';
-import { configSchema, LicenseManagementConfig } from './config';
 
-export const plugin = (ctx: PluginInitializerContext) => new LicenseManagementServerPlugin();
+export { config } from './config';
 
-export const config: PluginConfigDescriptor<LicenseManagementConfig> = {
-  schema: configSchema,
-  exposeToBrowser: {
-    ui: true,
-  },
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-};
+export const plugin = (ctx: PluginInitializerContext) => new LicenseManagementServerPlugin();
diff --git a/x-pack/plugins/remote_clusters/common/constants.ts b/x-pack/plugins/remote_clusters/common/constants.ts
index b11292141672d3..5a36924b26433c 100644
--- a/x-pack/plugins/remote_clusters/common/constants.ts
+++ b/x-pack/plugins/remote_clusters/common/constants.ts
@@ -20,6 +20,8 @@ export const PLUGIN = {
   },
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const API_BASE_PATH = '/api/remote_clusters';
 
 export const SNIFF_MODE = 'sniff';
diff --git a/x-pack/plugins/remote_clusters/server/config.ts b/x-pack/plugins/remote_clusters/server/config.ts
index 8f379ec5613c81..5b4972f0a5259f 100644
--- a/x-pack/plugins/remote_clusters/server/config.ts
+++ b/x-pack/plugins/remote_clusters/server/config.ts
@@ -4,23 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
-import { PluginConfigDescriptor } from 'kibana/server';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<RemoteClustersConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type RemoteClustersConfig = TypeOf<typeof schemaLatest>;
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  ui: schema.object({
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
 
-export type ConfigType = TypeOf<typeof configSchema>;
+export type RemoteClustersConfig7x = TypeOf<typeof schema7x>;
 
-export const config: PluginConfigDescriptor<ConfigType> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
+const config7x: PluginConfigDescriptor<RemoteClustersConfig7x> = {
   exposeToBrowser: {
     ui: true,
   },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.remote_clusters.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.remote_clusters.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.remoteClusters.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.remote_clusters.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.remoteClusters.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Remote Clusters UI, use the "xpack.remote_clusters.ui.enabled" setting instead of "xpack.remote_clusters.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.remoteClusters.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.remoteClusters.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.remote_clusters.enabled" setting to "xpack.remote_clusters.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
 };
+
+export const config: PluginConfigDescriptor<RemoteClustersConfig | RemoteClustersConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/remote_clusters/server/plugin.ts b/x-pack/plugins/remote_clusters/server/plugin.ts
index b13773c27034a4..fde71677b84486 100644
--- a/x-pack/plugins/remote_clusters/server/plugin.ts
+++ b/x-pack/plugins/remote_clusters/server/plugin.ts
@@ -11,7 +11,7 @@ import { CoreSetup, Logger, Plugin, PluginInitializerContext } from 'src/core/se
 
 import { PLUGIN } from '../common/constants';
 import { Dependencies, LicenseStatus, RouteDependencies } from './types';
-import { ConfigType } from './config';
+import { RemoteClustersConfig, RemoteClustersConfig7x } from './config';
 import {
   registerGetRoute,
   registerAddRoute,
@@ -30,7 +30,7 @@ export class RemoteClustersServerPlugin
 {
   licenseStatus: LicenseStatus;
   log: Logger;
-  config: ConfigType;
+  config: RemoteClustersConfig | RemoteClustersConfig7x;
 
   constructor({ logger, config }: PluginInitializerContext) {
     this.log = logger.get();
diff --git a/x-pack/plugins/rollup/common/index.ts b/x-pack/plugins/rollup/common/index.ts
index dffbfbd1820927..c912a905d061db 100644
--- a/x-pack/plugins/rollup/common/index.ts
+++ b/x-pack/plugins/rollup/common/index.ts
@@ -14,6 +14,8 @@ export const PLUGIN = {
   minimumLicenseType: basicLicense,
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const CONFIG_ROLLUPS = 'rollups:enableIndexPatterns';
 
 export const API_BASE_PATH = '/api/rollup';
diff --git a/x-pack/plugins/rollup/public/index.ts b/x-pack/plugins/rollup/public/index.ts
index b70ce864933827..f740971b4bcb09 100644
--- a/x-pack/plugins/rollup/public/index.ts
+++ b/x-pack/plugins/rollup/public/index.ts
@@ -4,7 +4,8 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { PluginInitializerContext } from 'src/core/public';
 
 import { RollupPlugin } from './plugin';
 
-export const plugin = () => new RollupPlugin();
+export const plugin = (ctx: PluginInitializerContext) => new RollupPlugin(ctx);
diff --git a/x-pack/plugins/rollup/public/plugin.ts b/x-pack/plugins/rollup/public/plugin.ts
index 0d345e326193c7..e458a13ee0e0e4 100644
--- a/x-pack/plugins/rollup/public/plugin.ts
+++ b/x-pack/plugins/rollup/public/plugin.ts
@@ -6,7 +6,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { CoreSetup, CoreStart, Plugin } from 'kibana/public';
+import { CoreSetup, CoreStart, Plugin, PluginInitializerContext } from 'kibana/public';
 import { rollupBadgeExtension, rollupToggleExtension } from './extend_index_management';
 // @ts-ignore
 import { RollupIndexPatternCreationConfig } from './index_pattern_creation/rollup_index_pattern_creation_config';
@@ -23,6 +23,7 @@ import { IndexManagementPluginSetup } from '../../index_management/public';
 import { setHttp, init as initDocumentation } from './crud_app/services/index';
 import { setNotifications, setFatalErrors, setUiStatsReporter } from './kibana_services';
 import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/public';
+import { ClientConfigType } from './types';
 
 export interface RollupPluginSetupDependencies {
   home?: HomePublicPluginSetup;
@@ -32,10 +33,16 @@ export interface RollupPluginSetupDependencies {
 }
 
 export class RollupPlugin implements Plugin {
+  constructor(private ctx: PluginInitializerContext) {}
+
   setup(
     core: CoreSetup,
     { home, management, indexManagement, usageCollection }: RollupPluginSetupDependencies
   ) {
+    const {
+      ui: { enabled: isRollupUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
+
     setFatalErrors(core.fatalErrors);
     if (usageCollection) {
       setUiStatsReporter(usageCollection.reportUiCounter.bind(usageCollection, UIM_APP_NAME));
@@ -46,7 +53,7 @@ export class RollupPlugin implements Plugin {
       indexManagement.extensionsService.addToggle(rollupToggleExtension);
     }
 
-    if (home) {
+    if (home && isRollupUiEnabled) {
       home.featureCatalogue.register({
         id: 'rollup_jobs',
         title: 'Rollups',
@@ -61,33 +68,35 @@ export class RollupPlugin implements Plugin {
       });
     }
 
-    const pluginName = i18n.translate('xpack.rollupJobs.appTitle', {
-      defaultMessage: 'Rollup Jobs',
-    });
+    if (isRollupUiEnabled) {
+      const pluginName = i18n.translate('xpack.rollupJobs.appTitle', {
+        defaultMessage: 'Rollup Jobs',
+      });
 
-    management.sections.section.data.registerApp({
-      id: 'rollup_jobs',
-      title: pluginName,
-      order: 4,
-      async mount(params) {
-        const [coreStart] = await core.getStartServices();
+      management.sections.section.data.registerApp({
+        id: 'rollup_jobs',
+        title: pluginName,
+        order: 4,
+        async mount(params) {
+          const [coreStart] = await core.getStartServices();
 
-        const {
-          chrome: { docTitle },
-        } = coreStart;
+          const {
+            chrome: { docTitle },
+          } = coreStart;
 
-        docTitle.change(pluginName);
-        params.setBreadcrumbs([{ text: pluginName }]);
+          docTitle.change(pluginName);
+          params.setBreadcrumbs([{ text: pluginName }]);
 
-        const { renderApp } = await import('./application');
-        const unmountAppCallback = await renderApp(core, params);
+          const { renderApp } = await import('./application');
+          const unmountAppCallback = await renderApp(core, params);
 
-        return () => {
-          docTitle.reset();
-          unmountAppCallback();
-        };
-      },
-    });
+          return () => {
+            docTitle.reset();
+            unmountAppCallback();
+          };
+        },
+      });
+    }
   }
 
   start(core: CoreStart) {
diff --git a/x-pack/plugins/rollup/public/types.ts b/x-pack/plugins/rollup/public/types.ts
new file mode 100644
index 00000000000000..dc5e55e9268f84
--- /dev/null
+++ b/x-pack/plugins/rollup/public/types.ts
@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export interface ClientConfigType {
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/x-pack/plugins/rollup/server/config.ts b/x-pack/plugins/rollup/server/config.ts
index d20b3174221076..c0cca4bbb4d330 100644
--- a/x-pack/plugins/rollup/server/config.ts
+++ b/x-pack/plugins/rollup/server/config.ts
@@ -4,11 +4,90 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<RollupConfig> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type RollupConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
+    enabled: schema.boolean({ defaultValue: true }),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type RollupConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<RollupConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.rollup.enabled') === undefined) {
+        return completeConfig;
+      }
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-});
+      addDeprecation({
+        configPath: 'xpack.rollup.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.rollupJobs.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.rollup.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.rollupJobs.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Rollup Jobs UI, use the "xpack.rollup.ui.enabled" setting instead of "xpack.rollup.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.rollupJobs.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.rollupJobs.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.rollup.enabled" setting to "xpack.rollup.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type RollupConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<RollupConfig | RollupConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/rollup/server/index.ts b/x-pack/plugins/rollup/server/index.ts
index e77e0e6f15d729..6ae1d9f24b8b9c 100644
--- a/x-pack/plugins/rollup/server/index.ts
+++ b/x-pack/plugins/rollup/server/index.ts
@@ -5,14 +5,10 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 import { RollupPlugin } from './plugin';
-import { configSchema, RollupConfig } from './config';
+
+export { config } from './config';
 
 export const plugin = (pluginInitializerContext: PluginInitializerContext) =>
   new RollupPlugin(pluginInitializerContext);
-
-export const config: PluginConfigDescriptor<RollupConfig> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
-};
diff --git a/x-pack/plugins/snapshot_restore/common/constants.ts b/x-pack/plugins/snapshot_restore/common/constants.ts
index b18e118dc5ff69..df13bd4c2f1f01 100644
--- a/x-pack/plugins/snapshot_restore/common/constants.ts
+++ b/x-pack/plugins/snapshot_restore/common/constants.ts
@@ -20,6 +20,8 @@ export const PLUGIN = {
   },
 };
 
+export const MAJOR_VERSION = '8.0.0';
+
 export const API_BASE_PATH = '/api/snapshot_restore/';
 
 export enum REPOSITORY_TYPES {
diff --git a/x-pack/plugins/snapshot_restore/public/plugin.ts b/x-pack/plugins/snapshot_restore/public/plugin.ts
index bb091a1fd18315..0351716fad5b53 100644
--- a/x-pack/plugins/snapshot_restore/public/plugin.ts
+++ b/x-pack/plugins/snapshot_restore/public/plugin.ts
@@ -42,52 +42,58 @@ export class SnapshotRestoreUIPlugin {
 
   public setup(coreSetup: CoreSetup, plugins: PluginsDependencies): void {
     const config = this.initializerContext.config.get<ClientConfigType>();
-    const { http } = coreSetup;
-    const { home, management, usageCollection } = plugins;
+    const {
+      ui: { enabled: isSnapshotRestoreUiEnabled },
+    } = config;
 
-    // Initialize services
-    this.uiMetricService.setup(usageCollection);
-    textService.setup(i18n);
-    httpService.setup(http);
+    if (isSnapshotRestoreUiEnabled) {
+      const { http } = coreSetup;
+      const { home, management, usageCollection } = plugins;
 
-    management.sections.section.data.registerApp({
-      id: PLUGIN.id,
-      title: i18n.translate('xpack.snapshotRestore.appTitle', {
-        defaultMessage: 'Snapshot and Restore',
-      }),
-      order: 3,
-      mount: async (params) => {
-        const { mountManagementSection } = await import('./application/mount_management_section');
-        const services = {
-          uiMetricService: this.uiMetricService,
-        };
-        return await mountManagementSection(coreSetup, services, config, params);
-      },
-    });
+      // Initialize services
+      this.uiMetricService.setup(usageCollection);
+      textService.setup(i18n);
+      httpService.setup(http);
 
-    if (home) {
-      home.featureCatalogue.register({
+      management.sections.section.data.registerApp({
         id: PLUGIN.id,
-        title: i18n.translate('xpack.snapshotRestore.featureCatalogueTitle', {
-          defaultMessage: 'Back up and restore',
+        title: i18n.translate('xpack.snapshotRestore.appTitle', {
+          defaultMessage: 'Snapshot and Restore',
         }),
-        description: i18n.translate('xpack.snapshotRestore.featureCatalogueDescription', {
-          defaultMessage:
-            'Save snapshots to a backup repository, and restore to recover index and cluster state.',
-        }),
-        icon: 'storage',
-        path: '/app/management/data/snapshot_restore',
-        showOnHomePage: true,
-        category: FeatureCatalogueCategory.ADMIN,
-        order: 630,
+        order: 3,
+        mount: async (params) => {
+          const { mountManagementSection } = await import('./application/mount_management_section');
+          const services = {
+            uiMetricService: this.uiMetricService,
+          };
+          return await mountManagementSection(coreSetup, services, config, params);
+        },
       });
-    }
 
-    plugins.share.url.locators.create(
-      new SnapshotRestoreLocatorDefinition({
-        managementAppLocator: plugins.management.locator,
-      })
-    );
+      if (home) {
+        home.featureCatalogue.register({
+          id: PLUGIN.id,
+          title: i18n.translate('xpack.snapshotRestore.featureCatalogueTitle', {
+            defaultMessage: 'Back up and restore',
+          }),
+          description: i18n.translate('xpack.snapshotRestore.featureCatalogueDescription', {
+            defaultMessage:
+              'Save snapshots to a backup repository, and restore to recover index and cluster state.',
+          }),
+          icon: 'storage',
+          path: '/app/management/data/snapshot_restore',
+          showOnHomePage: true,
+          category: FeatureCatalogueCategory.ADMIN,
+          order: 630,
+        });
+      }
+
+      plugins.share.url.locators.create(
+        new SnapshotRestoreLocatorDefinition({
+          managementAppLocator: plugins.management.locator,
+        })
+      );
+    }
   }
 
   public start() {}
diff --git a/x-pack/plugins/snapshot_restore/public/types.ts b/x-pack/plugins/snapshot_restore/public/types.ts
index b73170ad9d5788..c58c942b4bc166 100644
--- a/x-pack/plugins/snapshot_restore/public/types.ts
+++ b/x-pack/plugins/snapshot_restore/public/types.ts
@@ -7,4 +7,5 @@
 
 export interface ClientConfigType {
   slm_ui: { enabled: boolean };
+  ui: { enabled: boolean };
 }
diff --git a/x-pack/plugins/snapshot_restore/server/config.ts b/x-pack/plugins/snapshot_restore/server/config.ts
index f0ca416ef20323..cc430f4756610e 100644
--- a/x-pack/plugins/snapshot_restore/server/config.ts
+++ b/x-pack/plugins/snapshot_restore/server/config.ts
@@ -4,14 +4,98 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
 import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    slm_ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<SnapshotRestoreConfig> = {
+  exposeToBrowser: {
+    ui: true,
+    slm_ui: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
 
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  slm_ui: schema.object({
+export type SnapshotRestoreConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
     enabled: schema.boolean({ defaultValue: true }),
-  }),
-});
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    slm_ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+  },
+  { defaultValue: undefined }
+);
+
+export type SnapshotRestoreConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<SnapshotRestoreConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+    slm_ui: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.snapshot_restore.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.snapshot_restore.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.snapshotRestore.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.snapshot_restore.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.snapshotRestore.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Snapshot and Restore UI, use the "xpack.snapshot_restore.ui.enabled" setting instead of "xpack.snapshot_restore.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.snapshotRestore.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.snapshotRestore.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.snapshot_restore.enabled" setting to "xpack.snapshot_restore.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
 
-export type SnapshotRestoreConfig = TypeOf<typeof configSchema>;
+export const config: PluginConfigDescriptor<SnapshotRestoreConfig | SnapshotRestoreConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/snapshot_restore/server/index.ts b/x-pack/plugins/snapshot_restore/server/index.ts
index e10bffd6073d20..1e9d2b55aa20b3 100644
--- a/x-pack/plugins/snapshot_restore/server/index.ts
+++ b/x-pack/plugins/snapshot_restore/server/index.ts
@@ -5,16 +5,9 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'kibana/server';
+import { PluginInitializerContext } from 'kibana/server';
 import { SnapshotRestoreServerPlugin } from './plugin';
-import { configSchema, SnapshotRestoreConfig } from './config';
 
-export const plugin = (ctx: PluginInitializerContext) => new SnapshotRestoreServerPlugin(ctx);
+export { config } from './config';
 
-export const config: PluginConfigDescriptor<SnapshotRestoreConfig> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
-  exposeToBrowser: {
-    slm_ui: true,
-  },
-};
+export const plugin = (ctx: PluginInitializerContext) => new SnapshotRestoreServerPlugin(ctx);
diff --git a/x-pack/plugins/snapshot_restore/server/plugin.ts b/x-pack/plugins/snapshot_restore/server/plugin.ts
index 4414e3735959bf..d737807ec8dad4 100644
--- a/x-pack/plugins/snapshot_restore/server/plugin.ts
+++ b/x-pack/plugins/snapshot_restore/server/plugin.ts
@@ -28,16 +28,9 @@ export class SnapshotRestoreServerPlugin implements Plugin<void, void, any, any>
     this.license = new License();
   }
 
-  public setup(
-    { http, getStartServices }: CoreSetup,
-    { licensing, features, security, cloud }: Dependencies
-  ): void {
+  public setup({ http }: CoreSetup, { licensing, features, security, cloud }: Dependencies): void {
     const pluginConfig = this.context.config.get<SnapshotRestoreConfig>();
 
-    if (!pluginConfig.enabled) {
-      return;
-    }
-
     const router = http.createRouter();
 
     this.license.setup(
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
index b19c8b3d0f0821..b2a1c4e80ec7d8 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/index.ts
@@ -9,4 +9,4 @@ export { setup as setupOverviewPage, OverviewTestBed } from './overview.helpers'
 export { setup as setupElasticsearchPage, ElasticsearchTestBed } from './elasticsearch.helpers';
 export { setup as setupKibanaPage, KibanaTestBed } from './kibana.helpers';
 
-export { setupEnvironment } from './setup_environment';
+export { setupEnvironment, kibanaVersion } from './setup_environment';
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx
index a1cdfaa3446cba..fbbbc0e07853c5 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/helpers/setup_environment.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 import axios from 'axios';
 // @ts-ignore
 import axiosXhrAdapter from 'axios/lib/adapters/xhr';
-
+import SemVer from 'semver/classes/semver';
 import {
   deprecationsServiceMock,
   docLinksServiceMock,
@@ -19,7 +19,7 @@ import {
 import { HttpSetup } from 'src/core/public';
 
 import { KibanaContextProvider } from '../../../public/shared_imports';
-import { mockKibanaSemverVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { AppContextProvider } from '../../../public/application/app_context';
 import { apiService } from '../../../public/application/lib/api';
 import { breadcrumbService } from '../../../public/application/lib/breadcrumbs';
@@ -31,6 +31,8 @@ const { GlobalFlyoutProvider } = GlobalFlyout;
 
 const mockHttpClient = axios.create({ adapter: axiosXhrAdapter });
 
+export const kibanaVersion = new SemVer(MAJOR_VERSION);
+
 export const WithAppDependencies =
   (Comp: any, overrides: Record<string, unknown> = {}) =>
   (props: Record<string, unknown>) => {
@@ -41,9 +43,9 @@ export const WithAppDependencies =
       http: mockHttpClient as unknown as HttpSetup,
       docLinks: docLinksServiceMock.createStartContract(),
       kibanaVersionInfo: {
-        currentMajor: mockKibanaSemverVersion.major,
-        prevMajor: mockKibanaSemverVersion.major - 1,
-        nextMajor: mockKibanaSemverVersion.major + 1,
+        currentMajor: kibanaVersion.major,
+        prevMajor: kibanaVersion.major - 1,
+        nextMajor: kibanaVersion.major + 1,
       },
       notifications: notificationServiceMock.createStartContract(),
       isReadOnlyMode: false,
diff --git a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx
index 0acf5ae65c6cc6..7831ab0110e4f8 100644
--- a/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx
+++ b/x-pack/plugins/upgrade_assistant/__jest__/client_integration/overview/overview.test.tsx
@@ -5,8 +5,7 @@
  * 2.0.
  */
 
-import { mockKibanaSemverVersion } from '../../../common/constants';
-import { OverviewTestBed, setupOverviewPage, setupEnvironment } from '../helpers';
+import { OverviewTestBed, setupOverviewPage, setupEnvironment, kibanaVersion } from '../helpers';
 
 describe('Overview Page', () => {
   let testBed: OverviewTestBed;
@@ -24,7 +23,7 @@ describe('Overview Page', () => {
   describe('Documentation links', () => {
     test('Has a whatsNew link and it references nextMajor version', () => {
       const { exists, find } = testBed;
-      const nextMajor = mockKibanaSemverVersion.major + 1;
+      const nextMajor = kibanaVersion.major + 1;
 
       expect(exists('whatsNewLink')).toBe(true);
       expect(find('whatsNewLink').text()).toContain(`${nextMajor}.0`);
diff --git a/x-pack/plugins/upgrade_assistant/common/config.ts b/x-pack/plugins/upgrade_assistant/common/config.ts
deleted file mode 100644
index e74fe5cc1bf166..00000000000000
--- a/x-pack/plugins/upgrade_assistant/common/config.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
- */
-
-import { schema, TypeOf } from '@kbn/config-schema';
-
-export const configSchema = schema.object({
-  enabled: schema.boolean({ defaultValue: true }),
-  /*
-   * This will default to true up until the last minor before the next major.
-   * In readonly mode, the user will not be able to perform any actions in the UI
-   * and will be presented with a message indicating as such.
-   */
-  readonly: schema.boolean({ defaultValue: true }),
-});
-
-export type Config = TypeOf<typeof configSchema>;
diff --git a/x-pack/plugins/upgrade_assistant/common/constants.ts b/x-pack/plugins/upgrade_assistant/common/constants.ts
index 893d61d329534e..68a6b9e9cdb83d 100644
--- a/x-pack/plugins/upgrade_assistant/common/constants.ts
+++ b/x-pack/plugins/upgrade_assistant/common/constants.ts
@@ -4,15 +4,11 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
-import SemVer from 'semver/classes/semver';
-
 /*
- * These constants are used only in tests to add conditional logic based on Kibana version
  * On master, the version should represent the next major version (e.g., master --> 8.0.0)
  * The release branch should match the release version (e.g., 7.x --> 7.0.0)
  */
-export const mockKibanaVersion = '8.0.0';
-export const mockKibanaSemverVersion = new SemVer(mockKibanaVersion);
+export const MAJOR_VERSION = '8.0.0';
 
 /*
  * Map of 7.0 --> 8.0 index setting deprecation log messages and associated settings
diff --git a/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx b/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx
index ff11b9f1a8450c..d2cafd69e94eb3 100644
--- a/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx
+++ b/x-pack/plugins/upgrade_assistant/public/application/components/es_deprecations/deprecation_types/reindex/flyout/warning_step.test.tsx
@@ -8,12 +8,20 @@
 import { I18nProvider } from '@kbn/i18n/react';
 import { mount, shallow } from 'enzyme';
 import React from 'react';
+import SemVer from 'semver/classes/semver';
 
 import { ReindexWarning } from '../../../../../../../common/types';
-import { mockKibanaSemverVersion } from '../../../../../../../common/constants';
+import { MAJOR_VERSION } from '../../../../../../../common/constants';
 
 import { idForWarning, WarningsFlyoutStep } from './warnings_step';
 
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+const mockKibanaVersionInfo = {
+  currentMajor: kibanaVersion.major,
+  prevMajor: kibanaVersion.major - 1,
+  nextMajor: kibanaVersion.major + 1,
+};
+
 jest.mock('../../../../../app_context', () => {
   const { docLinksServiceMock } = jest.requireActual(
     '../../../../../../../../../../src/core/public/doc_links/doc_links_service.mock'
@@ -23,11 +31,7 @@ jest.mock('../../../../../app_context', () => {
     useAppContext: () => {
       return {
         docLinks: docLinksServiceMock.createStartContract(),
-        kibanaVersionInfo: {
-          currentMajor: mockKibanaSemverVersion.major,
-          prevMajor: mockKibanaSemverVersion.major - 1,
-          nextMajor: mockKibanaSemverVersion.major + 1,
-        },
+        kibanaVersionInfo: mockKibanaVersionInfo,
       };
     },
   };
@@ -45,7 +49,7 @@ describe('WarningsFlyoutStep', () => {
     expect(shallow(<WarningsFlyoutStep {...defaultProps} />)).toMatchSnapshot();
   });
 
-  if (mockKibanaSemverVersion.major === 7) {
+  if (kibanaVersion.major === 7) {
     it('does not allow proceeding until all are checked', () => {
       const defaultPropsWithWarnings = {
         ...defaultProps,
diff --git a/x-pack/plugins/upgrade_assistant/public/plugin.ts b/x-pack/plugins/upgrade_assistant/public/plugin.ts
index 5edb638e1bc5b1..32e825fbdc20d2 100644
--- a/x-pack/plugins/upgrade_assistant/public/plugin.ts
+++ b/x-pack/plugins/upgrade_assistant/public/plugin.ts
@@ -9,59 +9,69 @@ import SemVer from 'semver/classes/semver';
 import { i18n } from '@kbn/i18n';
 import { Plugin, CoreSetup, PluginInitializerContext } from 'src/core/public';
 
-import { SetupDependencies, StartDependencies, AppServicesContext } from './types';
-import { Config } from '../common/config';
+import {
+  SetupDependencies,
+  StartDependencies,
+  AppServicesContext,
+  ClientConfigType,
+} from './types';
 
 export class UpgradeAssistantUIPlugin
   implements Plugin<void, void, SetupDependencies, StartDependencies>
 {
   constructor(private ctx: PluginInitializerContext) {}
+
   setup(coreSetup: CoreSetup<StartDependencies>, { management, cloud }: SetupDependencies) {
-    const { readonly } = this.ctx.config.get<Config>();
+    const {
+      readonly,
+      ui: { enabled: isUpgradeAssistantUiEnabled },
+    } = this.ctx.config.get<ClientConfigType>();
 
-    const appRegistrar = management.sections.section.stack;
-    const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
+    if (isUpgradeAssistantUiEnabled) {
+      const appRegistrar = management.sections.section.stack;
+      const kibanaVersion = new SemVer(this.ctx.env.packageInfo.version);
 
-    const kibanaVersionInfo = {
-      currentMajor: kibanaVersion.major,
-      prevMajor: kibanaVersion.major - 1,
-      nextMajor: kibanaVersion.major + 1,
-    };
+      const kibanaVersionInfo = {
+        currentMajor: kibanaVersion.major,
+        prevMajor: kibanaVersion.major - 1,
+        nextMajor: kibanaVersion.major + 1,
+      };
 
-    const pluginName = i18n.translate('xpack.upgradeAssistant.appTitle', {
-      defaultMessage: '{version} Upgrade Assistant',
-      values: { version: `${kibanaVersionInfo.nextMajor}.0` },
-    });
+      const pluginName = i18n.translate('xpack.upgradeAssistant.appTitle', {
+        defaultMessage: '{version} Upgrade Assistant',
+        values: { version: `${kibanaVersionInfo.nextMajor}.0` },
+      });
 
-    appRegistrar.registerApp({
-      id: 'upgrade_assistant',
-      title: pluginName,
-      order: 1,
-      async mount(params) {
-        const [coreStart, { discover, data }] = await coreSetup.getStartServices();
-        const services: AppServicesContext = { discover, data, cloud };
+      appRegistrar.registerApp({
+        id: 'upgrade_assistant',
+        title: pluginName,
+        order: 1,
+        async mount(params) {
+          const [coreStart, { discover, data }] = await coreSetup.getStartServices();
+          const services: AppServicesContext = { discover, data, cloud };
 
-        const {
-          chrome: { docTitle },
-        } = coreStart;
+          const {
+            chrome: { docTitle },
+          } = coreStart;
 
-        docTitle.change(pluginName);
+          docTitle.change(pluginName);
 
-        const { mountManagementSection } = await import('./application/mount_management_section');
-        const unmountAppCallback = await mountManagementSection(
-          coreSetup,
-          params,
-          kibanaVersionInfo,
-          readonly,
-          services
-        );
+          const { mountManagementSection } = await import('./application/mount_management_section');
+          const unmountAppCallback = await mountManagementSection(
+            coreSetup,
+            params,
+            kibanaVersionInfo,
+            readonly,
+            services
+          );
 
-        return () => {
-          docTitle.reset();
-          unmountAppCallback();
-        };
-      },
-    });
+          return () => {
+            docTitle.reset();
+            unmountAppCallback();
+          };
+        },
+      });
+    }
   }
 
   start() {}
diff --git a/x-pack/plugins/upgrade_assistant/public/types.ts b/x-pack/plugins/upgrade_assistant/public/types.ts
index a2b49305c32d41..cbeaf22bb095bf 100644
--- a/x-pack/plugins/upgrade_assistant/public/types.ts
+++ b/x-pack/plugins/upgrade_assistant/public/types.ts
@@ -26,3 +26,10 @@ export interface StartDependencies {
   discover: DiscoverStart;
   data: DataPublicPluginStart;
 }
+
+export interface ClientConfigType {
+  readonly: boolean;
+  ui: {
+    enabled: boolean;
+  };
+}
diff --git a/x-pack/plugins/upgrade_assistant/server/config.ts b/x-pack/plugins/upgrade_assistant/server/config.ts
new file mode 100644
index 00000000000000..4183ea337def1e
--- /dev/null
+++ b/x-pack/plugins/upgrade_assistant/server/config.ts
@@ -0,0 +1,107 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { SemVer } from 'semver';
+import { i18n } from '@kbn/i18n';
+import { get } from 'lodash';
+import { schema, TypeOf } from '@kbn/config-schema';
+import { PluginConfigDescriptor } from 'src/core/server';
+
+import { MAJOR_VERSION } from '../common/constants';
+
+const kibanaVersion = new SemVer(MAJOR_VERSION);
+
+// -------------------------------
+// >= 8.x
+// -------------------------------
+const schemaLatest = schema.object(
+  {
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    /*
+     * This will default to true up until the last minor before the next major.
+     * In readonly mode, the user will not be able to perform any actions in the UI
+     * and will be presented with a message indicating as such.
+     */
+    readonly: schema.boolean({ defaultValue: true }),
+  },
+  { defaultValue: undefined }
+);
+
+const configLatest: PluginConfigDescriptor<UpgradeAssistantConfig> = {
+  exposeToBrowser: {
+    ui: true,
+    readonly: true,
+  },
+  schema: schemaLatest,
+  deprecations: () => [],
+};
+
+export type UpgradeAssistantConfig = TypeOf<typeof schemaLatest>;
+
+// -------------------------------
+// 7.x
+// -------------------------------
+const schema7x = schema.object(
+  {
+    enabled: schema.boolean({ defaultValue: true }),
+    ui: schema.object({
+      enabled: schema.boolean({ defaultValue: true }),
+    }),
+    /*
+     * This will default to true up until the last minor before the next major.
+     * In readonly mode, the user will not be able to perform any actions in the UI
+     * and will be presented with a message indicating as such.
+     */
+    readonly: schema.boolean({ defaultValue: true }),
+  },
+  { defaultValue: undefined }
+);
+
+export type UpgradeAssistantConfig7x = TypeOf<typeof schema7x>;
+
+const config7x: PluginConfigDescriptor<UpgradeAssistantConfig7x> = {
+  exposeToBrowser: {
+    ui: true,
+    readonly: true,
+  },
+  schema: schema7x,
+  deprecations: () => [
+    (completeConfig, rootPath, addDeprecation) => {
+      if (get(completeConfig, 'xpack.upgrade_assistant.enabled') === undefined) {
+        return completeConfig;
+      }
+
+      addDeprecation({
+        configPath: 'xpack.upgrade_assistant.enabled',
+        level: 'critical',
+        title: i18n.translate('xpack.upgradeAssistant.deprecations.enabledTitle', {
+          defaultMessage: 'Setting "xpack.upgrade_assistant.enabled" is deprecated',
+        }),
+        message: i18n.translate('xpack.upgradeAssistant.deprecations.enabledMessage', {
+          defaultMessage:
+            'To disallow users from accessing the Upgrade Assistant UI, use the "xpack.upgrade_assistant.ui.enabled" setting instead of "xpack.upgrade_assistant.enabled".',
+        }),
+        correctiveActions: {
+          manualSteps: [
+            i18n.translate('xpack.upgradeAssistant.deprecations.enabled.manualStepOneMessage', {
+              defaultMessage: 'Open the kibana.yml config file.',
+            }),
+            i18n.translate('xpack.upgradeAssistant.deprecations.enabled.manualStepTwoMessage', {
+              defaultMessage:
+                'Change the "xpack.upgrade_assistant.enabled" setting to "xpack.upgrade_assistant.ui.enabled".',
+            }),
+          ],
+        },
+      });
+      return completeConfig;
+    },
+  ],
+};
+
+export const config: PluginConfigDescriptor<UpgradeAssistantConfig | UpgradeAssistantConfig7x> =
+  kibanaVersion.major < 8 ? config7x : configLatest;
diff --git a/x-pack/plugins/upgrade_assistant/server/index.ts b/x-pack/plugins/upgrade_assistant/server/index.ts
index 5591276b2fa346..660aa107292e83 100644
--- a/x-pack/plugins/upgrade_assistant/server/index.ts
+++ b/x-pack/plugins/upgrade_assistant/server/index.ts
@@ -5,18 +5,11 @@
  * 2.0.
  */
 
-import { PluginInitializerContext, PluginConfigDescriptor } from 'src/core/server';
+import { PluginInitializerContext } from 'src/core/server';
 import { UpgradeAssistantServerPlugin } from './plugin';
-import { configSchema, Config } from '../common/config';
+
+export { config } from './config';
 
 export const plugin = (ctx: PluginInitializerContext) => {
   return new UpgradeAssistantServerPlugin(ctx);
 };
-
-export const config: PluginConfigDescriptor<Config> = {
-  deprecations: ({ deprecate }) => [deprecate('enabled', '8.0.0')],
-  schema: configSchema,
-  exposeToBrowser: {
-    readonly: true,
-  },
-};
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts b/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts
index d93fe7920f1d79..5f39e902c75d99 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/__fixtures__/version.ts
@@ -4,14 +4,16 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+import { SemVer } from 'semver';
+import { MAJOR_VERSION } from '../../../common/constants';
 
-import { mockKibanaSemverVersion } from '../../../common/constants';
+const kibanaVersion = new SemVer(MAJOR_VERSION);
 
 export const getMockVersionInfo = () => {
-  const currentMajor = mockKibanaSemverVersion.major;
+  const currentMajor = kibanaVersion.major;
 
   return {
-    currentVersion: mockKibanaSemverVersion,
+    currentVersion: kibanaVersion,
     currentMajor,
     prevMajor: currentMajor - 1,
     nextMajor: currentMajor + 1,
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts
index e1817ef63927d7..1785491e5da45d 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/es_version_precheck.test.ts
@@ -9,7 +9,7 @@ import { SemVer } from 'semver';
 import { IScopedClusterClient, kibanaResponseFactory } from 'src/core/server';
 import { coreMock } from 'src/core/server/mocks';
 import { licensingMock } from '../../../../plugins/licensing/server/mocks';
-import { mockKibanaVersion } from '../../common/constants';
+import { MAJOR_VERSION } from '../../common/constants';
 import { getMockVersionInfo } from './__fixtures__/version';
 
 import {
@@ -98,7 +98,7 @@ describe('verifyAllMatchKibanaVersion', () => {
 
 describe('EsVersionPrecheck', () => {
   beforeEach(() => {
-    versionService.setup(mockKibanaVersion);
+    versionService.setup(MAJOR_VERSION);
   });
 
   it('returns a 403 when callCluster fails with a 403', async () => {
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts
index 30093a9fb6e508..957198cde8da94 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/index_settings.test.ts
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { mockKibanaSemverVersion, mockKibanaVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { versionService } from '../version';
 import { getMockVersionInfo } from '../__fixtures__/version';
 
@@ -131,7 +131,7 @@ describe('transformFlatSettings', () => {
 
   describe('sourceNameForIndex', () => {
     beforeEach(() => {
-      versionService.setup(mockKibanaVersion);
+      versionService.setup(MAJOR_VERSION);
     });
 
     it('parses internal indices', () => {
@@ -152,7 +152,7 @@ describe('transformFlatSettings', () => {
 
   describe('generateNewIndexName', () => {
     beforeEach(() => {
-      versionService.setup(mockKibanaVersion);
+      versionService.setup(MAJOR_VERSION);
     });
 
     it('parses internal indices', () => {
@@ -186,7 +186,7 @@ describe('transformFlatSettings', () => {
       ).toEqual([]);
     });
 
-    if (mockKibanaSemverVersion.major === 7) {
+    if (currentMajor === 7) {
       describe('[7.x] customTypeName warning', () => {
         it('returns customTypeName warning for non-_doc mapping types', () => {
           expect(
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts
index 3cfdb1fdd31676..ce1e8e11eb2d17 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_actions.test.ts
@@ -19,7 +19,7 @@ import {
   ReindexStatus,
   ReindexStep,
 } from '../../../common/types';
-import { mockKibanaVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { versionService } from '../version';
 import { LOCK_WINDOW, ReindexActions, reindexActionsFactory } from './reindex_actions';
 import { getMockVersionInfo } from '../__fixtures__/version';
@@ -54,7 +54,7 @@ describe('ReindexActions', () => {
 
   describe('createReindexOp', () => {
     beforeEach(() => {
-      versionService.setup(mockKibanaVersion);
+      versionService.setup(MAJOR_VERSION);
       client.create.mockResolvedValue();
     });
 
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts
index 7a5bf1c1876980..6017691a9328d8 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.test.ts
@@ -20,7 +20,7 @@ import {
   ReindexStatus,
   ReindexStep,
 } from '../../../common/types';
-import { mockKibanaVersion } from '../../../common/constants';
+import { MAJOR_VERSION } from '../../../common/constants';
 import { licensingMock } from '../../../../licensing/server/mocks';
 import { LicensingPluginSetup } from '../../../../licensing/server';
 
@@ -89,7 +89,7 @@ describe('reindexService', () => {
       licensingPluginSetup
     );
 
-    versionService.setup(mockKibanaVersion);
+    versionService.setup(MAJOR_VERSION);
   });
 
   describe('hasRequiredPrivileges', () => {

From c1b0565acdbbcf7432a46a0664a91c34f299dab3 Mon Sep 17 00:00:00 2001
From: Tre <wayne.seymour@elastic.co>
Date: Tue, 19 Oct 2021 06:56:35 -0400
Subject: [PATCH 04/10] [QA][refactor] Use ui settings - sample data (#114530)

---
 test/functional/apps/home/_sample_data.ts   | 21 +++++++++------------
 test/functional/page_objects/common_page.ts |  9 +++++++++
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/test/functional/apps/home/_sample_data.ts b/test/functional/apps/home/_sample_data.ts
index 3cf387133bc9ce..e0a96940337e24 100644
--- a/test/functional/apps/home/_sample_data.ts
+++ b/test/functional/apps/home/_sample_data.ts
@@ -31,6 +31,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     after(async () => {
       await security.testUser.restoreDefaults();
+      await PageObjects.common.unsetTime();
     });
 
     it('should display registered flights sample data sets', async () => {
@@ -74,6 +75,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
 
     describe('dashboard', () => {
       beforeEach(async () => {
+        await time();
         await PageObjects.common.navigateToUrl('home', '/tutorial_directory/sampleData', {
           useActualUrl: true,
         });
@@ -84,10 +86,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('flights');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(17);
       });
@@ -112,10 +110,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('logs');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(13);
       });
@@ -124,10 +118,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.home.launchSampleDashboard('ecommerce');
         await PageObjects.header.waitUntilLoadingHasFinished();
         await renderable.waitForRender();
-        const todayYearMonthDay = moment().format('MMM D, YYYY');
-        const fromTime = `${todayYearMonthDay} @ 00:00:00.000`;
-        const toTime = `${todayYearMonthDay} @ 23:59:59.999`;
-        await PageObjects.timePicker.setAbsoluteRange(fromTime, toTime);
         const panelCount = await PageObjects.dashboard.getPanelCount();
         expect(panelCount).to.be(15);
       });
@@ -160,5 +150,12 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         expect(isInstalled).to.be(false);
       });
     });
+
+    async function time() {
+      const today = moment().format('MMM D, YYYY');
+      const from = `${today} @ 00:00:00.000`;
+      const to = `${today} @ 23:59:59.999`;
+      await PageObjects.common.setTime({ from, to });
+    }
   });
 }
diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index 64fb184f40e486..a40465b00dbeb9 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -30,6 +30,7 @@ export class CommonPageObject extends FtrService {
   private readonly globalNav = this.ctx.getService('globalNav');
   private readonly testSubjects = this.ctx.getService('testSubjects');
   private readonly loginPage = this.ctx.getPageObject('login');
+  private readonly kibanaServer = this.ctx.getService('kibanaServer');
 
   private readonly defaultTryTimeout = this.config.get('timeouts.try');
   private readonly defaultFindTimeout = this.config.get('timeouts.find');
@@ -500,4 +501,12 @@ export class CommonPageObject extends FtrService {
       await this.testSubjects.exists(validator);
     }
   }
+
+  async setTime(time: { from: string; to: string }) {
+    await this.kibanaServer.uiSettings.replace({ 'timepicker:timeDefaults': JSON.stringify(time) });
+  }
+
+  async unsetTime() {
+    await this.kibanaServer.uiSettings.unset('timepicker:timeDefaults');
+  }
 }

From f8041e6005a10b73fd771b9b8e2c8d9a22bfce84 Mon Sep 17 00:00:00 2001
From: Pete Harverson <peteharverson@users.noreply.github.com>
Date: Tue, 19 Oct 2021 11:57:10 +0100
Subject: [PATCH 05/10] [ML] Delete annotation directly from the index it is
 stored in (#115328)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../ml/common/constants/index_patterns.ts     |  1 -
 .../ml/server/lib/check_annotations/index.ts  | 11 ++-----
 .../annotation_service/annotation.test.ts     |  3 +-
 .../models/annotation_service/annotation.ts   | 33 ++++++++++++++++---
 4 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/x-pack/plugins/ml/common/constants/index_patterns.ts b/x-pack/plugins/ml/common/constants/index_patterns.ts
index d7d6c343e282bc..9a8e5c1b8ae783 100644
--- a/x-pack/plugins/ml/common/constants/index_patterns.ts
+++ b/x-pack/plugins/ml/common/constants/index_patterns.ts
@@ -7,7 +7,6 @@
 
 export const ML_ANNOTATIONS_INDEX_ALIAS_READ = '.ml-annotations-read';
 export const ML_ANNOTATIONS_INDEX_ALIAS_WRITE = '.ml-annotations-write';
-export const ML_ANNOTATIONS_INDEX_PATTERN = '.ml-annotations-6';
 
 export const ML_RESULTS_INDEX_PATTERN = '.ml-anomalies-*';
 export const ML_NOTIFICATION_INDEX_PATTERN = '.ml-notifications*';
diff --git a/x-pack/plugins/ml/server/lib/check_annotations/index.ts b/x-pack/plugins/ml/server/lib/check_annotations/index.ts
index a388a24d082a60..e64b4658588cbf 100644
--- a/x-pack/plugins/ml/server/lib/check_annotations/index.ts
+++ b/x-pack/plugins/ml/server/lib/check_annotations/index.ts
@@ -11,22 +11,15 @@ import { mlLog } from '../../lib/log';
 import {
   ML_ANNOTATIONS_INDEX_ALIAS_READ,
   ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
-  ML_ANNOTATIONS_INDEX_PATTERN,
 } from '../../../common/constants/index_patterns';
 
 // Annotations Feature is available if:
-// - ML_ANNOTATIONS_INDEX_PATTERN index is present
 // - ML_ANNOTATIONS_INDEX_ALIAS_READ alias is present
 // - ML_ANNOTATIONS_INDEX_ALIAS_WRITE alias is present
+// Note there is no need to check for the existence of the indices themselves as aliases are stored
+// in the metadata of the indices they point to, so it's impossible to have an alias that doesn't point to any index.
 export async function isAnnotationsFeatureAvailable({ asInternalUser }: IScopedClusterClient) {
   try {
-    const indexParams = { index: ML_ANNOTATIONS_INDEX_PATTERN };
-
-    const { body: annotationsIndexExists } = await asInternalUser.indices.exists(indexParams);
-    if (!annotationsIndexExists) {
-      return false;
-    }
-
     const { body: annotationsReadAliasExists } = await asInternalUser.indices.existsAlias({
       index: ML_ANNOTATIONS_INDEX_ALIAS_READ,
       name: ML_ANNOTATIONS_INDEX_ALIAS_READ,
diff --git a/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts b/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
index 725e0ac4949449..975070e92a7ecf 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/annotation.test.ts
@@ -9,7 +9,6 @@ import getAnnotationsRequestMock from './__mocks__/get_annotations_request.json'
 import getAnnotationsResponseMock from './__mocks__/get_annotations_response.json';
 
 import { ANNOTATION_TYPE } from '../../../common/constants/annotations';
-import { ML_ANNOTATIONS_INDEX_ALIAS_WRITE } from '../../../common/constants/index_patterns';
 import { Annotation, isAnnotations } from '../../../common/types/annotations';
 
 import { DeleteParams, GetResponse, IndexAnnotationArgs } from './annotation';
@@ -42,7 +41,7 @@ describe('annotation_service', () => {
 
       const annotationMockId = 'mockId';
       const deleteParamsMock: DeleteParams = {
-        index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
+        index: '.ml-annotations-6',
         id: annotationMockId,
         refresh: 'wait_for',
       };
diff --git a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
index c6ed72de18d058..5807d181cc5669 100644
--- a/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
+++ b/x-pack/plugins/ml/server/models/annotation_service/annotation.ts
@@ -71,6 +71,7 @@ export interface IndexParams {
   index: string;
   body: Annotation;
   refresh: boolean | 'wait_for' | undefined;
+  require_alias?: boolean;
   id?: string;
 }
 
@@ -99,6 +100,7 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
       index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
       body: annotation,
       refresh: 'wait_for',
+      require_alias: true,
     };
 
     if (typeof annotation._id !== 'undefined') {
@@ -407,14 +409,37 @@ export function annotationProvider({ asInternalUser }: IScopedClusterClient) {
   }
 
   async function deleteAnnotation(id: string) {
-    const params: DeleteParams = {
-      index: ML_ANNOTATIONS_INDEX_ALIAS_WRITE,
+    // Find the index the annotation is stored in.
+    const searchParams: estypes.SearchRequest = {
+      index: ML_ANNOTATIONS_INDEX_ALIAS_READ,
+      size: 1,
+      body: {
+        query: {
+          ids: {
+            values: [id],
+          },
+        },
+      },
+    };
+
+    const { body } = await asInternalUser.search(searchParams);
+    const totalCount =
+      typeof body.hits.total === 'number' ? body.hits.total : body.hits.total.value;
+
+    if (totalCount === 0) {
+      throw Boom.notFound(`Cannot find annotation with ID ${id}`);
+    }
+
+    const index = body.hits.hits[0]._index;
+
+    const deleteParams: DeleteParams = {
+      index,
       id,
       refresh: 'wait_for',
     };
 
-    const { body } = await asInternalUser.delete(params);
-    return body;
+    const { body: deleteResponse } = await asInternalUser.delete(deleteParams);
+    return deleteResponse;
   }
 
   return {

From 0e5f2524b46da0fe147b4726b741c38283789ed7 Mon Sep 17 00:00:00 2001
From: Diana Derevyankina
 <54894989+DziyanaDzeraviankina@users.noreply.github.com>
Date: Tue, 19 Oct 2021 15:08:05 +0300
Subject: [PATCH 06/10] Respect external URL allow list in TSVB (#114093)

* Respect external URL allow list in TSVB

* Remove showExternalUrlErrorModal and onContextMenu handler for table

* Update modal message

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../lib/external_url_error_modal.tsx          | 60 +++++++++++++++++++
 .../components/vis_types/table/vis.js         | 57 ++++++++++++++----
 .../components/vis_types/top_n/vis.js         | 21 ++++++-
 3 files changed, 125 insertions(+), 13 deletions(-)
 create mode 100644 src/plugins/vis_types/timeseries/public/application/components/lib/external_url_error_modal.tsx

diff --git a/src/plugins/vis_types/timeseries/public/application/components/lib/external_url_error_modal.tsx b/src/plugins/vis_types/timeseries/public/application/components/lib/external_url_error_modal.tsx
new file mode 100644
index 00000000000000..ebb806387d9cfc
--- /dev/null
+++ b/src/plugins/vis_types/timeseries/public/application/components/lib/external_url_error_modal.tsx
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import React from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiButton,
+  EuiModal,
+  EuiModalBody,
+  EuiModalFooter,
+  EuiModalHeader,
+  EuiModalHeaderTitle,
+  EuiTextColor,
+} from '@elastic/eui';
+
+interface ExternalUrlErrorModalProps {
+  url: string;
+  handleClose: () => void;
+}
+
+export const ExternalUrlErrorModal = ({ url, handleClose }: ExternalUrlErrorModalProps) => (
+  <EuiModal onClose={handleClose}>
+    <EuiModalHeader>
+      <EuiModalHeaderTitle>
+        <FormattedMessage
+          id="visTypeTimeseries.externalUrlErrorModal.headerTitle"
+          defaultMessage="Access to this external URL is not yet enabled"
+        />
+      </EuiModalHeaderTitle>
+    </EuiModalHeader>
+    <EuiModalBody>
+      <FormattedMessage
+        id="visTypeTimeseries.externalUrlErrorModal.bodyMessage"
+        defaultMessage="Configure {externalUrlPolicy} in your {kibanaConfigFileName} to allow access to {url}."
+        values={{
+          url: (
+            <EuiTextColor color="warning" component="span">
+              {url}
+            </EuiTextColor>
+          ),
+          externalUrlPolicy: 'externalUrl.policy',
+          kibanaConfigFileName: 'kibana.yml',
+        }}
+      />
+    </EuiModalBody>
+    <EuiModalFooter>
+      <EuiButton onClick={handleClose} fill>
+        <FormattedMessage
+          id="visTypeTimeseries.externalUrlErrorModal.closeButtonLabel"
+          defaultMessage="Close"
+        />
+      </EuiButton>
+    </EuiModalFooter>
+  </EuiModal>
+);
diff --git a/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js b/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js
index 7b1db4b3626470..b3a48a997b301d 100644
--- a/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js
+++ b/src/plugins/vis_types/timeseries/public/application/components/vis_types/table/vis.js
@@ -17,6 +17,7 @@ import { createFieldFormatter } from '../../lib/create_field_formatter';
 import { isSortable } from './is_sortable';
 import { EuiToolTip, EuiIcon } from '@elastic/eui';
 import { replaceVars } from '../../lib/replace_vars';
+import { ExternalUrlErrorModal } from '../../lib/external_url_error_modal';
 import { FIELD_FORMAT_IDS } from '../../../../../../../../plugins/field_formats/common';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { getFieldFormats, getCoreStart } from '../../../../services';
@@ -53,12 +54,26 @@ class TableVis extends Component {
     const DateFormat = fieldFormatsService.getType(FIELD_FORMAT_IDS.DATE);
 
     this.dateFormatter = new DateFormat({}, this.props.getConfig);
+
+    this.state = {
+      accessDeniedDrilldownUrl: null,
+    };
   }
 
   get visibleSeries() {
     return get(this.props, 'model.series', []).filter((series) => !series.hidden);
   }
 
+  createDrilldownUrlClickHandler = (url) => (event) => {
+    const validatedUrl = getCoreStart().http.externalUrl.validateUrl(url);
+    if (validatedUrl) {
+      this.setState({ accessDeniedDrilldownUrl: null });
+    } else {
+      event.preventDefault();
+      this.setState({ accessDeniedDrilldownUrl: url });
+    }
+  };
+
   renderRow = (row) => {
     const { model, fieldFormatMap, getConfig } = this.props;
 
@@ -74,7 +89,16 @@ class TableVis extends Component {
 
     if (model.drilldown_url) {
       const url = replaceVars(model.drilldown_url, {}, { key: row.key });
-      rowDisplay = <a href={sanitizeUrl(url)}>{rowDisplay}</a>;
+      const handleDrilldownUrlClick = this.createDrilldownUrlClickHandler(url);
+      rowDisplay = (
+        <a
+          href={sanitizeUrl(url)}
+          onClick={handleDrilldownUrlClick}
+          onContextMenu={handleDrilldownUrlClick}
+        >
+          {rowDisplay}
+        </a>
+      );
     }
 
     const columns = row.series
@@ -213,8 +237,11 @@ class TableVis extends Component {
     );
   }
 
+  closeExternalUrlErrorModal = () => this.setState({ accessDeniedDrilldownUrl: null });
+
   render() {
     const { visData, model } = this.props;
+    const { accessDeniedDrilldownUrl } = this.state;
     const header = this.renderHeader();
     let rows;
 
@@ -239,16 +266,24 @@ class TableVis extends Component {
       );
     }
     return (
-      <RedirectAppLinks
-        application={getCoreStart().application}
-        className="tvbVis"
-        data-test-subj="tableView"
-      >
-        <table className="table">
-          <thead>{header}</thead>
-          <tbody>{rows}</tbody>
-        </table>
-      </RedirectAppLinks>
+      <>
+        <RedirectAppLinks
+          application={getCoreStart().application}
+          className="tvbVis"
+          data-test-subj="tableView"
+        >
+          <table className="table">
+            <thead>{header}</thead>
+            <tbody>{rows}</tbody>
+          </table>
+        </RedirectAppLinks>
+        {accessDeniedDrilldownUrl && (
+          <ExternalUrlErrorModal
+            url={accessDeniedDrilldownUrl}
+            handleClose={this.closeExternalUrlErrorModal}
+          />
+        )}
+      </>
     );
   }
 }
diff --git a/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js b/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js
index 8176f6ece28058..5eb850a7533849 100644
--- a/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js
+++ b/src/plugins/vis_types/timeseries/public/application/components/vis_types/top_n/vis.js
@@ -15,10 +15,11 @@ import { getLastValue } from '../../../../../common/last_value_utils';
 import { isBackgroundInverted } from '../../../lib/set_is_reversed';
 import { replaceVars } from '../../lib/replace_vars';
 import PropTypes from 'prop-types';
-import React from 'react';
+import React, { useState, useCallback } from 'react';
 import { sortBy, first, get } from 'lodash';
 import { DATA_FORMATTERS } from '../../../../../common/enums';
 import { getOperator, shouldOperate } from '../../../../../common/operators_utils';
+import { ExternalUrlErrorModal } from '../../lib/external_url_error_modal';
 
 function sortByDirection(data, direction, fn) {
   if (direction === 'desc') {
@@ -41,6 +42,8 @@ function sortSeries(visData, model) {
 }
 
 function TopNVisualization(props) {
+  const [accessDeniedDrilldownUrl, setAccessDeniedDrilldownUrl] = useState(null);
+  const coreStart = getCoreStart();
   const { backgroundColor, model, visData, fieldFormatMap, getConfig } = props;
 
   const series = sortSeries(visData, model).map((item) => {
@@ -83,13 +86,27 @@ function TopNVisualization(props) {
   if (model.drilldown_url) {
     params.onClick = (item) => {
       const url = replaceVars(model.drilldown_url, {}, { key: item.label });
-      getCoreStart().application.navigateToUrl(url);
+      const validatedUrl = coreStart.http.externalUrl.validateUrl(url);
+      if (validatedUrl) {
+        setAccessDeniedDrilldownUrl(null);
+        coreStart.application.navigateToUrl(url);
+      } else {
+        setAccessDeniedDrilldownUrl(url);
+      }
     };
   }
 
+  const closeExternalUrlErrorModal = useCallback(() => setAccessDeniedDrilldownUrl(null), []);
+
   return (
     <div className="tvbVis" style={style}>
       <TopN {...params} />
+      {accessDeniedDrilldownUrl && (
+        <ExternalUrlErrorModal
+          url={accessDeniedDrilldownUrl}
+          handleClose={closeExternalUrlErrorModal}
+        />
+      )}
     </div>
   );
 }

From 340271fba271dab844d0c535d2dd685233535705 Mon Sep 17 00:00:00 2001
From: Kevin Qualters <56408403+kqualters-elastic@users.noreply.github.com>
Date: Tue, 19 Oct 2021 08:34:15 -0400
Subject: [PATCH 07/10] [Security Solution] Analyze event moved outside of
 overflow popover (#115478)

---
 .../timeline_actions/alert_context_menu.tsx   | 16 +-----
 .../timeline/body/actions/index.test.tsx      | 29 ++++++++++
 .../timeline/body/actions/index.tsx           | 54 ++++++++++++++++++-
 .../__snapshots__/index.test.tsx.snap         |  2 +-
 .../timeline/body/control_columns/index.tsx   |  2 +-
 .../components/timeline/body/helpers.tsx      |  6 ++-
 6 files changed, 90 insertions(+), 19 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
index 06d61b3f0b2847..a9b6eabecff864 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/alert_context_menu.tsx
@@ -34,7 +34,6 @@ import { useExceptionActions } from './use_add_exception_actions';
 import { useEventFilterModal } from './use_event_filter_modal';
 import { Status } from '../../../../../common/detection_engine/schemas/common/schemas';
 import { useKibana } from '../../../../common/lib/kibana';
-import { useInvestigateInResolverContextItem } from './investigate_in_resolver';
 import { ATTACH_ALERT_TO_CASE_FOR_ROW } from '../../../../timelines/components/timeline/body/translations';
 import { useEventFilterAction } from './use_event_filter_action';
 import { useAddToCaseActions } from './use_add_to_case_actions';
@@ -163,30 +162,19 @@ const AlertContextMenuComponent: React.FC<AlertContextMenuProps & PropsFromRedux
     isEndpointAlert: isAlertFromEndpointAlert({ ecsData: ecsRowData }),
     onAddExceptionTypeClick: handleOnAddExceptionTypeClick,
   });
-  const investigateInResolverActionItems = useInvestigateInResolverContextItem({
-    timelineId,
-    ecsData: ecsRowData,
-    onClose: afterItemSelection,
-  });
   const { eventFilterActionItems } = useEventFilterAction({
     onAddEventFilterClick: handleOnAddEventFilterClick,
   });
   const items: React.ReactElement[] = useMemo(
     () =>
       !isEvent && ruleId
-        ? [
-            ...investigateInResolverActionItems,
-            ...addToCaseActionItems,
-            ...statusActionItems,
-            ...exceptionActionItems,
-          ]
-        : [...investigateInResolverActionItems, ...addToCaseActionItems, ...eventFilterActionItems],
+        ? [...addToCaseActionItems, ...statusActionItems, ...exceptionActionItems]
+        : [...addToCaseActionItems, ...eventFilterActionItems],
     [
       statusActionItems,
       addToCaseActionItems,
       eventFilterActionItems,
       exceptionActionItems,
-      investigateInResolverActionItems,
       isEvent,
       ruleId,
     ]
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
index 5ed9398a621e8e..1da09bcf4e25fe 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.test.tsx
@@ -185,5 +185,34 @@ describe('Actions', () => {
         wrapper.find('[data-test-subj="timeline-context-menu-button"]').first().prop('isDisabled')
       ).toBe(false);
     });
+    test('it shows the analyze event button when the event is from an endpoint', () => {
+      const ecsData = {
+        ...mockTimelineData[0].ecs,
+        event: { kind: ['alert'] },
+        agent: { type: ['endpoint'] },
+        process: { entity_id: ['1'] },
+      };
+      const wrapper = mount(
+        <TestProviders>
+          <Actions {...defaultProps} ecsData={ecsData} />
+        </TestProviders>
+      );
+
+      expect(wrapper.find('[data-test-subj="view-in-analyzer"]').exists()).toBe(true);
+    });
+    test('it does not render the analyze event button when the event is from an unsupported source', () => {
+      const ecsData = {
+        ...mockTimelineData[0].ecs,
+        event: { kind: ['alert'] },
+        agent: { type: ['notendpoint'] },
+      };
+      const wrapper = mount(
+        <TestProviders>
+          <Actions {...defaultProps} ecsData={ecsData} />
+        </TestProviders>
+      );
+
+      expect(wrapper.find('[data-test-subj="view-in-analyzer"]').exists()).toBe(false);
+    });
   });
 });
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
index 73650bd320f326..c4dae739cb251e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
@@ -21,9 +21,23 @@ import { EventsTdContent } from '../../styles';
 import * as i18n from '../translations';
 import { DEFAULT_ICON_BUTTON_WIDTH } from '../../helpers';
 import { useShallowEqualSelector } from '../../../../../common/hooks/use_selector';
-import { TimelineId, ActionProps, OnPinEvent } from '../../../../../../common/types/timeline';
+import {
+  setActiveTabTimeline,
+  updateTimelineGraphEventId,
+} from '../../../../store/timeline/actions';
+import {
+  useGlobalFullScreen,
+  useTimelineFullScreen,
+} from '../../../../../common/containers/use_full_screen';
+import {
+  TimelineId,
+  ActionProps,
+  OnPinEvent,
+  TimelineTabs,
+} from '../../../../../../common/types/timeline';
 import { timelineActions, timelineSelectors } from '../../../../store/timeline';
 import { timelineDefaults } from '../../../../store/timeline/defaults';
+import { isInvestigateInResolverActionEnabled } from '../../../../../detections/components/alerts_table/timeline_actions/investigate_in_resolver';
 
 const ActionsContainer = styled.div`
   align-items: center;
@@ -100,6 +114,24 @@ const ActionsComponent: React.FC<ActionProps> = ({
     [eventType, ecsData.event?.kind, ecsData.agent?.type]
   );
 
+  const isDisabled = useMemo(() => !isInvestigateInResolverActionEnabled(ecsData), [ecsData]);
+  const { setGlobalFullScreen } = useGlobalFullScreen();
+  const { setTimelineFullScreen } = useTimelineFullScreen();
+  const handleClick = useCallback(() => {
+    const dataGridIsFullScreen = document.querySelector('.euiDataGrid--fullScreen');
+    dispatch(updateTimelineGraphEventId({ id: timelineId, graphEventId: ecsData._id }));
+    if (timelineId === TimelineId.active) {
+      if (dataGridIsFullScreen) {
+        setTimelineFullScreen(true);
+      }
+      dispatch(setActiveTabTimeline({ id: timelineId, activeTab: TimelineTabs.graph }));
+    } else {
+      if (dataGridIsFullScreen) {
+        setGlobalFullScreen(true);
+      }
+    }
+  }, [dispatch, ecsData._id, timelineId, setGlobalFullScreen, setTimelineFullScreen]);
+
   return (
     <ActionsContainer>
       {showCheckboxes && !tGridEnabled && (
@@ -171,6 +203,26 @@ const ActionsComponent: React.FC<ActionProps> = ({
           refetch={refetch ?? noop}
           onRuleChange={onRuleChange}
         />
+        {isDisabled === false ? (
+          <div>
+            <EventsTdContent textAlign="center" width={36}>
+              <EuiToolTip
+                data-test-subj="view-in-analyzer-tool-tip"
+                content={i18n.ACTION_INVESTIGATE_IN_RESOLVER}
+              >
+                <EuiButtonIcon
+                  aria-label={i18n.ACTION_INVESTIGATE_IN_RESOLVER_FOR_ROW({
+                    ariaRowindex,
+                    columnValues,
+                  })}
+                  data-test-subj="view-in-analyzer"
+                  iconType="analyzeEvent"
+                  onClick={handleClick}
+                />
+              </EuiToolTip>
+            </EventsTdContent>
+          </div>
+        ) : null}
       </>
     </ActionsContainer>
   );
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
index 6bc2dc089494dd..25d5104a98d955 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/column_headers/__snapshots__/index.test.tsx.snap
@@ -521,7 +521,7 @@ exports[`ColumnHeaders rendering renders correctly against snapshot 1`] = `
           "compare": null,
           "type": [Function],
         },
-        "width": 108,
+        "width": 140,
       },
     ]
   }
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/control_columns/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/control_columns/index.tsx
index d38bf2136513e4..2cdc8d5f4e284e 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/control_columns/index.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/control_columns/index.tsx
@@ -9,7 +9,7 @@ import { ControlColumnProps } from '../../../../../../common/types/timeline';
 import { Actions } from '../actions';
 import { HeaderActions } from '../actions/header_actions';
 
-const DEFAULT_CONTROL_COLUMN_WIDTH = 108;
+const DEFAULT_CONTROL_COLUMN_WIDTH = 140;
 
 export const defaultControlColumn: ControlColumnProps = {
   id: 'default-timeline-control-column',
diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
index 5b993110d38b58..7032319b593330 100644
--- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
+++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/helpers.tsx
@@ -17,8 +17,10 @@ import {
 import { OnPinEvent, OnUnPinEvent } from '../events';
 import * as i18n from './translations';
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export const omitTypenameAndEmpty = (k: string, v: any): any | undefined =>
+export const omitTypenameAndEmpty = (
+  k: string,
+  v: string | object | Array<string | object>
+): string | object | Array<string | object> | undefined =>
   k !== '__typename' && v != null ? v : undefined;
 
 export const stringifyEvent = (ecs: Ecs): string => JSON.stringify(ecs, omitTypenameAndEmpty, 2);

From b402bea0658a82d028a3e5c55df4a907a18ab326 Mon Sep 17 00:00:00 2001
From: Robert Austin <robert.austin@elastic.co>
Date: Tue, 19 Oct 2021 09:33:46 -0400
Subject: [PATCH 08/10] Disable the experimental `metrics_entities` plugin by
 default. (#115460)

This was default disabled in 7.15, but we needed a code change to maintain that (consistent) behavior.
---
 x-pack/plugins/metrics_entities/server/index.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/x-pack/plugins/metrics_entities/server/index.ts b/x-pack/plugins/metrics_entities/server/index.ts
index e61dc8b7dc642e..bb80ac8e8be731 100644
--- a/x-pack/plugins/metrics_entities/server/index.ts
+++ b/x-pack/plugins/metrics_entities/server/index.ts
@@ -5,6 +5,8 @@
  * 2.0.
  */
 
+import { schema } from '@kbn/config-schema';
+
 import { PluginInitializerContext } from '../../../../src/core/server';
 
 import { MetricsEntitiesPlugin } from './plugin';
@@ -17,3 +19,10 @@ export const plugin = (initializerContext: PluginInitializerContext): MetricsEnt
 };
 
 export { MetricsEntitiesPluginSetup, MetricsEntitiesPluginStart } from './types';
+
+export const config = {
+  schema: schema.object({
+    // This plugin is experimental and should be disabled by default.
+    enabled: schema.boolean({ defaultValue: false }),
+  }),
+};

From e5a918dc7dad47e32bd9abf6b056e99ffaf0db18 Mon Sep 17 00:00:00 2001
From: Garrett Spong <spong@users.noreply.github.com>
Date: Tue, 19 Oct 2021 07:43:43 -0600
Subject: [PATCH 09/10] [SecuritySolution][Detections] Enables Index Action and
 Connector for Detection Actions (#111813)

## Summary

This PR enables the [Index Connector and Action](https://www.elastic.co/guide/en/kibana/master/index-action-type.html) for the detection engine, addressing https://github.com/elastic/kibana/issues/110550.

<details><summary>Action type available in list:</summary>
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132774871-285ff387-eebe-44ee-9172-3143d0283b09.png" />
</p>
</details>

<details><summary>No Connector UI:</summary>
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132774935-e7e71061-e3b6-40ae-bc77-4adb76132de0.png" />
</p>
</details>


<details><summary>Create Connector UI:</summary>
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132774985-50980dcf-b022-4101-809a-a2d5a617a892.png" />
</p>
</details>

<details><summary>Connector Template:</summary>
<p>

``` json
{
    "rule_id": "{{context.rule.id}}",
    "rule_name": "{{context.rule.name}}",
    "alert_id": "{{alert.id}}",
    "context_message": "Threshold Results: {{#context.alerts}}{{#signal.threshold_result.terms}}{{value}}, {{/signal.threshold_result.terms}}{{/context.alerts}}"
}
```

<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132775311-3091ed5d-d7df-4dc1-89d6-c02a93c04779.png" />
</p>
</p>
</details>



<details><summary>Documents successfully written:</summary>
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132775457-128f0e62-0978-46a6-ae6e-bd951a1d6c96.png" />
</p>
</details>


---

If wanting to store the alert index timestamp, create index first with `timestamp` field and use `Define timefield for each document` option:


```
PUT .homemade-alerts-index
{
  "mappings" : {
    "dynamic": "true",
    "properties" : {
      "@timestamp": {
        "type": "date"
      }
    }
  }
}
```
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132775842-ac6534a7-289d-426f-851b-f5f2c2bb5716.png" />
</p>

<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/132776120-2def172f-3bfa-4a7e-b041-155e817173ab.png" />
</p>




### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials (will need to update documentation if we proceed with this PR)
---
 x-pack/plugins/security_solution/common/constants.ts | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/x-pack/plugins/security_solution/common/constants.ts b/x-pack/plugins/security_solution/common/constants.ts
index 5a7e19e2cdd054..6e8d574c15860c 100644
--- a/x-pack/plugins/security_solution/common/constants.ts
+++ b/x-pack/plugins/security_solution/common/constants.ts
@@ -296,15 +296,16 @@ export const ML_GROUP_IDS = [ML_GROUP_ID, LEGACY_ML_GROUP_ID];
 */
 export const NOTIFICATION_SUPPORTED_ACTION_TYPES_IDS = [
   '.email',
-  '.slack',
+  '.index',
+  '.jira',
   '.pagerduty',
-  '.swimlane',
-  '.webhook',
+  '.resilient',
   '.servicenow',
   '.servicenow-sir',
-  '.jira',
-  '.resilient',
+  '.slack',
+  '.swimlane',
   '.teams',
+  '.webhook',
 ];
 
 if (ENABLE_CASE_CONNECTOR) {

From 5a0002fae834965e7924b448b1036ff91cbc698d Mon Sep 17 00:00:00 2001
From: Jason Stoltzfus <jastoltz24@gmail.com>
Date: Tue, 19 Oct 2021 09:51:55 -0400
Subject: [PATCH 10/10] [App Search] Update "overrides" badge (#115437)

---
 .../components/curations/components/suggestions_table.test.tsx  | 2 +-
 .../components/curations/components/suggestions_table.tsx       | 2 +-
 .../applications/app_search/components/curations/types.ts       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
index 28c368d942c1fe..439f9dabadee62 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.test.tsx
@@ -88,7 +88,7 @@ describe('SuggestionsTable', () => {
     wrapper = renderColumn(0)('test', {});
     expect(wrapper.find(EuiBadge)).toHaveLength(0);
 
-    wrapper = renderColumn(0)('test', { override_curation_id: '1-2-3' });
+    wrapper = renderColumn(0)('test', { override_manual_curation: true });
     expect(wrapper.find(EuiBadge).prop('children')).toEqual('Overrides');
   });
 
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
index b7a731c1654caf..c91468e67529e0 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/suggestions_table.tsx
@@ -42,7 +42,7 @@ const columns: Array<EuiBasicTableColumn<CurationSuggestion>> = [
     render: (query: string, curation: CurationSuggestion) => (
       <EuiLinkTo to={getSuggestionRoute(query)}>
         {query}
-        {curation.override_curation_id && (
+        {curation.override_manual_curation && (
           <>
             <EuiBadge iconType="alert" color="warning" className="suggestionsTableBadge">
               {i18n.translate(
diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts
index f00da5deec7e3a..7479505ea86da2 100644
--- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts
+++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/types.ts
@@ -15,7 +15,7 @@ export interface CurationSuggestion {
   status: 'pending' | 'applied' | 'automated' | 'rejected' | 'disabled';
   curation_id?: string;
   operation: 'create' | 'update' | 'delete';
-  override_curation_id?: string;
+  override_manual_curation?: boolean;
 }
 
 export interface Curation {